Corporate website development: pages, governance, stack and compliance

The short answer

A corporate website is the company's official record online, where buyers, investors, journalists, candidates, partners and regulators check who you are. Building one is mostly about the parts a small-business site skips: leadership, a newsroom, investor relations if you're listed, careers fed by your applicant tracking system, locations, legal pages, an accessibility statement and often several languages. Around them sit the controls that let many people edit safely: roles, approvals, single sign-on and an audit log.

Those controls decide the platform and much of the cost. On 7 November 2026, Webflow's Team plan cost $2,500 a month on an annual contract and its Enterprise plan, the one with single sign-on, was quote-only; WordPress VIP, Sitecore and Adobe Experience Manager published no prices. Build to WCAG 2.2 AA, with privacy settings that fit your visitors' laws and a basic set of security headers. To price the build, see how much a website costs in the US.

What a corporate website is, and who it serves

A corporate website presents the company itself, not one product or campaign. It answers people deciding whether to trust the company, and most arrive with one task:

• Buyers and procurement teams check that the company is real, stable and secure enough to work with.
• Investors and analysts look for results, filings, governance documents and events.
• Journalists want facts, a media contact and images they may use.
• Candidates want the open roles and a reason to apply.
• Partners and suppliers need to know whom to contact.
• Regulators and the public read the legal notices, policies and accessibility statement.

What is an enterprise website?

An enterprise website is a corporate website run at a larger scale: several brands, regions or languages, dozens of editors, and an IT and procurement process around it. The pages are mostly the same; the operating model changes. It needs single sign-on so access follows the company directory, roles that limit who can publish what, approvals, an audit log, uptime commitments in a contract and a vendor that can answer a security questionnaire. Those features are where platform prices jump.

The pages and features that set it apart

A small-business site can be five pages and a form. A corporate site carries obligations to several audiences at once. This is the core set, who uses each part and what it needs:

Investor relations, if the company is listed

For a US-listed company, the website is part of disclosure practice. Under the SEC's 2008 guidance on company websites, whether a posting counts as public for Regulation FD depends on whether the site is a "recognized channel of distribution", whether the posting reaches the market in general, and whether investors have had time to react. One rule is specific: an issuer that maintains a corporate website must post its insiders' Forms 3, 4 and 5 by the end of the business day after filing and keep each one up for at least 12 months (17 CFR 240.16a-3(k)).

What the section must publish is your securities counsel's call; the web team's job is to make it fast, accessible and clearly dated.

Careers: let the applicant tracking system own the jobs

Don't copy job ads into the CMS by hand. Applicant tracking systems publish open roles through an API; Greenhouse's Job Board API needs no authentication to read them (Greenhouse). Pull the roles into your own templates and add JobPosting structured data so they can appear in Google's job results. Google treats stale listings as a policy problem: a closed role needs a validThrough date in the past, a 404 or 410 response, or no markup, and failing to expire jobs "may result in a manual action" (Google Search Central).

Languages: translate what you can maintain

Every language is another site to keep accurate. Google asks that each language version list itself and every other version, and ignores tags that don't point both ways (Google Search Central). Size the commitment honestly. When we retired 15 machine-translated languages on dardo.studio in October 2026, they made up 795 of the site's 954 URLs and brought about four search clicks a week; each now redirects to its English version. Our multilingual SEO guide covers the setup. For the cost of each extra language, see what website localization costs.

Governance: who can change what

A corporate site is edited by many people and owned by a few. Write the governance down before the build, because the platform tier, the roles and the workflow all follow from it.

Then ask each platform and vendor for these controls:

• Single sign-on with your identity provider, plus SCIM or just-in-time provisioning, so someone who leaves loses CMS access the same day.
• Roles that limit who can publish where, down to a page or collection.
• A publishing workflow: staged changes, review, approval and a record of what went live.
• An audit log you can export for compliance or incident review.
• Review cycles: every page has an owner and a next-review date, and the privacy policy is reviewed whenever a new tool starts collecting data.
• Vendor offboarding: agency accounts closed or downgraded at handover.

Stack options and what they cost

Prices below are from each vendor's own page, read on 7 November 2026, in US dollars.

Two things the table doesn't show. A platform fee buys hosting and an editor, not the design, content or integrations. And the jump between tiers usually comes from governance, not traffic: on Webflow, single sign-on and the audit logs API sit on Enterprise, above a Team plan that comes to $30,000 a year by our arithmetic.

How to narrow it down: For the full field of enterprise platforms, see our enterprise CMS comparison.

• A few editors, no directory requirement: Webflow Premium or a headless CMS on a growth plan. Our Webflow pricing guide and Webflow vs WordPress compare the details.
• Single sign-on and audit logs required by procurement: quote Webflow Enterprise, WordPress VIP and an enterprise headless CMS side by side.
• Strict speed targets, several languages or content reused in apps: a headless CMS with Astro or Next.js. See headless vs traditional CMS and Astro vs Next.js.
• A marketing suite already chosen: Sitecore or Adobe, with a certified partner.

Compliance and risk

This section is a plain-language summary for planning, not legal advice. Your counsel decides which rules apply.

Accessibility: WCAG 2.2 AA

The Department of Justice's guidance on web accessibility, published on 18 March 2022, says the ADA applies to the goods and services businesses offer on the web, that the department "does not have a regulation setting out detailed standards", and that existing standards such as WCAG provide helpful guidance. Courts have filled the gap unevenly; our guide to ADA website compliance covers the case law and lawsuit numbers.

The practical target is WCAG 2.2 Level AA, a W3C Recommendation since 5 October 2023. Most sites miss it today: WebAIM's February 2026 scan found detectable WCAG failures on 95.9% of the top million home pages (WebAIM). On a corporate site, the riskiest content is often not the templates but the documents: annual reports, investor decks and press-release PDFs. Plan accessible versions of those, publish an accessibility statement, and check your templates with our WCAG 2.2 checklist.

Privacy and cookie consent

• California. The CCPA covers for-profit businesses doing business in California with gross annual revenue of $26.625 million or more (since 1 January 2025), or that buy, sell or share the personal information of 100,000 or more California residents or households, or earn half their revenue from selling or sharing it. They must link the privacy policy from the home page with the word "privacy", offer a "Do Not Sell or Share My Personal Information" or "Your Privacy Choices" link, and honor signals such as Global Privacy Control (California Privacy Protection Agency).
• The European Union. The GDPR reaches a company outside the EU when it offers goods or services to people in the EU or monitors their behaviour there (GDPR, Article 3(2)). Separately, the ePrivacy Directive requires consent before storing or reading information on a visitor's device, except where that is strictly necessary for the service the visitor asked for (Article 5(3)). In practice: no analytics or advertising cookies before consent for those visitors.
• Everywhere. Inventory every tag and form, make the privacy policy match what the site collects, and use a consent tool that blocks tags until the visitor's choice allows them.

Security headers and a security contact

Set these on every response; the values are OWASP's recommendations:

Check the platform before you promise headers to IT: Webflow lists HSTS and custom security headers on Team and Enterprise, while its Basic and Premium security rows list two-factor authentication and DDoS protection. On a site you deploy yourself, headers live in your configuration. Add a security.txt file too: RFC 9116 makes its Contact and Expires fields mandatory.

Process and timeline

Corporate projects follow the same phases as any website, with more people at each gate:

1. Discovery: audiences, goals, governance, a content inventory, the integrations (applicant tracking, CRM, IR feed, consent, single sign-on) and legal requirements.
2. Information architecture and content model: pages, URL patterns and CMS collections for people, offices, releases and jobs.
3. Design system: accessible components built once.
4. Build and integrations, on a password-protected staging site.
5. Content: writing, approvals, translation and migration, with a redirect for every URL that changes; our website migration SEO checklist covers that step.
6. Testing: keyboard and screen reader checks, security headers, speed, forms, analytics and consent.
7. Launch and handover: editor training, written governance and an access review.

Published timelines are ranges. iDesign, a web design agency, puts small-business sites at 10 to 16 weeks and enterprise or highly custom projects at six months to a year, and calls late content "the single most common cause of timeline slippage" (iDesign). Clutch, which collects verified client reviews, says most web design projects reviewed on its platform last 7 months (Clutch). Legal and IR reviews take calendar time too, so book them into the plan. Our guide on how long it takes to build a website breaks the phases down. If you're replacing an existing site, our website redesign timeline breaks the phases down by scope.

Budget

We found no survey of corporate website costs specifically. The closest published data is Clutch's web design pricing guide, updated 21 September 2026: an average project cost of $38,105, a note that most projects reviewed there cost under $10,000, and US firms at $100 to $149 an hour (Clutch). The average is pulled up by a minority of large projects, and Clutch publishes no median.

The scope in this guide is what makes a project large: HR and IR integrations, several languages, legal review, accessibility testing and a platform tier with single sign-on. Price each as its own line and add the recurring costs from the stack table. Our US website cost guide shows how hours and rates become a quote, and the website cost calculator gives a range from published prices. Dardo quotes each project from its scope in an itemized written proposal (pricing).

Vendor-selection checklist

Send every vendor the same brief, which our free website RFP template helps you write, and compare their answers to these:

1. Similar work: live corporate or B2B sites with several editors, approvals or languages. Visit them on your phone.
2. A platform recommendation with reasons, including the tier your governance needs and its price.
3. Accessibility: the standard (WCAG 2.2 AA), manual testing with assistive technology, and who writes the statement.
4. Security: single sign-on setup, headers, who has production access and how they answer your questionnaire.
5. Integrations: who builds and who maintains each one.
6. Content and migration: who writes, who migrates and how redirects are tested.
7. Ownership: domain, hosting and CMS accounts in your company's name; code and design files handed over.
8. The team: who does the work, overlapping hours and what happens if someone leaves.
9. After launch: response times, a maintenance price and editor training.
10. The exit: how you would move to another vendor or platform.

Our guide on how to compare web design studios adds a scoring sheet, and our B2B website examples show how established companies structure the pages buyers check.

What to do next

Write the brief first, with the audiences, pages, governance and integrations from this guide. If you'd like Dardo to propose the build, see web development, or B2B website design if the site sells to buying committees. If accessibility is urgent, start with a web accessibility audit, or send us your brief.