EcoMark

Latest EcoMark · Algo v4

gosurrey.co.uk

This grade belongs to gosurrey.co.uk. It is based on a bounded sample of up to 5 connected public pages plus public evidence. It is not a grade for any one page.

View full analysis
C73#1 of 3 using v4

Improve

Start with these changes.

EcoMark puts the lowest-scoring areas first, so the next step is obvious.

1

responsibility

Add or strengthen these basic browser protections: HSTS, Content Security Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Frame protection.

Transparent, secure defaults make digital impact understandable and give visitors meaningful choices.

2

sovereignty

Avoid concentrating most third-party delivery in one provider ecosystem.

A more portable and less concentrated stack gives organisations more control over technology and jurisdiction.

3

efficiency

Add long-lived cache headers to versioned static assets.

Lighter pages consume less bandwidth and device work and remain usable on slower connections.

Breakdown

Where the score comes from.

Efficiency

75
#1 of 3

5 connected pages · ~245 KB measured/page · 63 KB JavaScript/page · 32 resource references/page · 10% sampled assets cacheable. PageSpeed-style checks: 3/7; 5 obvious blocking candidates; 33 images without width/height.

Evidence and scoring

Evidence: 5 connected pages · ~245 KB measured/page · 63 KB JavaScript/page · 32 resource references/page · 10% sampled assets cacheable. PageSpeed-style checks: 3/7; 5 obvious blocking candidates; 33 images without width/height.

  • PayloadMeasured HTML and sampled asset payload is proportionate and optimised.20/20
  • JavaScriptReferenced JavaScript weight is kept proportionate.20/20
  • RequestsPages avoid excessive resource references and third-party connections.15/20
  • MediaImages and video avoid obvious loading and autoplay waste.20/20
  • Caching and compressionSampled static assets expose effective cache policy.0/20

Privacy

90
#1 of 3

1 known trackers · 0 tracking-style response cookies · 7% third-party resource references.

Evidence and scoring

Evidence: 1 known trackers · 0 tracking-style response cookies · 7% third-party resource references.

  • Behavioural trackingKnown advertising pixels and cross-site trackers are absent or minimised.15/20
  • Analytics minimisationAnalytics technology is absent or privacy-preserving and proportionate.20/20
  • Cookies and consentNon-essential response cookies are avoided before interaction.20/20
  • Third-party disclosureResource loading does not unnecessarily disclose visits to third parties.15/20
  • Invasive techniquesKnown session replay and similarly invasive tools are absent.20/20

Sovereignty

65
#2 of 3

2 US-headquartered visitor-facing provider ecosystems · 93% first-party assets · open technology 93/100 · WordPress. DNS: NS dante.ns.cloudflare.com, etta.ns.cloudflare.com · MX 10 mail.protonmail.ch, 20 mailsec.protonmail.ch.

Evidence and scoring

Evidence: 2 US-headquartered visitor-facing provider ecosystems · 93% first-party assets · open technology 93/100 · WordPress. DNS: NS dante.ns.cloudflare.com, etta.ns.cloudflare.com · MX 10 mail.protonmail.ch, 20 mailsec.protonmail.ch.

  • Provider jurisdictionObservable visitor-facing dependencies minimise reliance on US-headquartered platform ecosystems.10/20
  • Third-party geographyKnown non-EU third-party data exposure is minimised.15/20
  • Portable deliveryPages minimise proprietary embeds and platform-specific content dependencies.20/20
  • Supplier concentrationThird-party resource loading is not dominated by one provider ecosystem.0/20
  • Open technologyOpen standards, first-party delivery, open-source technology and public source code are preferred where practical.20/20

Accessibility

80
#2 of 3

9 semantic issues · 0 keyboard markup issues · 0% unlabelled controls · 100% raw/rendered text ratio.

Evidence and scoring

Evidence: 9 semantic issues · 0 keyboard markup issues · 0% unlabelled controls · 100% raw/rendered text ratio.

  • SemanticsHTML exposes basic language, heading and landmark structure.0/20
  • Keyboard accessMarkup avoids obvious keyboard-hostile interaction patterns.20/20
  • Forms and controlsForm controls expose labels or accessible names.20/20
  • Visual accessibilityViewport and media markup avoid obvious visual accessibility barriers.20/20
  • ResilienceMeaningful text remains present without relying entirely on client rendering.20/20

Responsibility

45
#2 of 3

Privacy ✓ · Cookies ✗ · Terms ✓ · Accessibility ✗ · Contact/About ✓. Public registration IDs: UK company number 09981304. verified green hosting (Cloudflare). carbon.txt ✗ · sitemap ✓ · security 0/6. Missing: HSTS, Content Security Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Frame protection.

Evidence and scoring

Evidence: Privacy ✓ · Cookies ✗ · Terms ✓ · Accessibility ✗ · Contact/About ✓. Public registration IDs: UK company number 09981304. verified green hosting (Cloudflare). carbon.txt ✗ · sitemap ✓ · security 0/6. Missing: HSTS, Content Security Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Frame protection.

  • Public accountabilityPrivacy, terms, accessibility, contact and applicable registration information are discoverable.10/20
  • Security basicsThe main response exposes sensible browser security headers.0/20
  • Consent designTracking and consent markup avoids obvious one-sided choice patterns.5/20
  • Supplier disclosureDetected material visitor-facing providers are reflected in discoverable privacy information.20/20
  • Sustainability evidenceGreen hosting, carbon.txt and public sustainability information provide discoverable evidence of digital sustainability practice.10/20

Progress

Previous EcoMarks.

C73/100Algo v4 · 28 Aug 2026 New