Only 35.7% of Next.js sites pass all three Core Web Vitals on mobile, according to HTTP Archive's September 2026 crawl of 395,345 Next.js origins, against 52.8% for the web as a whole. The framework is not slow. A Next.js build is only as fast, secure and maintainable as the decisions behind it, and most of those are invisible in a demo.
This guide is for founders and marketing leads hiring a Next.js development agency or a React development agency. It sets out the five areas the agency should own and what you should receive in each, using the Next.js documentation, Vercel's pages, the 2025 security advisories and HTTP Archive field data.
The five things a Next.js agency should own
Webflow decides hosting, caching and upgrades for you. With Next.js, someone has to decide them and keep them working: the agency, until it hands over.
| Area | What the agency owns | What you should receive |
|---|---|---|
| Architecture | Which routes are static, which render per request, where data and auth checks live | A one-page rendering map and a data access diagram |
| Hosting | Platform choice, environments, cache and scaling configuration | The project in your account, with a list of every environment variable and its owner |
| Performance | Field Core Web Vitals, not only a Lighthouse score | A baseline from real-user data and a monitoring set-up you can read |
| Security and upgrades | Patching advisories, staying on a supported major version | An upgrade log and a named contact for the next advisory |
| Handover | Transferring code, project, domains and integrations | The repository and the hosting project in your organisation, plus a runbook |
An agency can be excellent at components and careless about the right-hand column. The right-hand column is what you still have in month thirteen.
Architecture: the rendering decisions should be written down
Every route in a Next.js app is either prerendered or rendered at request time, and since version 16 a single route can be both. The production checklist in the Next.js documentation warns that request-time APIs such as `cookies` and `searchParams` opt the entire route into dynamic rendering, and the whole application if they are used in the root layout. One careless call in a shared layout turns a site of static pages into a site that renders on a server for every visitor.
Caching is now opt-in. Next.js 16, released on 21 October 2025, introduced Cache Components and the `use cache` directive. The release notes say caching under this model is "entirely opt-in", and that dynamic code runs at request time by default. Older App Router projects cached implicitly, so the same code can behave differently after an upgrade.
Auth checks belong next to the data. The same checklist tells teams to verify authentication and authorisation inside each Server Action, and not to rely on Proxy, layout or page checks alone. The 2025 middleware advisory, covered below, showed why: a request filter is not an authorisation layer.
What to ask for. A rendering map: every route, whether it is static, dynamic or partly prerendered, and why. A data access diagram showing where database calls sit and which ones check the user. An agency that cannot produce either is choosing by default. For the backend layer itself, our MVP tech stack for 2026 sets out the database, auth and payments choices we would start with, and the Next.js and Supabase architecture guide on this blog covers Row Level Security in detail.
Hosting: three routes, three sets of responsibilities
The Next.js deployment docs list four options: a Node.js server and a Docker container, which both support every feature; a static export, which supports a limited set; and platform adapters, where support varies. Only two adapters are verified against the full Next.js test suite: Vercel and Bun. Cloudflare and Netlify offer their own integrations while they build verified ones.
| Route | Feature support | What the agency must set up | Cost basis |
|---|---|---|---|
| Vercel | All, verified adapter | Team and project in your account, environment variables per environment, spend limits | Pro at $20 per developer seat a month, 1 TB transfer included, then from $0.15 per GB |
| Self-hosted Node.js or Docker | All | Reverse proxy, shared cache handler, encryption key, deployment ID, streaming, graceful shutdown | Your server or container bill, plus the time to run it |
| Cloudflare via OpenNext | Most; Node Middleware from 15.2 not yet supported | Wrangler configuration, image optimisation through Cloudflare Images | Your Cloudflare Workers plan |
| Static export | Limited: no features that need a server | A CDN or static host; images optimised by a custom loader | Static hosting only |
Sources: Next.js deploying and self-hosting docs; Vercel pricing; OpenNext Cloudflare docs, read 2026-10-28
The Hobby trap. Vercel's pricing page says its Hobby plan "is for personal, non-commercial use". A business site launched on a developer's Hobby account is a licence problem and an ownership problem at once.
Self-hosting is a configuration job. The Next.js self-hosting guide, updated 15 October 2026, says the cache lives on each instance's local disk by default, so with two containers a `revalidateTag` call on one leaves the other serving stale pages until a shared store coordinates them. All instances also need the same `NEXT_SERVER_ACTIONS_ENCRYPTION_KEY`, or users see "Failed to find Server Action" errors, plus a `deploymentId` against version skew and a proxy that does not buffer streamed responses. Each item is a line in a runbook or an outage waiting to happen.
Performance: judge the agency on field data
Lighthouse runs a lab test on one simulated device. Google's Core Web Vitals are measured on real Chrome users at the 75th percentile: Largest Contentful Paint of 2.5 seconds or less, Interaction to Next Paint of 200 milliseconds or less, and Cumulative Layout Shift of 0.1 or less (web.dev). The Next.js production checklist itself says a Lighthouse run "should be paired with looking at field data".
| Metric | Next.js, Sept 2025 | Next.js, Sept 2026 | All origins, Sept 2026 |
|---|---|---|---|
| All three passed | 28.1% | 35.7% | 52.8% |
| Largest Contentful Paint | 47.7% | 53.5% | 65.6% |
| Interaction to Next Paint | 52.5% | 59.7% | 79.4% |
| Cumulative Layout Shift | 66.4% | 73.5% | 83.4% |
| Origins measured (all three) | 243,155 | 395,345 | 8,569,446 |
Source: HTTP Archive Core Web Vitals Technology Report, read through its API on 2026-10-28; raw file research/OB-0139-httparchive-cwv-2026-10-28.json
Interaction to Next Paint is the weakest metric relative to the web, about 20 points behind, which points at client-side JavaScript: large `use client` boundaries, third-party scripts and hydration work. The overall rate rose more than seven points in a year.
The aggregate mixes marketing sites with dashboards and single-page apps, so it says little about any one build. Our Webflow or Next.js comparison breaks the same data down against Webflow and Astro. What it does say is that passing is not the default, so the agency should commit to a field-data target.
What to ask for. A real-user baseline, the `useReportWebVitals` hook or an equivalent wired to your analytics, and a bundle analysis.
Security and upgrades: the part that happens after launch
Two critical advisories in 2025 show why a Next.js app needs an owner after launch.
| Advisory | Published | Severity | What was affected | What the owner had to do |
|---|---|---|---|---|
| CVE-2025-29927, middleware authorisation bypass | 21 March 2025 | Critical, CVSS 9.1 | Self-hosted apps on versions 11.1.4 to 15.2.2 that used middleware for auth | Upgrade to 12.3.5, 13.5.9, 14.2.25 or 15.2.3; Vercel-hosted apps were protected automatically |
| CVE-2025-66478, React Server Components remote code execution | 3 December 2025 | Critical, CVSS 10.0 | App Router apps on 15.x, 16.x and later 14.3 canaries | Upgrade to a patched release such as 15.5.7 or 16.0.7, then rotate every secret if the app was online and unpatched on 4 December |
Sources: GitHub Security Advisory GHSA-f82v-jwr5-mffw; Next.js security advisory CVE-2025-66478
The December advisory is the one to quote to anyone who thinks a finished site needs no maintenance. The Next.js team wrote that there was "no workaround" and that upgrading was required, then added guidance to rotate secrets.
Version support. Under the Next.js support policy, each major stays in Active LTS until the next major ships, then in Maintenance LTS for two years from its first release, receiving only critical fixes. Version 16 is in Active LTS. Version 15 is in Maintenance LTS, and its original end date of 21 October 2026 has been extended to a date not yet announced. Version 14 and earlier are unsupported. Next.js 16 raised the minimum Node.js version to 20.9 and removed synchronous access to `params`, `cookies` and `headers`, so an upgrade is scoped work, not a version bump.
What to ask for. Which major version the agency will build on, who watches the advisories, how fast a critical patch goes out, and whether that is in the contract or billed per incident. We would expect a written answer to all four.
Handover: what moves, and what does not
A Next.js handover is two transfers and a document, and both transfers have gaps.
- The repository. GitHub's documentation says issues, pull requests, wiki, stars and commit history move with a transfer, and links to the old location redirect, while GitHub Pages URLs do not. Better still, keep the repository in your organisation from day one, with the agency as collaborators.
- The Vercel project. Vercel's docs say a project moves between teams with zero downtime in 10 seconds to 10 minutes, carrying deployments, environment variables, domains, cron jobs and the Git link. Integrations, log data, monitoring data, log drains and usage history do not move, and environment variables defined in `vercel.json` must be migrated first.
- Environment variables and third-party accounts. Every key in the project belongs to an account somewhere: the database, auth, payments, email, analytics. The handover list should name the account owner for each one.
- The runbook. How to run the project locally, how deploys work, how to roll back, where logs live, which Node.js and Next.js versions are pinned, and what to do when the next advisory lands.
- The documents from the sections above. The rendering map, the data access diagram, the performance baseline and the upgrade log.
If a lighter tool would do the job, the trade-off is worth a look before you hire a full Next.js team: our Wized vs custom code comparison sets out where a Webflow front end with a no-code app layer stops being enough.
How to check an agency before you sign
Ask about last year's advisories. How many days did the agency take to patch CVE-2025-66478 for existing clients, and did it rotate secrets? A specific answer is a good sign.
Ask where the last project lives. If previous client apps sit in the agency's own Vercel team or GitHub organisation, yours will too.
Ask for a rendering map and a field-data number. A team that decides rendering deliberately can show one in five minutes, plus a Chrome UX Report result for a site it built.
What this means for choosing a Next.js development agency
Pick the agency on the right-hand column of the first table, not only on its portfolio. The rendering map, hosting account, field-data baseline, patch record and transfer plan decide whether the app is still fast, safe and yours a year after launch. We build applications in Next.js and marketing sites in Webflow, so we have a bias towards splitting the two; we would set the five handover documents as deliverables in the scope and quote per project. Our web apps service page explains how we scope a Next.js build.
