An SEO RFP template is a ready-made request for proposal you send to three to five SEO agencies. Every answer lines up. You score them side by side. A good one has twelve parts, from your goals and tech stack to AI search, security and data, and a weighted scoring sheet. The full template is below, ready to paste into your own document. Under it sit the security questions your IT team will ask, a scoring sheet with a worked example, and the red flags to cut early.
I'm Brenden House, and I run Searchmaxxed, an SEO and AI SEO agency. So I'd be one of the people answering your RFP. I'll point out where that shows.
In summary
Send a short, specific RFP to three to five agencies, score every reply on one weighted sheet, then test the finalists on your site.
- Put twelve sections in it, including AI search and a security and data block. IT will ask for the second one anyway.
- Give a budget range. Without one, agencies guess, and you can't compare the proposals that come back.
- Ask for monthly output in numbers, such as pages built, fixes shipped and links earned, because hours and activity lists hide the work.
- Grant read-only access during the RFP. Google's own advice is to "only grant read access to Search Console" at the audit stage.
- Fix the weights before proposals arrive, then score alone before the group talks.
What is an SEO RFP?
An SEO RFP (request for proposal) describes your business, your search goals and the work you need, then asks agencies the same questions. Same format, too. It turns a set of sales pitches into proposals you can compare.
Three related documents get mixed up, so here they are in plain terms:
| Document | What it asks for | When to use it |
|---|---|---|
| RFI (request for information) | A short capability summary from many agencies | You don't know who's out there yet |
| RFP (request for proposal) | A full plan, team, method and price against your brief | You know the problem and want a shortlist's best answer |
| RFQ (request for quote) | A price for a fixed, defined piece of work | The scope is settled, such as one migration or one audit |
A statement of work (SOW) comes after the RFP. It's the signed list of what the winning agency will deliver.
Enterprise, B2B SaaS, venture-backed, manufacturing and public-sector teams usually need an RFP because procurement wants a record of how the team made the choice. That's a fair reason. It's also why so many RFPs read like they're for the auditor instead of the agency.
When should you run an SEO RFP, and when should you skip it?
Run an RFP when the contract needs procurement sign-off, when several teams share the website, or when you're replacing an agency and must show why. Skip it when you need one fixed piece of work, like a technical audit, and a request for quote will do.
The test I'd use: will you spend more than a few weeks of the team's time living with this choice? Then the RFP pays for itself. A six-week process for a one-off audit is backwards. Public-sector teams follow their own procurement rules on process, so use this template for the content that goes inside those rules. Get two or three quotes instead. If you're unsure what a good audit contains, what an SEO audit includes sets it out.
What should an SEO RFP include?
An SEO RFP should include twelve sections, running from your company overview and goals through security, measurement, commercials, timeline and a scoring sheet. Each one exists to make the proposals comparable.
Here's what each section does:
| Section | What you give | What you ask for |
|---|---|---|
| 1. Company overview | Products, markets, customers, competitors | Their read of your market |
| 2. Goals | Business targets: pipeline, demo requests, sales by market | How they'd tie search work to those targets |
| 3. Current position | Search Console trend, top pages, past agencies, known problems | What they see on your site today |
| 4. Scope | Technical SEO, content, links and digital PR, international, migration | What's in, what's out, what they'd do first |
| 5. Technical environment | CMS, framework, hosting, release process, who deploys | How their changes reach production |
| 6. AI search | Which engines matter: ChatGPT, Gemini, Perplexity, AI Overviews, AI Mode | How they track and improve your visibility there |
| 7. Security and data | Your access, privacy and AI rules | Answers to your security questions |
| 8. Measurement | Your GA4, CRM and attribution setup | A sample report and how they'd check your tracking |
| 9. Team | Who on your side owns this | Named people, roles and time on your account |
| 10. Commercials | Budget range and preferred terms | Price in your format, what each month delivers |
| 11. Timeline | Dates for questions, proposals, finalists and start | Confirmation they can meet it |
| 12. Response format | Page limit, file type, the scoring sheet | Answers in your section order |
Two sections separate a useful RFP from a generic one. Section 3 gives agencies your real data, so the proposal they write is about your site and not a stock deck. Section 5 decides whether the work ever ships, and on large sites that's where most SEO plans stall. Our enterprise SEO service puts it bluntly: enterprise SEO "dies in the queue, never in the SERP."
The SEO RFP template (copy and paste)
Copy everything in the box into your own document, then replace the brackets. Delete any line that doesn't apply.
```text SEO REQUEST FOR PROPOSAL [Company name] | Issued [date] | Proposals due [date, time, time zone] Contact for all questions: [name, role, email]
- ABOUT US
- What we sell: [products or services, in one paragraph]
- Who buys it: [buyer roles, company sizes, industries]
- Markets: [countries, languages, regions]
- Main competitors in search: [3 to 5 names or domains]
- Website(s) in scope: [domains, subdomains, number of indexed pages if known]
- WHAT WE WANT SEARCH TO DO
- Business goal for the next 12 months: [e.g. more demo requests from organic search in AU and US]
- How we measure it today: [pipeline from organic, key events in GA4, CRM source field]
- Searches and topics that matter most: [10 to 20 examples]
- WHERE WE ARE NOW
- Organic trend, last 16 months: [attach a Search Console export]
- Top landing pages by leads: [list]
- Past SEO work and agencies, and what changed: [short history]
- Known problems: [migrations, traffic drops, indexing issues, slow templates]
- SCOPE OF WORK
Tell us what you would do, in what order, and why. Cover:
- Technical SEO: crawling, indexing, site speed, Core Web Vitals, structured data, international setup (hreflang) if relevant
- Content and on-page: new pages, rewrites, internal links
- Links and digital PR
- Any site migration or redesign planned for [date]
State clearly what is NOT included.
- OUR TECHNICAL ENVIRONMENT
- CMS / framework: [e.g. headless CMS on Next.js]
- Who can deploy to production, and how often we release: [e.g. our dev team, fortnightly sprints]
- Tell us how your changes reach production: direct edits, pull requests, or tickets for our team.
- AI SEARCH (GEO / AEO)
- Engines that matter to us: [ChatGPT, Gemini, Perplexity, Copilot, Google AI Overviews, AI Mode]
- How would you track whether these engines name us, and against which competitors?
- What would you change on our site and off it to get us named?
- What does that work add to the price, if anything?
- SECURITY AND DATA
Answer every question in Appendix A (security and data questionnaire).
- MEASUREMENT AND REPORTING
- Attach a sample monthly report (anonymised).
- How would you check that our conversion tracking works before you report on it?
- How do you separate bot traffic from real visits in AI and referral reporting?
- Which numbers would you report to our executive team?
- TEAM
- Name the people who would work on our account, their roles, and the share of their week.
- Who leads strategy, and who do we speak to day to day?
- Who will present at the finalist meeting? (It must be the delivery team.)
- COMMERCIALS
- Our budget range: [range, per month or per year, currency, tax treatment]
- Price your proposal in this format: one-off costs, then monthly cost, then anything billed separately.
- State what ships each month as numbers: pages, fixes, links or placements.
- Terms you offer: [e.g. monthly, 6 or 12 months], notice period, what we keep at exit.
- TIMELINE
- Written questions due: [date]. We share all answers with every agency.
- Proposals due: [date]
- Finalist meetings: [dates]
- Decision: [date] Start: [date]
- HOW TO RESPOND AND HOW WE SCORE
- [10 to 15] pages, PDF, answers in the section order above.
- We score every proposal on the weighted sheet in Appendix B.
- References: two current clients of similar size we may call.
APPENDIX A: Security and data questionnaire [paste from the next section] APPENDIX B: Scoring sheet [paste from the scoring section] ```
Want it shorter? Keep sections 2, 3, 4, 8, 10 and 12. Those six carry most of the signal.
What security and data questions should an SEO RFP ask?
An SEO RFP should ask what access the agency needs, how it handles your data, which AI tools touch it and what happens at exit. Search work reaches your analytics, your website code and sometimes your lead data, so your IT team will ask these questions in any case. Asking them in the RFP saves a month at contract stage.
Start with access, because it's the easiest place to over-share. Google's help pages set out the roles:
| System | Role to give during the RFP | Role during the work | What the extra role adds |
|---|---|---|---|
| Google Search Console | Restricted user: "simple view rights on most data" | Full user, if they'll run tests or submit sitemaps | Full users "can take some actions"; only owners can add users |
| Google Analytics 4 | Viewer: sees settings and data | Marketer, if they'll set up events and key events | Marketers "can create, edit, and delete audiences, events, and key events" |
| Website code or CMS | None, or a staging copy | Branch and pull-request access; you approve each merge | Production rights only if your team agrees |
| CRM or lead data | None | A read-only export of lead source and stage | Personal data stays out unless you decide otherwise |
Google's guidance on hiring an SEO is direct about this: "only grant read access to Search Console (at this stage, don't grant them write access)". The same page adds, "Ultimately, you are responsible for the actions of any companies you hire". GA4 even lets you hide cost and revenue metrics from a user with its "No Cost Metrics" and "No Revenue Metrics" restrictions.
Then paste this as Appendix A:
- Access. List every system you need access to, the role, and why. Do you use named logins for each person, never shared ones?
- Off-boarding. When someone leaves your team or the contract ends, how soon do you remove their access?
- AI tools. Which AI models and tools will see our data or content? Does any provider train on it? Can you switch that training off for our account?
- Personal data. Will you receive personal information, such as lead names or emails? Where will it sit, and in which countries?
- Sub-processors. List the third-party tools that will receive our data: crawlers, rank trackers, AI tools, reporting software.
- Certifications. Do you hold a SOC 2 report or ISO/IEC 27001 certification? If not, attach your information security policy.
- Incidents. How soon will you tell us about a security incident that affects our data?
- Code changes. How do changes reach our site? Who reviews them, and how do you roll one back?
- Exit. At the end, what do you hand back, and what do you delete? Name the accounts, content, tracking history and reports.
Two notes on the law. For Australian organisations, Australian Privacy Principle 8 covers personal information sent overseas. The OAIC's APP 8 guidelines say you must take reasonable steps so the overseas recipient doesn't breach the APPs. Under section 16C, your organisation can answer for what that recipient does, so question 4 matters when an agency stores data offshore.
For US teams, a SOC 2 report is the usual vendor evidence. It's an auditor's report on a firm's controls against the AICPA's Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. Many good agencies won't have one. A clear security policy and straight answers to the nine questions above often satisfy a vendor review instead. Check with your own security team first.
At Searchmaxxed, every managed package answers the ownership question the same way: you own the site, repository, content and data from day one. We don't hold your accounts in our name.
How should you score SEO agency proposals?
Score proposals on a weighted sheet you fix before any proposal arrives. Each reviewer scores alone from 1 to 5 per criterion, you multiply by the weight, and you compare totals only after everyone has finished.
Here are the weights I'd start from. They're my judgement, not an industry standard, so move them to fit your goals.
| Criterion | Weight | A 5 looks like |
|---|---|---|
| Understanding of your search problem | 20% | Names specific pages, competitors and searches from your site |
| Plan and monthly output | 20% | A 90-day plan, then output stated as numbers each month |
| Delivery inside your stack | 15% | Shows exactly how changes reach production in your release process |
| Measurement and reporting | 15% | Checks your tracking first; reports leads and pipeline as well as traffic |
| Team | 10% | Named people with the time each gives you, and they're in the room |
| Security and data | 10% | Answers all nine questions in plain words |
| Commercials and terms | 10% | Price in your format, with clear exit terms and ownership |
Price sits at 10% on purpose. On a large site, a plan that ships beats a plan stuck in a ticket queue by far more than two quotes differ. If procurement insists on a higher price weight, raise it, but keep "delivery inside your stack" above it. Yes, that weighting favours agencies that build the work themselves, which is how we sell. Treat it as my bias.
A worked example: a B2B SaaS company scores three agencies
Take a B2B SaaS company selling into Australia and the US, on a headless CMS with fortnightly releases. It sends the RFP to three agencies. These are example scores, not real agencies.
| Criterion (weight) | Agency A | Agency B | Agency C |
|---|---|---|---|
| Understanding (20%) | 3 | 5 | 4 |
| Plan and output (20%) | 3 | 4 | 4 |
| Delivery in stack (15%) | 2 | 4 | 5 |
| Measurement (15%) | 3 | 4 | 4 |
| Team (10%) | 4 | 3 | 5 |
| Security and data (10%) | 5 | 3 | 4 |
| Commercials (10%) | 5 | 3 | 3 |
| Weighted total out of 5 | 3.35 | 3.90 | 4.15 |
Agency A had the cheapest quote and the neatest security pack. It also proposed a long list of tickets for the client's developers, which is how SEO plans die on headless sites. Agency C wrote merge-ready changes into its plan, named the engineers who'd ship them and showed how each change would reach production. It wins, even though it isn't the cheapest. That's the point of fixing the weights early: the sheet keeps a low price from winning the room.
What red flags should you look for in an SEO RFP response?
The biggest red flags are vague output, missing names and over-reaching access. If you can't tell what ships each month, who does it, or why the agency wants owner rights, cut it before the finalist round.
| Red flag | Why it matters | What to ask |
|---|---|---|
| The proposal could be about any company | They haven't looked at your site or your search results | "Name three pages you'd change first, and why" |
| Monthly output in hours or "activities" | You can't count what you're buying | "How many pages, fixes and links ship in month two?" |
| No named team, or the delivery team skips the pitch | The people who sold it won't be the ones doing it | "Who will work on this each week, and can they present?" |
| Asks for owner or admin access before signing | More access than a proposal needs | "What can you do with Restricted access only?" |
| Accounts, content or tools held in their name | You lose the work and the history when you leave | "What exactly do we keep if we end the contract?" |
| The report covers rankings and traffic, nothing else | Traffic can rise while leads fall | "Show a report that ties search to leads or pipeline" |
| Vague about where links come from | Google's spam policies define link spam as links made "primarily for the purpose of manipulating search rankings" | "Where would our links come from? Show three examples" |
| Can't say which AI tools see your data | Your content or customer data may end up somewhere you didn't approve | "List every AI tool that will touch our data" |
Read this line from Google's hiring page aloud: "Be careful if a company is secretive or won't clearly explain what they intend to do". For the wider questions to ask any agency, see how to choose an SEO agency.
How should you handle AI search (GEO and AEO) in an SEO RFP?
Put AI search in the main scope, name the engines you care about, and ask how each agency would track and lift you there. A section titled "AI and the future" invites a slide of buzzwords. Concrete questions get concrete answers.
Two terms first, since agencies use them loosely:
- GEO (generative engine optimisation) means getting your business named in AI-written answers.
- AEO (answer engine optimisation) is structuring your pages so engines can lift a direct answer, including Google's AI Overviews.
Ask each agency to run three of your buyer questions in ChatGPT, Gemini and Perplexity before the finalist meeting. Then have them show which brands those engines name today and what they'd change first. It beats a page of method.
Ask about cost plainly too. Some agencies fold AI search into SEO and others charge for it as an add-on. At Searchmaxxed, GEO and AEO sit inside every managed package, with the technical SEO and content they depend on.
How do you check an agency's measurement before you sign?
Ask for an anonymised sample report and one question back: how would they check your tracking before reporting on it? Agencies that report on broken tracking produce confident, wrong numbers. Enterprise analytics setups break in quiet ways.
Two things we found on one enterprise B2B client's account show why. The first is about conversions:
> A client's four enquiry types never counted as conversions. Their event names ran 41 to 50 characters; GA4 cuts at 40. The 40-character "career" event counted every time. Nobody had noticed, because the events still showed up.
The second is about AI traffic, which every RFP now asks about:
> A client's GA4 showed AI-assistant visits jump from 354 to 6,050 in a month. Almost none of it was real. About 5,700 came in three one-hour bursts: same 1920x1080 desktop Chrome, all new users, no referrer, about 20 seconds each, landing on two pages. Real AI traffic was 385 sessions against 354 the month before, roughly flat.
That's why section 8 asks how they separate bot traffic from real visits, because the raw chart would have shown a seventeenfold win. So put this in your scoring notes: a 5 for measurement means they check the tracking first.
What should the report contain? People pay for outcomes, not activity, so I'd ask for leads and pipeline from organic search first. Then pages changed, rankings and AI answers. A monthly report that opens with a page of keyword positions is reporting activity.
How long does an SEO RFP process take?
Plan on about eight weeks from writing the RFP to a signed start. Internal sign-off and procurement take most of it.
This is the timeline I'd suggest for a company with a procurement team:
| Week | Step |
|---|---|
| 0 | Agree goals, budget range and the scoring weights internally |
| 1 | Send the RFP to three to five agencies; open written questions |
| 2 | Share every question and answer with every agency |
| 4 | Proposals due |
| 5 | Each reviewer scores alone; meet to compare; pick two finalists |
| 6 | Finalist meetings with the delivery team, working on your own site |
| 7 | Reference calls, security review, contract and statement of work |
| 8 | Kick-off: access granted, tracking checked, first 90-day plan agreed |
Give agencies two to three weeks to respond. A good proposal needs time with your data, and a rushed one is guesswork with a logo on it.
The finalist meeting matters most. Make it a working session: share your Search Console on screen and ask what they'd fix first. You'll learn who has done this before within ten minutes.
Should you include a budget in an SEO RFP?
Yes. Give a range, the currency and whether it includes tax. Without it, agencies either pitch a generic middle package or underquote to win, and the proposals stop being comparable.
If you don't know what to budget, our guide to how much SEO costs sets out published prices by type of work. Ask every agency to price in the same format, one-off costs then monthly cost then extras, and to count what ships each month. Two quotes at the same price can buy wildly different amounts of work.
How would Searchmaxxed answer this RFP?
Searchmaxxed is an SEO, technical SEO, AI SEO, GEO and AEO agency for enterprise, B2B SaaS, venture-backed, manufacturing and public-sector companies. Here's how our answers line up against the template, so you can hold us to the same sheet as everyone else.
| RFP section | Our answer |
|---|---|
| Scope | Technical SEO, content and on-page, links and digital PR, GEO, AEO and LLM SEO, run as one plan |
| Plan and output | A 90-day plan broken into weekly releases. Output counted in page releases each month: 30 on the Growth System, 50 on Agentic Search Engineering |
| Delivery in your stack | We build the work. Where your platform needs internal deployment, we deliver merge-ready changes sized for your release process |
| AI search | Included in every managed package, not an add-on. Agentic Search Engineering tracks answers in ChatGPT, Gemini, Perplexity and AI Overviews |
| Measurement | Search Console and GA4 wired and checked, then a monthly decision memo measured against competitors |
| Team | Direct access to the people doing the work, with no account managers |
| Ownership and exit | You own the site, repository, content and data from day one |
| Terms | Monthly, six-month or 12-month, agreed on the call |
| Price | Quoted per business after we look at your site, market and goals |
A page release means an approved new page or a substantial rebuild of one. Technical, schema, internal-link and measurement work doesn't reduce that count.
How we do the work, in one paragraph. We build on a website you own, our Agentic Website, or ship changes into yours. AI agents pull your Search Console and GA4 data, read the Google results and check what AI answers say about you and your competitors. That feeds the Managed Search Loop, which shows which page, fix or link should bring in the most enquiries next. We build it, check the live page and measure what changed. Off your site, the Off-Page Source Layer builds the links and digital PR that back your pages up.
Searchmaxxed's work has generated more than A$10 million in revenue through search for its clients.
Not ready for a full RFP? The AI SEO Audit takes five business days. It maps where buyers search without finding you, what the site is doing to itself, and every fix ranked by what it's worth.
Is Searchmaxxed right for you?
We fit marketing and growth teams that want search work shipped every month, across Google and AI answers, by people they can call directly. We're a poor fit for teams that want strategy decks or a single fix.
| Searchmaxxed is a good fit if | Look elsewhere if |
|---|---|
| You want pages and fixes shipped monthly, counted as page releases | You want a strategy document and plan to do the work in-house |
| You want SEO and AI search in one plan, with no add-on | You need one migration or one audit, priced as a fixed project |
| You want to own your site, repository, content and data | You're choosing mainly on the lowest monthly price |
| Your dev queue is the bottleneck and you want merge-ready changes | Your procurement requires a SOC 2 report or ISO 27001 certificate from every vendor |
| You sell into crowded or several markets and need links and digital PR | You need search to fill this month's pipeline on its own |
Frequently asked questions
How long should an SEO RFP be?
Eight to twelve pages is plenty for the RFP itself, plus your data exports as attachments. Ask agencies to reply in 10 to 15 pages. Longer replies tend to be padding.
How many agencies should you send an SEO RFP to?
Three to five. Fewer limits your choice, and more creates a scoring job nobody on your team has time for. Use a short RFI or a few calls to cut a longer list down first.
Should an SEO agency do a free audit as part of the RFP?
A short live review in the finalist meeting is fair, and it tells you a lot about how the team thinks. A full free audit isn't. If you want a proper audit before choosing, pay for one, and give only read access while they do it.
What is the difference between an SEO RFP and an SEO proposal?
The RFP is the document you send out, describing your needs and questions. The proposal is each agency's answer to it. The statement of work comes last and lists what the winner will deliver.
Should procurement or marketing own the SEO RFP?
Marketing should own the content and the scoring, because they'll live with the result. Procurement should own the process, terms and paperwork. IT or security should own Appendix A.
Can you use the same template for GEO and AEO?
Yes. Section 6 covers GEO and AEO. Keep it inside the main scope, because the same pages, structured data and links drive Google rankings and AI answers.
What should happen in the first 90 days after you pick an agency?
Access granted at the right roles, tracking checked, a 90-day plan agreed, and the first changes live within the first few weeks. If nothing has shipped by day 30, raise it then.
What should you do next?
Copy the template, fill in sections 2 and 3 with your real numbers, and fix your scoring weights before you send it. Want Searchmaxxed on the shortlist? Send us the RFP and we'll answer every section. If you'd rather start with scope and cost, let's talk pricing.