WordPress RFP: What a WordPress Website RFP Should Include (With a Template)
WordPress adds its own risks and decisions. This guide covers what a WordPress RFP should include beyond a general website RFP, and gives you a template you can copy.
A WordPress RFP is a request for proposal that already names WordPress as the platform and asks agencies to answer the questions WordPress itself creates: where it will be hosted, whether the theme is bought or built, which plugins carry the site, who keeps it updated, and who owns it at the end. A general website RFP covers goals, pages, content and budget. A WordPress website RFP adds a technical layer that decides how safe, fast and cheap the site is to run, and this post covers that layer with a template you can copy.
Do you need a WordPress-specific RFP?
You need one if WordPress is already the decision, because the risks of a WordPress project live in choices that a general RFP never asks about. WordPress sites rarely fail on design. They fail on a page builder that makes every page slow, a stack of 40 plugins nobody updates, or a licence that stops working when the agency leaves.
If you have not chosen a platform yet, write the general RFP first and leave the platform open (more on that below). The general sections are covered in the website design and development RFP guide, so this post does not repeat them. Think of the WordPress RFP as an extra chapter you add to that document.
What should a WordPress RFP include that a general website RFP does not?
It should include eight WordPress-specific sections: hosting, theme approach, page builder, plugins and licences, updates and security, performance, ownership, and maintenance. Two proposals can match on price and differ on every one of these.
Hosting. Ask where the site will live, who holds the account, and what the plan includes. Managed WordPress hosting usually bundles automatic updates for core, themes and plugins, automated backups, WordPress-specific firewall rules and built-in caching, while basic shared hosting gives you less of each, according to Bluehost's 2026 comparison of shared and WordPress hosting. Entry-level plans on both sides cost a few dollars a month, so the difference is in what is included.
Server requirements. WordPress.org recommends PHP 8.3 or greater, MariaDB 10.11 or greater or MySQL 8.0 or greater, and HTTPS; it still runs on PHP 7.4, but the official requirements page warns that older versions have reached end of life and may expose a site to security problems. Ask every agency to confirm their hosting meets the current recommendation.
Theme approach. Ask whether they will use a purchased theme, a starter theme with a child theme, or a custom theme built for you. Each is legitimate; the proposal should say which one and why.
Page builder. A page builder is a drag-and-drop editor added on top of WordPress. Ask whether they plan to use the native block editor or a third-party builder, and what happens to your pages if that builder is removed.
Plugins and licences. A plugin is an add-on that gives WordPress a feature it lacks by default. Ask for the expected plugin list, which ones are paid, who holds each licence, and the yearly cost after launch.
Updates and security. Ask who applies updates, how often, and who is responsible if an update breaks something. Patchstack's State of WordPress Security report counted 11,334 new vulnerabilities across the WordPress ecosystem in 2025, a 42 percent rise on 2024, with 91 percent in plugins and 9 percent in themes, while WordPress core had only six low-priority issues. The same report found that 46 percent of those vulnerabilities had no fix from the developer when they were disclosed. Fewer plugins and faster updates mean a safer site.
Performance. Ask for a target on Core Web Vitals (Google's page speed and stability scores) and how the chosen theme and builder will hit it.
Ownership. Ask for written confirmation that the hosting account, domain, theme files, custom code and all content belong to you. The IP side belongs in the contract; see what a website development contract should include.
What does a WordPress website RFP template look like?
A WordPress RFP template is the general website RFP plus a technical appendix of about twelve headings, each with two or three lines of your answer or your question. Copy this outline and fill in what you know; leave a question where you want the agency to recommend.
- Project summary. Who you are, what the site must do, when you need it.
- Why WordPress. Why the platform is fixed (existing site, staff skills, content workflow), or a note that it is open to challenge.
- Current site. URL, host, theme and plugins, known problems, what must be kept.
- Hosting. Preferred host if any; otherwise ask for a recommendation with monthly cost, backup policy and account owner.
- Theme approach. Purchased, starter plus child theme, or custom. State your preference or ask them to justify theirs.
- Page builder and editing. Who will edit pages after launch and how technical they are. Ask for the proposed editor.
- Plugins and licences. Full expected list, annual costs, licence holder, and a cap on plugin count.
- Updates, security and backups. Who does what after launch, on what schedule, with what response time.
- Performance and SEO basics. Target Core Web Vitals, redirect plan, XML sitemap, staging environment.
- Ownership and handover. Everything in your name at launch, admin access, documentation, a recorded walkthrough.
- Maintenance after launch. A separate monthly price and scope (see below).
- How to respond. Deadline, format, the questions you want answered, how you will score proposals.
What questions should you ask WordPress agencies?
Ask questions whose answers reveal how the agency works after launch, because that is where WordPress projects succeed or fail. These seven separate strong WordPress development RFP responses from thin ones.
- How many plugins do you expect to install, and which three could you not live without?
- Who owns every paid licence at launch, and what do I pay per year to keep them?
- If you used a page builder and I switched agencies, what would the next developer inherit?
- What hosting do you recommend, what does it cost monthly, and does it meet the current WordPress.org recommendations?
- Who applies updates, how often, and what happens if an update breaks the site on a Friday night?
- Can you show me a site you built two or more years ago that is still fast and still updated?
- What exactly is handed over at the end: admin access, hosting account, theme files, documentation?
Weak answers are vague. Strong answers name the plugins, the host, the schedule and the person.
What should a WordPress website cost?
A WordPress website for a small business usually costs less than a comparable custom build, but the range is wide and depends on custom design, content volume and integrations more than on the platform. The website cost guide for small businesses in 2026 lays out the market ranges by project size. For your RFP, state a budget range and ask every agency to split the price into build, year-one licences and hosting, and monthly maintenance. Two proposals with the same build price can differ by thousands of dollars a year once licences and maintenance are included.
Should the RFP leave the platform open?
Leave it open if you have not yet decided, and lock it if you have a real reason, such as an existing WordPress site your staff knows how to edit. An open RFP invites agencies to argue for a custom build or a different CMS, which is useful when your site needs features WordPress handles poorly, such as complex user accounts or heavy integrations. The trade-offs are covered in WordPress vs a custom website. If you leave it open, say so, and ask each agency to state the platform they propose and why, so you can compare like with like.
What should the RFP say about maintenance after launch?
The RFP should ask for a separate, priced maintenance scope, because a WordPress site that nobody updates becomes a liability within months. The Patchstack figures above are the reason: almost all WordPress security problems arrive through plugins and themes, and nearly half had no patch on disclosure day. Someone has to watch, test and update, and the RFP should name that someone.
Ask for a monthly plan that includes core, theme and plugin updates on a stated schedule, testing on staging before anything major goes live, off-site backups with a tested restore, uptime monitoring, security scanning, and a response-time promise for breakages. Ask what is not included (new features, content changes, design work) so the monthly number means something, and whether you can cancel and keep the site.
This is also where having development and SEO handled by the same long-term partner pays off: updates, redirects and speed all touch rankings, and one partner who owns both sides catches problems sooner.
Quick answers
What is a WordPress RFP?
A WordPress RFP is a request for proposal for a website that will be built on WordPress. It covers the general website sections (goals, pages, content, budget, timeline) and adds WordPress-specific ones: hosting, theme approach, page builder, plugins and licences, updates and security, performance, ownership and maintenance.
Do you need an RFP for a WordPress website?
You do if the project is large enough to compare more than one agency, roughly anything beyond a simple brochure site. A written RFP for a WordPress website forces each agency to name its hosting, plugins, update process and handover, which decide how the site performs after launch.
What should a WordPress development RFP include?
Beyond the general sections, a WordPress development RFP should include hosting and server requirements, the theme approach, the editing tool, the expected plugin list with licence costs and owners, who handles updates and security, performance targets, full ownership and handover, and a separately priced maintenance plan.
Is there a WordPress RFP template I can copy?
Yes. Use the 12-heading outline in this post, from project summary and why WordPress through hosting, theme, plugins, updates, performance and ownership to maintenance and how to respond. Fill in what you know and ask agencies to recommend the rest.
How many agencies should you send a WordPress website RFP to?
Three to five is enough. Fewer than three gives you no real comparison; more than five means you will not read the responses carefully. Send the same document to each and score them on the same questions, especially plugins, hosting, updates and ownership.
Next step
If you are drafting a WordPress RFP and want a second pair of eyes before it goes out, book a free call. You will get a written recommendation on what to add, what to cut and which answers to insist on, with no obligation afterwards.
