The Art of the Deal

There is a negotiation in which both sides want to close, both have room to move and neither uses it. It happens all the time when organisations commission websites, online shops and digital ecosystems, and it nearly always ends with the same sentence: “We loved your proposal, it’s the best one we’ve received, but you’re way above what we can afford.” A sentence that closes the conversation at the exact moment it should open it.

The book this article is named after sold millions of copies promising to teach people how to close deals (a book, incidentally, written by a ghostwriter who years later said he regretted it). What we see in our industry goes the other way: a process designed, without anyone designing it, so that the deal never even opens. And the most striking part is that everyone involved behaves reasonably.

The only number

The client doesn’t share their budget. They have their reasons: in their experience, naming a figure means setting a ceiling the supplier will make sure to reach. The agency stops asking, because every time it does, it gets the same look. So it does the only thing it can with the information it has: listen to the ideal scenario, analyse it, benchmark it against the industry, ask for a second meeting, prepare a counter-brief and price that ideal scenario with everything it contains. Scope, timelines, team, approvals, what’s included and what isn’t.

Then the proposal arrives and the client doesn’t negotiate either. They compare the total with the figure they had in mind and with the totals of other proposals, and they choose. Across the whole relationship, the only number spoken out loud is the rejection. Once. At the end.

Calling that a negotiation is generous. It’s more like a poker game in which one player gets up from the table without showing their cards, convinced they’ve won.

At Digital Bakers, four or five out of every ten proposals we send fall through this way: on price, without a single exchange about scope, phases or deliverables. And every one of those proposals states, literally, that the document is a starting point and that we would rather adjust than lose the project. Nobody picks up the gauntlet. I don’t think it’s bad faith. I think nobody has explained to buyers that a digital proposal is negotiated on scope; since they only know how to negotiate on price, and talking about price makes them uncomfortable, they don’t negotiate.

Across the whole relationship, the only number spoken out loud is the rejection. Once. At the end.

The dream, untouched

Here’s the part of the mechanism almost nobody looks at. When a client rejects on price, you’d expect them to scale the scenario down: fewer languages, fewer integrations, one phase now and another a year from now. It almost never happens. The scenario stays untouched; what changes is the supplier. Instead of a smaller project, the client buys the same dream for a fraction of the price.

And that can only mean one of two things. Either the cheap supplier has found a way to do the same thing for a third, or the price they quoted isn’t the price. In our industry, with alarming frequency, it’s the latter. The in-house version is just as common: “we’ll do it with what we have in-house”, which is the same bet with a different supplier, one that can’t say no.

Two years later

What follows are patterns, not cases. We know them because, as an occupational hazard, we end up seeing what the people who said no to us went on to publish, and because some of our clients came to us fleeing one of these scenarios.

The redesign that ages faster than the old site. A company wants to renew its website because of its age, its user experience and its accessibility. It rejects the proposal and handles it internally or with its usual supplier. What it publishes delivers less than what prompted the redesign: harder to use, not accessible and with a look that falls short of the business it represents. What was saved, nobody sees. What was published, everybody sees, including the customers that company is trying to win.

The copy without the judgement. A website that has worked for years, with a recognisable design and a carefully crafted user experience, is replaced by a version inspired by the original and built by another team. The surface is copied and what made it work is lost: the hierarchy, the content structure, the accessibility, the content governance and everything nobody saw but everybody used. The result looks like the previous site until someone tries to use it.

The broken promise. We know this one from the inside, because part of our work is auditing websites for clients who no longer trust what their previous supplier delivered. They were promised a site that would help them communicate, rank and sell. From the outside, it sometimes looks good. The moment you look closer, it’s frightening: code that follows none of the conventions of the platform it’s built on, exposed credentials and personal data, errors that stop search engines and AI assistants from indexing the site, legal notices, cookies and accessibility out of compliance, publishing workflows that don’t work, performance that hurts visibility, badly implemented analytics that have spent months measuring nothing. And not a single page of documentation. None of these things were in the promise, and none of them show up in the demo.

The hostage situation. The most expensive one, and the least visible in the proposal. A client turns down a solution built on the standards of an open source platform, with no custom code, because “anyone” can build them a cheaper website. That anyone builds it on a base of third-party plugins with custom development on top. For the first year everything seems to work. Then publishing a piece of content requires a ticket, every update breaks something, and when the client wants to switch suppliers they discover nobody else can touch it without rebuilding it. The low price at the start was, in reality, a subscription.

This shouldn’t be read as a verdict on any one platform. The core of the most widely used CMSs is reasonably secure; the risk lies in the plugin model. According to Patchstack, a security company specialising in that ecosystem, 11,334 new vulnerabilities were recorded in 2025, around 91% of them in plugins. Every plugin is a component someone has to maintain, and custom development on top of that layer is a component only its author can maintain. That’s the lock.

How you know you won’t be held hostage

This is where we have to show our cards, because saying “that doesn’t happen with us” is worth exactly as much as the cheap supplier’s promise. What we can do is offer facts any technical person can verify:

• Everything is built on open source software and on the platform’s standards, with no proprietary components that stop working if the relationship ends.
• The code and the data belong to the client from day one.
• Anything that goes beyond the standard is documented and developed following the platform’s best practices, so another team can pick it up.
• No recurring service is a condition for the website to stay alive.

Any supplier who can’t state those four things in writing should explain why. And any client can ask for them before signing, whatever the proposal costs.

What can be negotiated

Let’s go back to the poker table, because there’s much more on it than people think. A digital proposal has at least five variables that can move without touching the quality of what’s delivered: the scope, the phases, how much of the work the in-house team can take on, what gets deferred to a second stage and which features were wants rather than needs. We put them in writing in every proposal, and still nobody touches them. Part of the responsibility is ours: we used to request a meeting to walk through the proposal when we should have made it a condition for sending it.

What isn’t said can’t be negotiated. And “you’re way above” says very little.

How to negotiate with an agency without losing face

And a sixth for whoever is on the other side of the table: if the agency gets annoyed hearing any of these phrases, you already have the information you needed.

Sources

• Patchstack, annual WordPress ecosystem vulnerability report, 2025 — number of vulnerabilities recorded and share found in plugins.