Costs and pricing
Part of A buyer's cost-register method for web design commissions
Website costs that get left out, and the questions that bring them back
Find commonly omitted website cost categories, each tied to an official source, and turn them into dated buyer-owned questions before contracting.
A cost is "hidden" here only when a website budget omits a foreseeable activity, dependency or exit obligation. It does not mean an agency concealed a charge.
For an RFP, ask: Which lines are fixed price or time and materials, and what is the unit? What is the VAT treatment and payment trigger for each line? What is the change rule and exit charge if we stop or move supplier?
What to take away
- A hidden cost is a foreseeable activity, dependency or exit obligation left out of a website budget, not a concealed agency charge.
- Ask for unit price, VAT status, period and change rule on every line. Mark unknowns as questions, not zeros.
- Accessibility, privacy, security, licensing and tax work all need separate budget rows rather than one lump sum.
- Plan exit before award, covering data formats, owners, deletion evidence, continuity and any termination charge.
- Give each applicable item an owner, evidence source, quantity, period, confidence, approval limit, review date and stop condition.
List method
Scope: England-focused website commissions. Sources are live GOV.UK, ICO, NCSC, IPO and HMRC guidance. Market averages and agency price pages are excluded. Order follows the project lifecycle.
1. Discovery and reversal
A premature platform decision can create rework and lock-in. Government Digital Service advice on choosing technology asks public teams to understand the context, prototype and preserve their ability to change direction. Private buyers can translate that into separate allowances for discovery, proof work and reversing a failed choice. The guidance is not a private-sector purchasing rule.
GDS publishes no private-sector price. A typical planning example is to separate discovery at 10 to 15 per cent of the build budget. On a £60,000 build that is £6,000 to £9,000. Treat that as an illustration, not a market rate. What sets it: interviews, prototype count, technical spikes and reversal cost.
2. Accessibility evidence and remediation
Automated checks, manual review, assistive-technology work and fixes require different effort. The Service Manual tells its government audience to budget for accessibility, including training and audit. For another organisation, a qualified accessibility and legal reviewer should define the applicable duties and sample. Keep initial assessment, correction and retest as separate budget rows.
Public sector bodies in England must meet the Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations 2018 and publish an accessibility statement. Private buyers face the Equality Act 2010.
A manual audit is quoted by template, journey and WCAG 2.2 level. Automated scans are cheap or free, while manual audits and fixes are usually four- to five-figure lines on a mid five-figure build.
What sets it: templates, components, PDFs and assistive-technology tests.
3. Privacy assessment and contract work
Forms, analytics, personalisation and account areas may change processing risks and contractual responsibilities. The ICO's DPIA material explains when likely high-risk processing needs assessment and currently warns that the guidance is under review. Include screening, data mapping, specialist advice and mitigation where the facts justify them. A supplier label cannot decide whether the buyer must complete a DPIA.
The ICO data protection fee is £40, £60 or £2,900 a year, depending on size and turnover. A DPIA itself has no fee. Legal and data-mapping quotes depend on processing types, records of processing, retention and cross-border transfers. Ask for a fixed price for screening and a capped price for mitigation.
4. Secure operation after release
Launch does not end security work. The NCSC's secure development and deployment principles cover repositories, build routes, continuing testing and flaw handling. They also state that using the principles does not guarantee a secure product. Budget ownership for dependency updates, vulnerability reports, remediation, incident evidence and recovery rather than grouping all security under the build fee.
Cyber Essentials certification is priced by IASME approved bodies, so check current fees. A basic certification is usually a low four-figure line, while Plus and penetration testing are quoted by scope. What sets it: number of environments, user accounts, dependencies and incident-response cover. Name the owner of each security line in the contract.
5. Rights and licence limits
Logos, fonts, imagery, copy, code, plugins and design files may have different owners or licence terms. The Intellectual Property Office says commissioned-work copyright usually begins with the creator unless the parties agree otherwise in writing. The buyer should fund an asset register and qualified contract review. It should also record renewals, permitted uses, source files and replacement options.
IPO fees are public: a trade mark application is £170 plus £50 per class, and a design registration is £50. Copyright registration has no fee. Font, image, plugin and code licences are set by each rights holder. Ask for a renewal schedule and a replacement price for every non-transferable asset.
6. Tax and invoice reconciliation
A proposal amount may be net or gross, while input-tax recovery depends on transaction and buyer. GOV.UK's VAT charging guidance states VAT-registered businesses must show tax separately and apply the applicable current rate.
Keep net charge, VAT, gross cash and reviewed recoverability separate. Add the internal effort needed to match an invoice to accepted deliverables and resolve credits or disputes.
The standard VAT rate is 20 per cent. The VAT registration threshold is £90,000 from 1 April 2024. Recovery depends on the buyer's VAT status and the supply. HMRC's guidance is the anchor. Ask for a VAT-inclusive total and a VAT-exclusive breakdown.
7. Hosting, migration and exit overlap
A move can require parallel hosting, data export, redirects, DNS work, licences, testing and supplier assistance. Government hosting guidance tells public teams to consider lifetime operating cost, flexible billing and full migration expense. Ask for a practical exit plan before award, including formats, owners, deletion evidence, continuity and any charge triggered by termination.
Cloud exit charges are real. AWS lists data transfer out to the internet at about $0.09 per GB after the first 100 GB each month, so check the current price for your region. Nominet sets the wholesale fee for .uk domain names, and registrars add their own margin.
Ask for an export and deletion price, not just a migration price.
Controls and exit checks
Assign each applicable item an owner, evidence source, quantity, period and confidence. Add approval limit, review date and stop condition. Do not apply a blanket uplift to an unexplained subtotal.
Pause the purchase when a mandatory gate lacks a costed route, an essential licence is unidentified, or continuity depends on untested export. This list informs scoping, not legal, tax or financial advice.
Worked planning example, not a quote:
| Planning line | Example amount |
|---|---|
| Build fee | £60,000 |
| Discovery at 10 per cent | £6,000 |
| Accessibility audit and retest | £3,000 |
| ICO data protection fee | £60 |
| Cyber Essentials | £1,500 |
| Asset register and contract review | £500 |
| Export and domain exit | £500 |
| Net planning total | £71,560 |
| VAT at 20 per cent | £14,312 |
| Gross planning total | £85,872 |
- Ask for unit price, VAT status, period and change rule
- Separate discovery, proof work and reversal allowances
- Keep assessment, correction and retest as distinct rows
- Budget for dependency updates, vulnerability reports and recovery
- Fund an asset register and qualified contract review
- Request a practical exit plan before award
Common questions
What makes a website cost hidden rather than concealed?
The article defines a hidden cost as a foreseeable omission. It is not a concealed charge. To test a proposal, ask for unit price, VAT status, period and change rule.
Why should accessibility assessment, correction and retest be separate budget rows?
Automated checks, manual review, assistive-technology work and fixes each require different effort. The Service Manual tells its government audience to budget for accessibility, including training and audit. For another organisation, a qualified accessibility and legal reviewer should define the applicable duties and sample, so keeping initial assessment, correction and retest apart reflects that split.
What should an exit plan cover before a contract is awarded?
Ask for a practical exit plan before award, including formats, owners, deletion evidence, continuity and any charge triggered by termination. Government hosting guidance tells public teams to consider lifetime operating cost, flexible billing and full migration expense. A move can also require parallel hosting, data export, redirects, DNS work, licences and testing.
