Quick answer: a website RFP (request for proposal) is the document you send to a shortlist of agencies so their quotes answer the same questions and can be compared side by side. It needs six sections: project overview, objectives and goals, scope of work, technical requirements, evaluation criteria, and timeline and budget. Malaysian businesses need one only when several people must sign off and the decision has to be defended. If you do run one: three to five agencies, 10 to 15 working days, a published budget band, and scoring weights fixed before you read a response. A template is linked below.
Two things sink website RFPs in roughly equal measure. A brief so vague that every quote prices a different project, so you compare RM18,000 against RM140,000 and learn nothing. Or one so prescriptive that it specifies the solution instead of the problem, so you buy what you asked for rather than what you needed. This guide is for the buyer, not the agency.
What is an RFP?
RFP stands for request for proposal. It is a document a buyer sends to a shortlist of suppliers setting out the problem, the scope and the rules of the selection, then asking each of them to propose how they would solve it and what that would cost. The word “proposal” is the point: you are asking for an approach, not only a price. Three documents get confused, and sending the wrong one wastes everybody’s week.
| Document | What it asks for | When to use it |
|---|---|---|
| RFI (request for information) | Capabilities, experience and rough approach. No price, no commitment. | You do not yet know who can do the work, or what is possible, and want to build a shortlist. |
| RFQ (request for quotation) | A price against a fixed, detailed specification. | The solution is already defined and you want the cheapest competent supplier to build it. |
| RFP (request for proposal) | An approach, a team, a timeline and a price for solving a stated problem. | The problem is clear but how to solve it is part of what you are buying. Almost every website project. |
A website wants an RFP rather than an RFQ almost every time, because how the agency proposes to structure the site, handle the content and preserve rankings is part of what you are buying, and you cannot specify that without doing their job for them. An RFQ fits only when a detailed functional specification already exists and you want the cheapest competent builder of it. Government and large corporate procurement in Malaysia often runs the RFI then RFP sequence formally; most SME website projects need neither, which is the next question.
Do you actually need an RFP?
An RFP is procurement machinery. It costs you two to four days of writing and each responding agency two to five days of unpaid work. Worth it when the decision is contested, not for a five page brochure site.
| Write a full RFP when | Skip it when |
|---|---|
| Several people or a board must sign off on the choice | One person decides and owns the outcome |
| Procurement or audit rules require a documented, competitive selection | There is no formal procurement requirement |
| The site is large, integrated with other systems, or replacing one that earns real search traffic | It is a small brochure site with a handful of pages |
| The budget is large enough that a wrong choice is expensive to undo | The budget is modest and the risk of a wrong choice is low |
| You will need to defend the decision later | You already have an agency you trust and want to work with |
If the shortlist is a formality and the RFP exists to satisfy a procurement rule, say so. Agencies can tell, and will either decline or pad the price. The lighter route: one page on the business and what the site must do, one page on scope and budget band, a 45 minute call with three agencies, then written proposals from the two you liked.
The six sections, and the mistake each one usually contains
1. Project overview
Four short paragraphs: who you are, what you sell and to whom, what your current site is, and what triggered the project. The trigger is what agencies read hardest, because it says what the project is about.
Worked example: “A Shah Alam industrial fastener distributor, 34 staff, selling to contractors and OEM manufacturers. WordPress site built in 2018, 61 pages, about four enquiries a month. Being replaced because the sales team cannot send a prospect a credible product page.”
State as plain facts: current platform and host, page count, monthly sessions, enquiry volume, who owns the site internally, redesign or rebuild. If you are replacing a live site, say whether rankings matter, because preserving search visibility through a redesign changes the scope.
The mistake: founding story and vision statement, with no page count, no traffic figure and no stated reason. An agency cannot size that.
2. Objectives and goals
Write outcomes, each with a number and a date. Features belong in scope of work.
Worked example: “Increase qualified enquiries from 4 to 12 a month within six months of launch, measured as form submissions tagged contractor or OEM in GA4.”
Three to five objectives, ranked, because an agency will have to trade one against another and you want them trading in your order.
The mistake: “a modern, mobile friendly website that reflects our brand” describes the deliverable, not the goal. The other version is 14 objectives of equal weight, which is the same as none. Test each one: six months after launch, could you say whether it happened?
3. Scope of work
This section decides whether your quotes are comparable, and it is where most briefs go thin. Every blank line becomes an assumption, and every agency assumes differently.
| Item | What to state |
|---|---|
| Pages and templates | Approximate page count, number of templates and unique layouts, and the rate for pages beyond the stated count |
| Content | Who writes the copy, in which languages, in what format and by what date |
| Images and media | Who supplies photography, video and icons, and whether stock licences are included |
| Design | Number of design concepts and revision rounds, and whether a brand refresh is in or out |
| Functionality | Forms, search, filtering, bookings, ecommerce, member areas, multilingual switching |
| Integrations | CRM, email marketing, ERP or inventory, payment gateway, live chat, with the system names |
| Content migration | Which existing pages, posts and files move across, and who moves them |
| SEO and redirects | Redirect mapping, metadata, schema and Search Console handover |
| Analytics | GA4 and Google Tag Manager setup, and which conversions are tracked |
| Training and handover | CMS training sessions, documentation and admin access |
| Post-launch support | Warranty period, then maintenance, hosting and updates priced separately |
Be blunt about content. “Client supplies final copy in Word, per page, by an agreed date” and “agency writes copy from interviews” are different projects at different prices. Undecided? Price both as separate line items.
Give page count a number and a mechanism for change: “approximately 45 pages on 7 templates, up to 5 unique layouts. Pages beyond 50 quoted at the stated per page rate.” That line removes the commonest source of post-signature friction.
The mistake: “a full website with all necessary pages”, or listing pages but never saying who writes the words. Our website development cost in Malaysia breakdown shows how far the same page count swings on these variables.
4. Technical requirements
State requirements as outcomes where you can, and as specifics only where you have a real constraint. A team that runs WordPress and will maintain the site is a constraint. “Must be built in React” because somebody said it in a meeting is not; delete it.
| Area | Write it as an outcome |
|---|---|
| CMS and editing | “Marketing staff can add and edit pages, posts and products without a developer.” Name a platform only if you already run it or must maintain it. |
| Hosting | Who hosts, where, uptime expectation, backups and who pays the renewal |
| Performance | Core Web Vitals targets, the percentile and how they will be verified (see below) |
| Accessibility | A named standard, for example WCAG 2.2 level AA, and how conformance will be checked |
| Security | HTTPS, update policy, spam protection on forms and administrator access controls |
| Data protection | PDPA notice and consent on every form, where submissions are stored and for how long |
| Languages | Which languages, and whether each is a full translation or a summary |
| Browsers and devices | Current versions of the main browsers on mobile and desktop |
Performance targets. Google’s Core Web Vitals thresholds, published on web.dev, are Largest Contentful Paint within 2.5 seconds, Interaction to Next Paint of 200 milliseconds or less, and Cumulative Layout Shift of 0.1 or less, at the 75th percentile of page loads, segmented by mobile and desktop. Put exactly that in the RFP, then say how it gets verified: “PageSpeed Insights field data 30 days after launch, on the five highest traffic templates”. Without the percentile and the test method the clause is unenforceable. See our Core Web Vitals explainer.
PDPA obligations for forms. Malaysia’s Personal Data Protection Act 2010 applies the moment your site collects a name, email address or phone number. The practical asks: a collection notice stating the purpose and who the data may be disclosed to, in Bahasa Malaysia and English; consent that is not pre-ticked; a retention period; a route to request access or correction; and a named data processor arrangement wherever submissions are stored. Recent amendments added breach notification and, for some organisations, a data protection officer. Our guide to making your website PDPA compliant in Malaysia has the detail; confirm your position with the Personal Data Protection Department or a legal adviser.
The mistake: naming a stack when the real requirement was an editing outcome, or asking for “fast loading” with no number, no percentile and no test.
5. Evaluation criteria
Almost nobody includes this, and it is the highest value page in the document. It makes you decide what matters before price anchors your judgement, and gives you a written basis when somebody asks why you did not take the cheapest bid. Publish the weights: agencies respond to what is scored.
| Criterion | Weight | What a 5 looks like |
|---|---|---|
| Understanding of the problem and objectives | 20% | Restates your problem accurately and links its approach to your ranked objectives |
| Proposed approach and methodology | 20% | Clear discovery, content and SEO migration plan, with reasons for each choice |
| Relevant experience and case studies | 15% | Live sites of comparable size or sector, with the reasoning and results explained |
| Technical fit | 15% | Meets every stated requirement, including performance, PDPA and your CMS constraint |
| Team and project management | 10% | Named people, their roles, and how communication and approvals will run |
| Price and value | 15% | Within the band, itemised against the scope, with options and change rates stated |
| Ownership, support and terms | 5% | Accepts the ownership terms and offers clear post-launch support |
Score 1 to 5 per criterion, multiply by the weight, divide by 5 for a percentage. Have two people score independently before they discuss, and write the reason for every 1 or 2: those are the scores you will be challenged on. Set a minimum threshold on anything you cannot compromise on, say 3 on technical fit, and disqualify below it. Score the written response before any presentation.
The mistake: inventing the criteria after the responses arrive. By then you have seen the prices, and the weights you pick will justify the answer you already favour.
6. Timeline and budget
Give a budget band. A band of RM60,000 to RM90,000 tells an agency which version of the project to propose and lets you compare three quotes solving the same problem. Hiding it produces one quote at RM25,000 that omits content, one at RM180,000 with a brand refresh you never asked for, and no basis to judge either.
If you genuinely cannot publish a number, publish a structure: a base price against the stated scope, separately priced options, and per page and per hour rates for changes. Set the band from market data, not a guess: our website development cost in Malaysia breakdown shows what drives the figure.
Realistic phase durations for a 40 to 60 page corporate site, if your side meets the review windows:
| Phase | Typical duration |
|---|---|
| Discovery and sitemap | 2 weeks |
| Wireframes and content plan | 2 weeks |
| Visual design and revisions | 3 weeks |
| Development and content entry | 5 weeks |
| Testing, fixes and launch | 2 weeks |
| Total | About 14 weeks |
State your own review turnaround: “consolidated feedback within 5 working days at each stage”. That is what makes the agency’s timeline binding, and its absence is the usual reason a 14 week project takes 30. Before agreeing a date, read the website launch checklist.
The mistake: a launch date tied to an event, with no budget figure and no stated review capacity.
Ownership terms to state up front
Put these in the RFP, not in contract negotiation. Cheap before anyone has quoted, expensive afterwards.
| Asset | What the RFP should require |
|---|---|
| Domain name | Registered in your company’s name and account |
| Hosting account | In your name, or full administrator access with a documented handover if the agency hosts |
| CMS administrator access | A full administrator login for your team from launch day |
| Source code and theme | Ownership or a perpetual licence on final payment, with no lock-in to the agency |
| Design files | Editable source files handed over on completion |
| Content and images | Ownership of content produced for you, and licences for any stock assets in your name |
| Analytics and Search Console | GA4, Google Tag Manager and Search Console created in your own accounts, with the agency added as a user |
| Third-party licences | Premium plugins and tools listed, with who holds each licence and who pays renewals |
The analytics line matters more than it looks: if the GA4 property sits in the agency’s account, changing agency costs you your history.
Who to send it to, and how to run the window fairly
Send it to three to five agencies. Below three gives no comparison; above five creates a pile you will not read properly, and good agencies decline open calls. Shortlist on evidence: live sites of comparable size, a sector you recognise, a team you can reach. Our guide to choosing a web design agency in Malaysia covers that. Give 10 to 15 working days: below 10 you get recycled boilerplate, beyond 20 the project loses momentum.
Run the question window like this:
- One named contact, one email address, all questions in writing.
- Close questions at the midpoint, day 7 of a 14 day window.
- Compile every question, anonymise it, answer it, and send the same document to all bidders. Skip this and whoever asked the clever question gains a private advantage.
- One optional briefing call, all bidders in the same session, notes published afterwards.
- Say when bidders will hear, then tell them, losers included.
Red flags in the responses
| Red flag | Why it matters |
|---|---|
| The response does not restate your problem | It is boilerplate; the agency has not read your brief |
| A single lump-sum price with no breakdown | You cannot compare it, and every change becomes a negotiation |
| Content, SEO migration or analytics left unmentioned | These are usually the missing costs that appear after signature |
| Rankings, traffic or leads guaranteed | No one can guarantee outcomes that depend on search engines and your market |
| The agency keeps the domain, hosting, code or analytics | Leaving later becomes expensive or impossible |
| Free speculative designs with no discovery | You are judging a guess, not an approach |
| No named team, or work subcontracted without saying so | You do not know who will actually build your site |
| A timeline far shorter than every other response | Either scope is missing or the date will slip |
The template
Everything above is in a fill in the blanks document: prompts in square brackets where your details go, the scoring matrix as an editable table, the ownership terms and a submission checklist.
Download: Website-RFP-Template-Malaysia-2026.docx [download link to be added]
Treat it as a floor. Delete sections that do not apply rather than leaving them blank.
Frequently asked questions
What does RFP stand for, and who writes it?
Request for proposal. The buyer writes it, not the agency, which is the point: it fixes the questions so every response answers the same ones. In a Malaysian SME the writer is usually a marketing manager or operations lead, with input from whoever owns the budget and whoever will maintain the site afterwards.
How long should a website RFP be?
Eight to fifteen pages for most Malaysian mid-market projects. Under six usually means thin scope; over twenty-five and bidders skim. Length should come from the scope and technical sections, not company background.
Should I tell agencies my budget?
Yes, as a band. Agencies are not pricing against your number, they are deciding which version of the project to propose. Without a band you get quotes solving different problems at incomparable prices, the exact failure the RFP exists to prevent.
Can I ask for free design concepts in the response?
You can, and should not. Speculative design means judging a guess made without discovery, and agencies that do discovery properly will decline to bid. Ask instead for two case studies of comparable scale with the reasoning explained.
What if our content is not ready?
Say so, with a count of pages needing writing and who will write them. An unstated content gap is the commonest cause of a website running late, because the build finishes and then waits. Price copywriting as an option if undecided.
Do we need to mention PDPA in a website RFP?
Yes, if the site collects any personal data, which a contact form does. State the consent and notice wording requirement, where submissions are stored, the retention period and who the data processor is. Cheaper to require now than to retrofit after launch.
The bottom line
A website RFP is worth writing only when the decision is genuinely contested, and only if it is specific enough to make quotes comparable without being so prescriptive that it buys the wrong thing. The parts that do the work: the scope of work table, a published budget band, and a scoring matrix fixed before any response arrives. The parts that waste everyone’s time: company history, feature wish lists dressed as objectives, and a hidden budget. If your project is small, skip the RFP.
Want a second pair of eyes on a draft RFP before it goes out? Send it over and we will mark up the scope and technical sections against what we see in real briefs, at no cost and with no obligation to invite us to bid. Get in touch, or read how we approach web design and development in Malaysia.
