Outbound Sales for Web Development Companies: A Guide

A twelve-person web shop finishes a rebuild for a regional distributor, invoices it, and looks at the board. Two retainers, one small project, and nothing signed past November. The founder opens a prospecting tool, filters for marketing managers within fifty miles, and starts drafting an email about modern, fast, mobile-friendly websites. Every company on that list already has a website, and every one of them has been told it could be more modern.

This guide is written for the people inside that shop: a web development company, a web design studio or a small dev agency that wants to win clients through outbound rather than wait for the next referral. If you sell tools or services to web agencies, cold email for web development is the page for you.

A web shop has an advantage almost no other seller has: the thing it would replace is public. A prospect's website can be inspected before anyone writes a word, and several of the facts on it come with dates attached by somebody else. Outbound for a web shop works when the list is built from those facts, and fails when it is built from a job title and a postcode.

The prospect's site is the list

Most outbound starts from who a company is. Yours can start from what its site visibly is, and three kinds of public fact do most of the work.

What the site runs on, and whether that software is still supported. The PHP project publishes its support calendar. Its supported versions page says "Each release branch of PHP is fully supported for two years from its initial stable release", followed by two further years of critical security fixes, and then "Once the four years of support are completed, the branch reaches its end of life and is no longer supported." On 18 September 2026 that page listed security support for the 8.2 branch ending on 31 December 2026 and for the 8.3 branch ending on 31 December 2027. A company whose site discloses an older branch has a dated problem it may not know about, and the date was set by the PHP project rather than by you.

How the site performs for real visitors. Google's Search Central documentation defines the three Core Web Vitals and gives a target for each. For loading it says to "strive to have LCP occur within the first 2.5 seconds of the page starting to load", with an Interaction to Next Paint under 200 milliseconds and a Cumulative Layout Shift under 0.1. Google's PageSpeed Insights documentation explains that its real-user figures come from the Chrome User Experience Report and cover the previous 28-day collection period, so the measurement is public, recent and about actual visitors. The gap is common. The CMS chapter of the 2024 Web Almanac, published by HTTP Archive from Lighthouse tests across its crawl of websites, reports that "the median CMS Performance score for WordPress is 61 on desktop and 38 on mobile".

Whether the owner has an accessibility obligation with a date on it. This one applies to public bodies in the United States and is covered in its own section below, because the dates moved in 2026.

None of the three needs a contact database to find, and none is a trick for getting attention. Together they decide who belongs on the list at all. A company whose site is supported, fast and under no obligation is not a prospect this quarter, however well its marketing manager's title matches your filter.

Who owns the website depends on who the client is

Web shops tend to describe their buyer as a marketing manager, and that is wrong for at least two of the segments they sell to.

In an owner-run business the site belongs to the owner, and the owner is tired of hearing about it. A commenter on a 2017 Hacker News thread about selling websites to veterinary clinics put it plainly, saying small businesses "get spam (charitably called 'outreach') emails from agencies from all over the world on a nearly daily basis". The person who had run that campaign replied that "multiple clinics told me they are getting up to 3 calls per week regarding such offers".

In a public body the owner is the entity itself, and the law says so. The ADA.gov fact sheet on the web accessibility rule states that the rule applies to web content a state or local government provides or makes available, and adds "This includes when a state or local government has an arrangement with someone else who provides or makes available web content for them." A city that outsources its site has not outsourced the obligation.

The dates other people have set

A web shop rarely gets a budget calendar from its market. What it gets instead is a short list of dates published by software projects and regulators, and those dates are the closest thing the trade has to a buying season.

The accessibility date is the largest. The Department of Justice rule under Title II of the ADA requires state and local government web content and mobile apps to meet a technical standard, and the fact sheet is direct about which one: "State and local governments' web content usually needs to meet WCAG 2.1, Level AA." ADA.gov records that on April 20, 2026 the Federal Register published an Interim Final Rule extending the compliance dates, so that entities with a total population of 50,000 or more must comply by April 26, 2027, and entities under 50,000 and special district governments by April 26, 2028. The same page notes that "A school district is not a special district government." and takes its date from the population of its city or county.

Two consequences follow for a web shop. The extension puts many public bodies in a planning window, which is the moment a scoped proposal is welcome. And any message that quotes an out-of-date deadline tells the reader you have not checked.

1. 31 December 2026PHP 8.2 security support ends

   From the PHP project's supported versions page.

2. 26 April 2027ADA Title II web rule, population 50,000 or more

   Extended compliance date for state and local government entities, per ADA.gov.

3. 31 December 2027PHP 8.3 security support ends

   From the PHP project's supported versions page.

4. 26 April 2028ADA Title II web rule, under 50,000 and special districts

   Extended compliance date, per ADA.gov.

Public bodies often buy by formal bid, and the Hacker News commenter's first piece of advice to the web shop in that thread was "You respond to RFPs or job postings instead of cold calling". For the public segment, outbound is the step before the bid: a short, useful note that gets your firm known before the specification is written.

What the rules require of the sender

Two sets of rules touch a web shop's outreach directly. Neither paragraph is legal advice.

For email to United States recipients, the FTC's CAN-SPAM compliance guide is explicit that a small agency writing to businesses is covered: "The law makes no exception for business-to-business email." The guide lists what the sender must do, including accurate header information, a subject line that reflects the content, "Your message must include your valid physical postal address.", a clear way to opt out, and "You must honor a recipient's opt-out request within 10 business days."

For LinkedIn, the platform's help page on prohibited software says members who use third party tools that scrape or automate activity "risk having their accounts restricted or shut down". For a founder-led shop the account at risk is usually the founder's own. Our position on that channel, including what can safely be handed to someone else, is set out in LinkedIn lead generation services.

Three openers, each built on a published fact

Each opener below is an example, shown beside the source that makes it a legitimate reason to write now. None names a real recipient or claims a result, and each is a single message: we send one message per campaign, with no follow-up underneath it.

Opener one, from the PHP support calendar. Source: the PHP supported versions page.

Your site's response headers report PHP 8.2. The PHP project lists security support for that branch as ending on 31 December 2026. If the upgrade is already planned, ignore this. If it is not, we can send a one-page note on what usually breaks in the move and what does not.

Opener two, from the ADA.gov fact sheet. Source: the fact sheet on the web accessibility rule.

The Title II web rule now gives a city of your size until 26 April 2027 to meet WCAG 2.1, Level AA. We ran an automated check on five of your most visited pages and can share the results as they stand. It is not a full audit, and it may help whoever is scoping the work.

Opener three, from Google's own measurement. Source: Understanding Core Web Vitals.

PageSpeed Insights shows your product pages loading their main content slower than the 2.5 seconds Google recommends, on real visitor data from the last 28 days. Would a short list of the three heaviest elements on those pages be useful?

To: the person who owns the website

Your site's response headers report PHP 8.2. 1

The PHP project lists security support for that branch as ending on 31 December 2026. 2

If the upgrade is already planned, ignore this. If it is not, we can send a one-page note on what usually breaks in the move and what does not. 3

1. 1A fact read from the prospect's own public site, so the reader can check it in seconds.
2. 2The date was set by the PHP project rather than by the sender.
3. 3One message, an easy way to say no, and an offer smaller than a meeting.

The pattern in all three is the same. The first sentence is about their site, the second is a fact published by somebody with no interest in your sale, the reader has an easy way to say no, and the ask is smaller than a meeting.

Where LinkedIn fits for a web shop

LinkedIn outreach for web development companies is a narrower tool than the advice around it suggests, and the reason is the buyer rather than the platform. Owner-run businesses are reached through the contact details on the site you have just inspected. LinkedIn earns its place where the site belongs to a named person inside a larger organisation, and the message benefits from the reader being able to see who you are and what you have built.

Two rules hold whatever the segment. Nothing is automated, for the account reasons given above. And a connection request is followed by one message, because a second one lands directly beneath the first in the same thread. What LinkedIn itself publishes about connection requests and notes is in our guide to LinkedIn invitations, and this page does not repeat it.

When outbound is the wrong play for a web shop

There are four cases where a web shop should not build this.

The first is when the buyer does not need custom work. The same Hacker News commenter observed that many small practices would be better served by an off-the-shelf site builder with some help on content and design. If your honest recommendation to a prospect would be a template, the deal is too small to carry the cost of finding it cold.

The second is when the work arrives by bid. For public bodies that procure formally, outbound creates familiarity before a bid and nothing more.

The third is when the shop has no specialism. The commenter's closing line was "it's much easier to sell to people who already want what you are selling", and a generalist shop cannot find those people, because it has no view on which public facts matter. Pick the platform, the sector or the problem first.

The fourth is capacity. If the people who would answer replies are the people shipping client work, replies wait, and a reply answered on day four is often lost. That problem, and the order in which to fix it, is the subject of lead generation for digital agencies, and the build-or-buy decision from the owner's chair is in outbound for agency owners.

The short version

For a web development company the product it would replace is public. Build the list from what the site runs on, how it performs for real visitors and whether its owner has a dated accessibility duty, and let the PHP project, Google and ADA.gov supply the facts and the dates. Write to the person who actually owns the site, follow the FTC's rules for commercial email, keep LinkedIn manual, send one message, and do not build any of it if the buyer needs a template, the work arrives by bid, the shop has no specialism or nobody is free to answer.

If you would rather keep shipping client work while somebody else builds the list and runs the sending, you can see what a first campaign would look like for your market.

Dates, thresholds and quotations were read from the named publishers' own pages on 18 September 2026, from stored snapshots. Compliance dates and support calendars change, as the 2026 extension shows: check the source before relying on any date here. Nothing in this article is legal advice.

Sources: PHP, Supported Versions, ADA.gov, fact sheet on the web accessibility rule, Google Search Central, Understanding Core Web Vitals, Google, About PageSpeed Insights, HTTP Archive, Web Almanac 2024, CMS chapter, FTC, CAN-SPAM Act: A Compliance Guide for Business, LinkedIn Help, Prohibited software and extensions, Hacker News, comment thread of July 14, 2017