{
  "schema": "ecomark-automated-analysis-v4",
  "generated_at": "2026-08-28T20:20:22.929Z",
  "algorithm": {
    "version": "4",
    "status": "current",
    "name": "EcoMark v4",
    "published": "2026-08-28",
    "rubric": {
      "0": "Fails materially or creates clear harm in this criterion.",
      "1": "Poor. Significant problems or unnecessary impact remain.",
      "2": "Mixed. Some good practice is present, but material gaps remain.",
      "3": "Good. The criterion is mostly met with only limited gaps.",
      "4": "Strong. The criterion is deliberately and consistently met."
    },
    "formula": {
      "criterion": "criterion_points = max_points × level ÷ 4",
      "category": "category_score = sum(criterion_points)",
      "overall": "overall_score = round(sum(category_score × category_weight))",
      "ranking": "competition ranking: equal scores share a rank and the next rank skips accordingly (1, 1, 3)",
      "comparison": "rankings compare assessments produced by the same EcoMark version only",
      "historical_cutoff": "historical rankings use published_at, not assessed_on"
    },
    "analysis": {
      "type": "automated-observable-web",
      "rendered_homepage": true,
      "max_pages": 5,
      "max_policy_pages": 8,
      "max_asset_samples": 16,
      "freshness_hours": 24,
      "dns_record_types": [
        "A",
        "AAAA",
        "CNAME",
        "MX",
        "NS",
        "TXT"
      ],
      "green_web_check": true,
      "rules": {
        "efficiency": {
          "payload": {
            "metric": "average_page_kb",
            "direction": "lower",
            "bands": [
              500,
              1000,
              2000,
              4000
            ],
            "unit": "KB/page"
          },
          "javascript": {
            "metric": "average_javascript_kb",
            "direction": "lower",
            "bands": [
              100,
              250,
              500,
              1000
            ],
            "unit": "KB/page"
          },
          "requests": {
            "metric": "average_resource_references",
            "direction": "lower",
            "bands": [
              20,
              40,
              70,
              100
            ],
            "unit": "resources/page"
          },
          "media": {
            "metric": "media_issue_count",
            "direction": "lower",
            "bands": [
              0,
              1,
              3,
              6
            ],
            "unit": "issues"
          },
          "caching": {
            "metric": "cacheable_asset_percent",
            "direction": "higher",
            "bands": [
              80,
              60,
              40,
              20
            ],
            "unit": "%"
          }
        },
        "privacy": {
          "trackers": {
            "metric": "tracker_count",
            "direction": "lower",
            "bands": [
              0,
              1,
              2,
              4
            ],
            "unit": "known trackers"
          },
          "analytics": {
            "metric": "analytics_risk",
            "direction": "lower",
            "bands": [
              0,
              1,
              2,
              3
            ],
            "unit": "risk level"
          },
          "cookies": {
            "metric": "nonessential_cookie_count",
            "direction": "lower",
            "bands": [
              0,
              1,
              3,
              6
            ],
            "unit": "response cookies"
          },
          "third_party_data": {
            "metric": "third_party_percent",
            "direction": "lower",
            "bands": [
              0,
              10,
              25,
              50
            ],
            "unit": "%"
          },
          "invasive_techniques": {
            "metric": "invasive_tracker_count",
            "direction": "lower",
            "bands": [
              0,
              0,
              0,
              1
            ],
            "unit": "known invasive tools"
          }
        },
        "sovereignty": {
          "provider_jurisdiction": {
            "metric": "us_provider_count",
            "direction": "lower",
            "bands": [
              0,
              1,
              3,
              6
            ],
            "unit": "visitor-facing provider ecosystems"
          },
          "data_location": {
            "metric": "known_non_eu_data_percent",
            "direction": "lower",
            "bands": [
              0,
              10,
              30,
              60
            ],
            "unit": "%"
          },
          "portability": {
            "metric": "proprietary_embed_count",
            "direction": "lower",
            "bands": [
              0,
              1,
              3,
              6
            ],
            "unit": "embeds"
          },
          "concentration": {
            "metric": "top_provider_share_percent",
            "direction": "lower",
            "bands": [
              0,
              40,
              65,
              85
            ],
            "unit": "%"
          },
          "openness": {
            "metric": "open_technology_score",
            "direction": "higher",
            "bands": [
              90,
              75,
              60,
              40
            ],
            "unit": "openness score"
          }
        },
        "accessibility": {
          "semantics": {
            "metric": "semantic_issue_count",
            "direction": "lower",
            "bands": [
              0,
              1,
              2,
              4
            ],
            "unit": "issues"
          },
          "keyboard": {
            "metric": "keyboard_issue_count",
            "direction": "lower",
            "bands": [
              0,
              1,
              3,
              6
            ],
            "unit": "issues"
          },
          "controls": {
            "metric": "unlabelled_control_percent",
            "direction": "lower",
            "bands": [
              0,
              5,
              15,
              30
            ],
            "unit": "%"
          },
          "visual": {
            "metric": "visual_issue_count",
            "direction": "lower",
            "bands": [
              0,
              1,
              2,
              4
            ],
            "unit": "issues"
          },
          "resilience": {
            "metric": "raw_text_ratio_percent",
            "direction": "higher",
            "bands": [
              80,
              60,
              40,
              20
            ],
            "unit": "%"
          }
        },
        "responsibility": {
          "transparency": {
            "metric": "transparency_evidence_score",
            "direction": "higher",
            "bands": [
              90,
              75,
              55,
              35
            ],
            "unit": "evidence score"
          },
          "security": {
            "metric": "security_header_score",
            "direction": "higher",
            "bands": [
              100,
              83,
              67,
              50
            ],
            "unit": "% basic browser protections"
          },
          "consent_design": {
            "metric": "consent_issue_score",
            "direction": "lower",
            "bands": [
              0,
              1,
              2,
              3
            ],
            "unit": "risk level"
          },
          "supplier_disclosure": {
            "metric": "undisclosed_provider_percent",
            "direction": "lower",
            "bands": [
              0,
              25,
              50,
              75
            ],
            "unit": "%"
          },
          "sustainability_governance": {
            "metric": "sustainability_evidence_score",
            "direction": "higher",
            "bands": [
              4,
              3,
              2,
              1
            ],
            "unit": "evidence signals"
          }
        }
      },
      "note": "EcoMark v4 expands the observable evidence sample to five connected pages, actively checks common policy and sitemap paths, validates six basic browser security protections and records lightweight PageSpeed-style diagnostics. It does not call Google PageSpeed Insights and does not claim Core Web Vitals field data.",
      "max_common_path_probes": 20,
      "pagespeed_style_checks": true,
      "security_header_checks": 6
    },
    "grades": [
      {
        "grade": "A",
        "min": 90,
        "max": 100
      },
      {
        "grade": "B",
        "min": 80,
        "max": 89
      },
      {
        "grade": "C",
        "min": 70,
        "max": 79
      },
      {
        "grade": "D",
        "min": 60,
        "max": 69
      },
      {
        "grade": "E",
        "min": 50,
        "max": 59
      },
      {
        "grade": "F",
        "min": 0,
        "max": 49
      }
    ],
    "categories": [
      {
        "key": "efficiency",
        "label": "Efficiency",
        "weight": 0.25,
        "short": "Resource use, page weight and avoidable computation.",
        "criteria": [
          {
            "key": "payload",
            "label": "Payload",
            "max_points": 20,
            "description": "Measured HTML and sampled asset payload is proportionate and optimised."
          },
          {
            "key": "javascript",
            "label": "JavaScript",
            "max_points": 20,
            "description": "Referenced JavaScript weight is kept proportionate."
          },
          {
            "key": "requests",
            "label": "Requests",
            "max_points": 20,
            "description": "Pages avoid excessive resource references and third-party connections."
          },
          {
            "key": "media",
            "label": "Media",
            "max_points": 20,
            "description": "Images and video avoid obvious loading and autoplay waste."
          },
          {
            "key": "caching",
            "label": "Caching and compression",
            "max_points": 20,
            "description": "Sampled static assets expose effective cache policy."
          }
        ]
      },
      {
        "key": "privacy",
        "label": "Privacy",
        "weight": 0.25,
        "short": "Tracking, cookies, profiling, analytics and consent.",
        "criteria": [
          {
            "key": "trackers",
            "label": "Behavioural tracking",
            "max_points": 20,
            "description": "Known advertising pixels and cross-site trackers are absent or minimised."
          },
          {
            "key": "analytics",
            "label": "Analytics minimisation",
            "max_points": 20,
            "description": "Analytics technology is absent or privacy-preserving and proportionate."
          },
          {
            "key": "cookies",
            "label": "Cookies and consent",
            "max_points": 20,
            "description": "Non-essential response cookies are avoided before interaction."
          },
          {
            "key": "third_party_data",
            "label": "Third-party disclosure",
            "max_points": 20,
            "description": "Resource loading does not unnecessarily disclose visits to third parties."
          },
          {
            "key": "invasive_techniques",
            "label": "Invasive techniques",
            "max_points": 20,
            "description": "Known session replay and similarly invasive tools are absent."
          }
        ]
      },
      {
        "key": "sovereignty",
        "label": "Sovereignty",
        "weight": 0.2,
        "short": "Ownership, geography, openness, portability and dependency.",
        "criteria": [
          {
            "key": "provider_jurisdiction",
            "label": "Provider jurisdiction",
            "max_points": 20,
            "description": "Observable visitor-facing dependencies minimise reliance on US-headquartered platform ecosystems."
          },
          {
            "key": "data_location",
            "label": "Third-party geography",
            "max_points": 20,
            "description": "Known non-EU third-party data exposure is minimised."
          },
          {
            "key": "portability",
            "label": "Portable delivery",
            "max_points": 20,
            "description": "Pages minimise proprietary embeds and platform-specific content dependencies."
          },
          {
            "key": "concentration",
            "label": "Supplier concentration",
            "max_points": 20,
            "description": "Third-party resource loading is not dominated by one provider ecosystem."
          },
          {
            "key": "openness",
            "label": "Open technology",
            "max_points": 20,
            "description": "Open standards, first-party delivery, open-source technology and public source code are preferred where practical."
          }
        ]
      },
      {
        "key": "accessibility",
        "label": "Accessibility",
        "weight": 0.15,
        "short": "Inclusive, semantic and resilient implementation.",
        "criteria": [
          {
            "key": "semantics",
            "label": "Semantics",
            "max_points": 20,
            "description": "HTML exposes basic language, heading and landmark structure."
          },
          {
            "key": "keyboard",
            "label": "Keyboard access",
            "max_points": 20,
            "description": "Markup avoids obvious keyboard-hostile interaction patterns."
          },
          {
            "key": "controls",
            "label": "Forms and controls",
            "max_points": 20,
            "description": "Form controls expose labels or accessible names."
          },
          {
            "key": "visual",
            "label": "Visual accessibility",
            "max_points": 20,
            "description": "Viewport and media markup avoid obvious visual accessibility barriers."
          },
          {
            "key": "resilience",
            "label": "Resilience",
            "max_points": 20,
            "description": "Meaningful text remains present without relying entirely on client rendering."
          }
        ]
      },
      {
        "key": "responsibility",
        "label": "Responsibility",
        "weight": 0.15,
        "short": "Transparency, security basics and responsible choices.",
        "criteria": [
          {
            "key": "transparency",
            "label": "Public accountability",
            "max_points": 20,
            "description": "Privacy, terms, accessibility, contact and applicable registration information are discoverable."
          },
          {
            "key": "security",
            "label": "Security basics",
            "max_points": 20,
            "description": "The main response exposes sensible browser security headers."
          },
          {
            "key": "consent_design",
            "label": "Consent design",
            "max_points": 20,
            "description": "Tracking and consent markup avoids obvious one-sided choice patterns."
          },
          {
            "key": "supplier_disclosure",
            "label": "Supplier disclosure",
            "max_points": 20,
            "description": "Detected material visitor-facing providers are reflected in discoverable privacy information."
          },
          {
            "key": "sustainability_governance",
            "label": "Sustainability evidence",
            "max_points": 20,
            "description": "Green hosting, carbon.txt and public sustainability information provide discoverable evidence of digital sustainability practice."
          }
        ]
      }
    ]
  },
  "algorithm_sha256": "fd7b59cbb2964a4f059df0645f095f1695a2d85bfcf776dc0d88da6f174781a4",
  "source_fingerprint": "c8aaf2e3b8f747bc4400921b35717fa84ea0d90c376ed7aed5b9b69667e22c82",
  "external_sources": {
    "dns": "Cloudflare 1.1.1.1 DNS over HTTPS",
    "green_hosting": "Green Web Foundation Greencheck API",
    "performance": "EcoMark lightweight lab diagnostics; no Google PageSpeed API call"
  },
  "metrics": {
    "pages_checked": 5,
    "browser_rendered_homepage": false,
    "average_page_kb": 1552,
    "average_javascript_kb": 0,
    "average_resource_references": 40,
    "media_issue_count": 4,
    "cacheable_asset_percent": 25,
    "tracker_count": 0,
    "analytics_risk": 0,
    "nonessential_cookie_count": 0,
    "third_party_percent": 79,
    "invasive_tracker_count": 0,
    "us_provider_count": 1,
    "known_non_eu_data_percent": 0,
    "proprietary_embed_count": 0,
    "top_provider_share_percent": 94,
    "first_party_asset_percent": 22,
    "semantic_issue_count": 3,
    "keyboard_issue_count": 0,
    "unlabelled_control_percent": 0,
    "visual_issue_count": 0,
    "raw_text_ratio_percent": 100,
    "missing_transparency_links": 2,
    "security_header_count": 5,
    "consent_issue_score": 0,
    "undisclosed_provider_percent": 0,
    "responsible_default_issue_count": 0,
    "dns_record_count": 17,
    "policy_pages_discovered": 5,
    "common_path_probe_count": 11,
    "sitemap_count": 1,
    "legal_identifier_count": 1,
    "public_source_repository": false,
    "open_source_technology_count": 0,
    "open_technology_score": 67,
    "transparency_evidence_score": 82,
    "sustainability_evidence_score": 2,
    "green_hosting_verified": true,
    "carbon_txt_found": false,
    "security_header_score": 83,
    "page_speed_checks_passed": 2,
    "page_speed_checks_total": 7,
    "homepage_response_ms": 125,
    "render_blocking_candidate_count": 7,
    "images_without_dimensions": 29
  },
  "analysis_quality": {
    "status": "good",
    "browser_result": "blocked-or-incomplete; static fallback used",
    "raw_homepage_status": 200,
    "raw_homepage_text_chars": 5697,
    "raw_homepage_resources": 77,
    "raw_homepage_response_ms": 125
  },
  "pages": [
    {
      "url": "https://www.zerohour.uk/",
      "status": 200,
      "browser_rendered": false,
      "html_bytes": 115964
    },
    {
      "url": "https://www.zerohour.uk/about",
      "status": 200,
      "browser_rendered": false,
      "html_bytes": 43664
    },
    {
      "url": "https://www.zerohour.uk/contact",
      "status": 200,
      "browser_rendered": false,
      "html_bytes": 40625
    },
    {
      "url": "https://www.zerohour.uk/privacy",
      "status": 200,
      "browser_rendered": false,
      "html_bytes": 41281
    },
    {
      "url": "https://www.zerohour.uk/",
      "status": 200,
      "browser_rendered": false,
      "html_bytes": 115964
    }
  ],
  "documents": {
    "about": {
      "url": "https://www.zerohour.uk/about",
      "reachable": true,
      "source": "linked",
      "blocked_by_robots": false
    },
    "contact": {
      "url": "https://www.zerohour.uk/contact",
      "reachable": true,
      "source": "linked",
      "blocked_by_robots": false
    },
    "terms": {
      "url": "https://www.zerohour.uk/terms",
      "reachable": true,
      "source": "linked",
      "blocked_by_robots": false
    },
    "privacy": {
      "url": "https://www.zerohour.uk/privacy",
      "reachable": true,
      "source": "linked",
      "blocked_by_robots": false
    },
    "cookies": {
      "url": "https://www.zerohour.uk/privacy",
      "reachable": true,
      "source": "common-path",
      "blocked_by_robots": false
    }
  },
  "document_probes": [
    {
      "kind": "cookies",
      "url": "https://www.zerohour.uk/cookies",
      "reachable": true,
      "blocked_by_robots": false
    },
    {
      "kind": "accessibility",
      "url": "https://www.zerohour.uk/accessibility",
      "reachable": false,
      "blocked_by_robots": false
    },
    {
      "kind": "accessibility",
      "url": "https://www.zerohour.uk/accessibility-statement",
      "reachable": false,
      "blocked_by_robots": false
    },
    {
      "kind": "accessibility",
      "url": "https://www.zerohour.uk/accessibility_statement",
      "reachable": false,
      "blocked_by_robots": false
    },
    {
      "kind": "legal",
      "url": "https://www.zerohour.uk/legal",
      "reachable": false,
      "blocked_by_robots": false
    },
    {
      "kind": "legal",
      "url": "https://www.zerohour.uk/imprint",
      "reachable": false,
      "blocked_by_robots": false
    },
    {
      "kind": "legal",
      "url": "https://www.zerohour.uk/governance",
      "reachable": false,
      "blocked_by_robots": false
    },
    {
      "kind": "sustainability",
      "url": "https://www.zerohour.uk/sustainability",
      "reachable": false,
      "blocked_by_robots": false
    },
    {
      "kind": "sustainability",
      "url": "https://www.zerohour.uk/environment",
      "reachable": false,
      "blocked_by_robots": false
    },
    {
      "kind": "sustainability",
      "url": "https://www.zerohour.uk/climate",
      "reachable": false,
      "blocked_by_robots": false
    },
    {
      "kind": "sustainability",
      "url": "https://www.zerohour.uk/carbon",
      "reachable": false,
      "blocked_by_robots": false
    }
  ],
  "sitemaps": {
    "found": [
      "https://www.zerohour.uk/sitemap.xml"
    ],
    "checked": [
      {
        "url": "https://www.zerohour.uk/sitemap.xml",
        "reachable": true,
        "blocked_by_robots": false
      },
      {
        "url": "https://www.zerohour.uk/sitemap_index.xml",
        "reachable": false,
        "blocked_by_robots": false
      },
      {
        "url": "https://www.zerohour.uk/sitemap-index.xml",
        "reachable": false,
        "blocked_by_robots": false
      },
      {
        "url": "https://www.zerohour.uk/sitemap",
        "reachable": false,
        "blocked_by_robots": false
      }
    ]
  },
  "legal_identifiers": [
    {
      "type": "UK company number",
      "jurisdiction": "UK",
      "value": "12846343"
    }
  ],
  "dns": {
    "records": {
      "A": [
        "104.26.8.231",
        "104.26.9.231",
        "172.67.70.126"
      ],
      "AAAA": [
        "2606:4700:20::681a:8e7",
        "2606:4700:20::681a:9e7",
        "2606:4700:20::ac43:467e"
      ],
      "CNAME": [],
      "MX": [
        "1 aspmx.l.google.com",
        "5 alt1.aspmx.l.google.com",
        "5 alt2.aspmx.l.google.com",
        "10 alt3.aspmx.l.google.com",
        "10 alt4.aspmx.l.google.com"
      ],
      "NS": [
        "rene.ns.cloudflare.com",
        "stephane.ns.cloudflare.com"
      ],
      "TXT": [
        "v=spf1 include:_spf.google.com ~all",
        "google-site-verification=lM756ESU9puDW0_1Ml88jMEBpLjT-h-l5pqhNaqINH8",
        "google-site-verification=mSMV6T0SP_5IFScaEKiLUEj96E48bL8gEow-p1yymMU",
        "stripe-verification=6b9fbe55b6ae861d7539e60ee8803cc520b242e0fd8612ee3f87e89820971b5d"
      ],
      "WWW_CNAME": []
    },
    "record_count": 17,
    "carbon_txt_location": null
  },
  "security_headers": {
    "score": 83,
    "passed": 5,
    "total": 6,
    "checks": [
      {
        "key": "hsts",
        "label": "HSTS",
        "pass": false,
        "value": null
      },
      {
        "key": "csp",
        "label": "Content Security Policy",
        "pass": true,
        "value": "default-src 'self' https: data: blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https: blob:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: blob: https:; font-src 'self' data: https:; connect-src 'self' https: wss:; media-src 'self' data: blob: https:; frame-src 'self' https:; child-src 'self' https: blob:; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; form-action 'self' https:"
      },
      {
        "key": "nosniff",
        "label": "X-Content-Type-Options",
        "pass": true,
        "value": "nosniff"
      },
      {
        "key": "referrer",
        "label": "Referrer-Policy",
        "pass": true,
        "value": "strict-origin-when-cross-origin"
      },
      {
        "key": "permissions",
        "label": "Permissions-Policy",
        "pass": true,
        "value": "camera=(), microphone=(), geolocation=()"
      },
      {
        "key": "framing",
        "label": "Frame protection",
        "pass": true,
        "value": "SAMEORIGIN"
      }
    ],
    "missing": [
      "HSTS"
    ]
  },
  "performance_diagnostics": {
    "kind": "lightweight-lab-proxy",
    "note": "These are EcoMark diagnostics inspired by common PageSpeed/Lighthouse checks. They are not a Google PageSpeed score and do not claim CrUX or Core Web Vitals field data.",
    "html_kb": 113,
    "response_ms": 125,
    "render_blocking_script_candidates": 3,
    "render_blocking_stylesheet_candidates": 4,
    "images_without_dimensions": 29,
    "images_without_lazy": 6,
    "passed": 2,
    "total": 7,
    "checks": [
      {
        "key": "response",
        "label": "Initial response under 800 ms from EcoMark",
        "pass": true,
        "value": "125 ms"
      },
      {
        "key": "payload",
        "label": "Measured page under 1 MB",
        "pass": false,
        "value": "1552 KB/page"
      },
      {
        "key": "javascript",
        "label": "JavaScript under 250 KB/page",
        "pass": true,
        "value": "0 KB/page"
      },
      {
        "key": "requests",
        "label": "Fewer than 40 resource references/page",
        "pass": false,
        "value": "40 references/page"
      },
      {
        "key": "caching",
        "label": "At least 60% of sampled assets cacheable",
        "pass": false,
        "value": "25%"
      },
      {
        "key": "render_blocking",
        "label": "No obvious parser/render-blocking candidates",
        "pass": false,
        "value": "7 candidates"
      },
      {
        "key": "image_dimensions",
        "label": "Images include width and height",
        "pass": false,
        "value": "29 missing dimensions"
      }
    ]
  },
  "open_technologies": [],
  "source_repository": null,
  "green_web": {
    "checked": true,
    "green": true,
    "hosted_by": "Cloudflare",
    "supporting_documents": [
      {
        "id": 18,
        "title": "Blog post - The Climate and Cloudflare",
        "link": "https://blog.cloudflare.com/the-climate-and-cloudflare/"
      },
      {
        "id": 1264,
        "title": "Cloudflare 2023 Emissions Inventory",
        "link": "https://media.greenweb.org/uploads/Cloudflare_2023_Emissions_Inventory.pdf"
      }
    ]
  },
  "carbon_txt": {
    "found": false,
    "method": null,
    "location": null
  },
  "providers": [],
  "tracker_urls": [],
  "assessment": {
    "id": "dd3a8085-00f3-47a0-980b-48e88fdc5b3c",
    "domain": "zerohour.uk",
    "site_name": "Zero Hour - Join the campaign for climate and nature",
    "website_url": "https://www.zerohour.uk/",
    "ecomark_version": "4",
    "overall_score": 72,
    "grade": "C",
    "summary": "Automated EcoMark v4 approximation using up to 5 connected pages, DNS, active policy/sitemap discovery, browser security checks and lightweight performance diagnostics. Browser Run was blocked or incomplete, so the normal public HTML response was used instead. Analysis quality: good.",
    "assessed_on": "2026-08-28",
    "categories": [
      {
        "category": "efficiency",
        "score": 55,
        "criteria": {
          "payload": {
            "level": 2,
            "points": 10
          },
          "javascript": {
            "level": 4,
            "points": 20
          },
          "requests": {
            "level": 3,
            "points": 15
          },
          "media": {
            "level": 1,
            "points": 5
          },
          "caching": {
            "level": 1,
            "points": 5
          }
        },
        "priority": "high",
        "finding": "5 connected pages · ~1552 KB measured/page · 0 KB JavaScript/page · 40 resource references/page · 25% sampled assets cacheable. PageSpeed-style checks: 2/7; 7 obvious blocking candidates; 29 images without width/height.",
        "evidence": "5 connected pages · ~1552 KB measured/page · 0 KB JavaScript/page · 40 resource references/page · 25% sampled assets cacheable. PageSpeed-style checks: 2/7; 7 obvious blocking candidates; 29 images without width/height.",
        "why_it_matters": "Lighter pages consume less bandwidth and device work and remain usable on slower connections.",
        "action": "Lazy-load below-the-fold media and remove autoplay."
      },
      {
        "category": "privacy",
        "score": 80,
        "criteria": {
          "trackers": {
            "level": 4,
            "points": 20
          },
          "analytics": {
            "level": 4,
            "points": 20
          },
          "cookies": {
            "level": 4,
            "points": 20
          },
          "third_party_data": {
            "level": 0,
            "points": 0
          },
          "invasive_techniques": {
            "level": 4,
            "points": 20
          }
        },
        "priority": "low",
        "finding": "0 known trackers · 0 tracking-style response cookies · 79% third-party resource references.",
        "evidence": "0 known trackers · 0 tracking-style response cookies · 79% third-party resource references.",
        "why_it_matters": "Minimising tracking and third-party disclosure reduces profiling and unnecessary visitor data exposure.",
        "action": "Move commonly used assets and services first-party where practical."
      },
      {
        "category": "sovereignty",
        "score": 65,
        "criteria": {
          "provider_jurisdiction": {
            "level": 3,
            "points": 15
          },
          "data_location": {
            "level": 4,
            "points": 20
          },
          "portability": {
            "level": 4,
            "points": 20
          },
          "concentration": {
            "level": 0,
            "points": 0
          },
          "openness": {
            "level": 2,
            "points": 10
          }
        },
        "priority": "medium",
        "finding": "1 US-headquartered visitor-facing provider ecosystems · 22% first-party assets · open technology 67/100 · no framework signal required/detected. DNS: NS rene.ns.cloudflare.com, stephane.ns.cloudflare.com · MX 1 aspmx.l.google.com, 5 alt1.aspmx.l.google.com.",
        "evidence": "1 US-headquartered visitor-facing provider ecosystems · 22% first-party assets · open technology 67/100 · no framework signal required/detected. DNS: NS rene.ns.cloudflare.com, stephane.ns.cloudflare.com · MX 1 aspmx.l.google.com, 5 alt1.aspmx.l.google.com.",
        "why_it_matters": "A more portable and less concentrated stack gives organisations more control over technology and jurisdiction.",
        "action": "Avoid concentrating most third-party delivery in one provider ecosystem."
      },
      {
        "category": "accessibility",
        "score": 85,
        "criteria": {
          "semantics": {
            "level": 1,
            "points": 5
          },
          "keyboard": {
            "level": 4,
            "points": 20
          },
          "controls": {
            "level": 4,
            "points": 20
          },
          "visual": {
            "level": 4,
            "points": 20
          },
          "resilience": {
            "level": 4,
            "points": 20
          }
        },
        "priority": "low",
        "finding": "3 semantic issues · 0 keyboard markup issues · 0% unlabelled controls · 100% raw/rendered text ratio.",
        "evidence": "3 semantic issues · 0 keyboard markup issues · 0% unlabelled controls · 100% raw/rendered text ratio.",
        "why_it_matters": "Accessible, resilient markup works for more people, assistive technology and older or constrained devices.",
        "action": "Fix basic document semantics: language, one clear H1 and meaningful landmarks/headings."
      },
      {
        "category": "responsibility",
        "score": 80,
        "criteria": {
          "transparency": {
            "level": 3,
            "points": 15
          },
          "security": {
            "level": 3,
            "points": 15
          },
          "consent_design": {
            "level": 4,
            "points": 20
          },
          "supplier_disclosure": {
            "level": 4,
            "points": 20
          },
          "sustainability_governance": {
            "level": 2,
            "points": 10
          }
        },
        "priority": "low",
        "finding": "Privacy ✓ · Cookies n/a · Terms ✓ · Accessibility ✗ · Contact/About ✓. Public registration IDs: UK company number 12846343. verified green hosting (Cloudflare). carbon.txt ✗ · sitemap ✓ · security 5/6. Missing: HSTS.",
        "evidence": "Privacy ✓ · Cookies n/a · Terms ✓ · Accessibility ✗ · Contact/About ✓. Public registration IDs: UK company number 12846343. verified green hosting (Cloudflare). carbon.txt ✗ · sitemap ✓ · security 5/6. Missing: HSTS.",
        "why_it_matters": "Transparent, secure defaults make digital impact understandable and give visitors meaningful choices.",
        "action": "Publish sustainability evidence, consider carbon.txt, and use independently verified green hosting where practical."
      }
    ]
  }
}