Corporate website checklist: pages, trust signals, bilingual setup and PDPA

A corporate website is a company's official website: it states who the organisation is, what it does and how to reach it, so customers, partners, job applicants, investors and the media can check information from a source the company itself stands behind. A good corporate website therefore needs the core pages, verifiable information, correct bilingual setup, PDPA compliance and ongoing maintenance after launch.

This article is a checklist for anyone about to build or rebuild a corporate website. It covers what one is, the pages it needs, the information that builds trust, running a Thai and English site with hreflang, PDPA and cookie consent, speed and security, and the choice between WordPress and a custom build.

What a corporate website is, and how it differs from an online shop or a landing page

A corporate website focuses on information and confidence in the company, not on selling individual products. Visitors arrive for many reasons: a procurement team vetting a new supplier, a job applicant who wants to understand the culture, a journalist looking up the leadership team, or a bank verifying the company's identity.

An e-commerce site exists mainly to sell products online, so its structure revolves around product pages, the cart and checkout. A landing page is a single page that receives people from one campaign and asks them to do one thing, such as request a quote. All three can coexist. One company might run a corporate website as its core, a separate online shop, and a landing page for each ad campaign.

The difference shapes the design. A corporate website serves several user groups, so it needs clear navigation and content organised by audience. A landing page removes the menu to keep focus on one goal. Trying to make every page of a corporate website behave like a landing page usually buries the information other visitors need.

Which pages a corporate website needs

The list below covers the pages most corporate websites should have. Some depend on the type of business: an investor relations section is necessary for a listed company but may not be for a small firm.

Core pages every site needs

• Home: states in the first screen what the company does and for whom, with routes to the key sections such as services, contact and company information.
• About: history, vision, mission, leadership and organisational structure. If there are subsidiaries or sister companies, explain how they relate.
• Products or services: one page per product or service group. Each page should answer what it is, who it suits and how to get in touch. Separate pages also help SEO, because each page can answer its own search queries.
• Contact: registered address, map, phone, email, opening hours and a contact form. If there are several branches or factories, list each one separately.
• Privacy policy and cookie policy: required once the site collects personal data, which almost every site with a form or an analytics tool already does.

Pages that depend on the type of organisation

• News and press: company news, projects and press releases show media and partners that the company is active. A news page that has not been updated for years can have the opposite effect.
• Careers: open positions, benefits and how to apply. If applications come in through the site, state the purpose and retention period for applicant data.
• Investor relations: for listed companies, used to publish financial statements, annual reports and shareholder meeting information.
• Sustainability or ESG: environmental, social and governance policies and reports, which some large buyers use when selecting suppliers.
• Portfolio or case studies: for service and B2B businesses, include only work that clients have allowed you to publish.
• Downloads: brochures, catalogues, certificates or product data sheets.

Information that builds trust

Many visitors to a corporate website come to check, not to buy. Verifiable information matters more than marketing copy. It should include:

• The full legal entity name and registration number: in Thailand the 13-digit juristic person registration number lets partners check the company against Department of Business Development records. The name on the site should match the name on tax invoices.
• A real address and working contact channels: a phone number someone answers, email on the company domain rather than a free email service, and a map that matches the Google Business Profile.
• Leadership information: names, titles and real photos make the company feel tangible.
• Certifications and awards: for example ISO standards or operating licences. List only those actually held and still valid, with reference numbers where available.
• Real photos of premises and staff: stock photos can support a page, but real images of the office, factory or team say more.
• Signs that information is current: the copyright year in the footer, the date of the latest news item or the dates on documents. Information that looks stale makes people wonder whether the company is still operating.

For SEO, the same information can be marked up as Organization structured data, including the company name, logo, address and official social profiles, which helps Google understand which organisation owns the site.

Corporate website checklist table

How to run a corporate website in Thai and English

Many Thai companies need to communicate with both domestic customers and foreign partners, so corporate websites are often bilingual. Three things need to be right from the start.

A separate URL for each language

Each language should have its own URL, for example /th/ and /en/ folders or subdomains. Avoid switching language with a cookie or script on a single URL, because Google will only see one language, and anyone sharing a link cannot know which language the recipient will see.

Correct hreflang

hreflang is the tag that tells Google a page has versions in other languages and where they are, so Thai searchers see the Thai page and English searchers see the English page. The main rules: each page must reference itself and every other language version, the references must be reciprocal (the Thai page points to the English page and the English page points back), and an x-default should cover users who match neither language. If the tag points to a page that redirects or returns 404, Google may ignore it.

Translate fully, not just the menu

A bilingual site that translates only the menu and the homepage, while service pages and policies stay in one language, leaves foreign visitors stuck halfway. If resources are limited, fully translate the pages foreign partners actually use first, such as About, core services, Contact and the privacy policy, then expand. Unreviewed machine translation often gets job titles, product names and technical terms wrong.

PDPA and cookie consent on a corporate website

Thailand's Personal Data Protection Act B.E. 2562 (2019), or PDPA, has been fully in force since 1 June 2022 and covers personal data collected through websites. In practice, a corporate website collects data in several places: the contact form, job application forms, newsletter sign-ups and cookies from analytics or advertising tools.

The mechanisms most sites use are these:

• Privacy notice: states what data is collected, why, how long it is kept, who it is shared with and how data subjects can exercise their rights, with contact details for the data controller.
• Notice at the form: a short line under each form saying how the data will be used, with a link to the full notice. If the data will be used for further marketing, give users a separate choice that is not pre-ticked.
• Cookie banner: group cookies into categories such as strictly necessary, analytics and advertising. Strictly necessary cookies can always run; the other groups should wait for consent, and users should be able to change their settings later.
• Connection to measurement: if you use Google Analytics or ad tags, the consent management tool should pass the consent state to those tags, for example through Google Consent Mode, so they behave according to the user's choice.

This article covers only the technical mechanics. The content of the privacy notice and the legal basis for each type of data collection should be reviewed by a legal advisor or the organisation's data protection officer.

Speed, security and maintenance after launch

Speed

Google uses Core Web Vitals as part of its page experience signals. The "good" thresholds are LCP (when the main content appears) at or under 2.5 seconds, INP (how quickly the page responds to a click or tap) at or under 200 milliseconds, and CLS (how much the layout shifts while loading) at or under 0.1. Corporate websites are usually slow for the same few reasons: large uncompressed banner images, autoplay video on the homepage, several font families and many third-party scripts such as chat widgets, ad tags and social plugins.

Security

Corporate websites get attacked even without a payment system, because a compromised site can be used to plant spam links or scam pages under the company's name. The basic measures are HTTPS on every page, regular updates to the core system, themes and plugins, removing unused plugins, limiting the number of admin accounts and enabling two-factor authentication, a web application firewall, and automatic backups stored away from the main server, with restores tested so you know they work.

Maintenance after launch

A corporate website is not a one-off project. Assign a clear owner and a maintenance routine, for example:

• Update the system and plugins on a schedule and test on a staging site before applying changes to the live site.
• Check for broken links, and check that forms still deliver to the right inbox, especially after the person who received them leaves.
• Renew the domain and SSL certificate before they expire, and keep domain access in the company's name, not a contractor's personal account.
• Review content such as the leadership list, addresses and certificates whenever they change.
• Check Google Search Console regularly to catch indexing problems and security warnings.

Choosing a platform: WordPress or a custom build

There is no single answer that fits every company. It depends on what the site has to do beyond presenting information, and on what kind of team will look after it.

WordPress suits you when the site is content-led, with company, service and news pages, the marketing team wants to edit content without writing code, and you want multilingual support from existing plugins. The caution is that security depends on keeping plugins and themes updated, and installing many plugins hurts both speed and risk.

A custom build suits you when the site has to connect to internal systems such as an ERP, a CRM or a partner portal that requires login, when there are strict security or audit requirements, or when you need full control of performance and structure. The trade-off is higher upfront cost and maintenance that depends on a development team.

A hypothetical example: a parts manufacturer that only needs to present company information, products and a quote request could start on WordPress. A company that needs dealers to log in, check stock and place orders through the site will usually need custom development, at least for the portal. This example only illustrates the decision logic.

Corporate websites in Thailand: what is different

• Company names in two languages: the Thai and English names should match the company registration certificate and be used consistently everywhere, on the site, in structured data and in the Google Business Profile.
• LINE Official Account: many people in Thailand contact businesses through LINE. An add-friend button next to the phone number and email makes contact easier, but it should not replace official contact details.
• Thai fonts: choose fonts that read well on mobile, render tone marks and stacked vowels correctly, and load only the weights you actually use so pages stay fast.
• PDPA in Thai: the privacy notice and cookie banner should be available in Thai for Thai users, not only in English.

Corporate website FAQ

How is a corporate website different from other websites?

A corporate website focuses on giving verifiable information about the company to several audiences, including customers, partners, job applicants and investors, while an online shop focuses on product purchases and a landing page focuses on one action from one campaign.

Does a corporate website need to be bilingual?

It is not required, but it is worth doing if the company has foreign partners, customers or shareholders. If you run two languages, use a separate URL per language with correct hreflang, and translate the core pages fully rather than only the homepage.

Does a corporate website need a cookie banner?

If the site uses cookies that are not necessary for it to work, such as analytics or advertising cookies, the common practice under PDPA is to ask for consent before they run, through a banner that lets users choose. Check the legal detail with the organisation's advisor.

How often should a corporate website be updated?

The system and plugins should be updated on a regular schedule as developers release patches, content should be corrected as soon as company details change, such as leadership, address or certificates, and news or projects should be added whenever the company has something real to report.

Is WordPress secure enough for a corporate website?

Yes, if it is maintained properly: regular updates to the core, themes and plugins, only the plugins you need from developers who still maintain them, two-factor authentication and backups. Most problems come from outdated plugins rather than from the core system.

Summary

A good corporate website answers the basic questions of every audience, carries verifiable information, handles two languages correctly, follows PDPA, loads quickly, stays secure and has someone looking after it. If you are planning a new site or a rebuild, see the corporate website design page. For platform choice, see the WordPress web design and custom website pages. For care after launch and personal data, see the website support and data security compliance pages.