Vetting a Web Architecture Partner: A Cambridge Buyer’s Checklist

Cambridge has an unusual density of technically literate buyers. Between the university spin-outs, the Silicon Fen deep-tech cluster, and the professional services firms serving them, procurement teams here are more likely than most to include someone who can read a HAR file or interrogate a CSP header. And yet the majority of web design proposals reaching those desks are still evaluated on portfolio aesthetics, client logos, and a Google review count. That mismatch is the problem this checklist exists to close.

The shift towards agentic search and generative answer engines has raised the technical floor for what a competent web architecture partner must deliver. It is no longer sufficient to build a site that renders correctly in Chrome and ranks for a handful of keywords. A defensible enterprise web asset in 2026 must perform under real user conditions, resist a specific and enumerable set of attack vectors, and expose its content in a form that both search crawlers and AI retrieval systems can parse deterministically. None of this requires trust in an agency’s self-description. It requires a checklist and five minutes with free, independent tools.

Why Portfolio Review Is No Longer Sufficient Due Diligence

Abstract network diagram representing structured data and security layers

A visual portfolio tells you how an agency’s past clients look in a browser screenshot. It tells you nothing about Interaction to Next Paint under load, nothing about whether the site’s security headers were configured by someone who understands the threat model, and nothing about whether the content architecture will survive being chunked and retrieved by a language model rather than read linearly by a human. These are the three domains — performance, security, and machine-readability — where genuine engineering competence is either present or absent, and all three are independently verifiable in minutes without the agency’s cooperation.

This matters more in Cambridgeshire than in most UK regions because of the concentration of regulated and IP-sensitive organisations here — biotech, medtech, legal, and advanced engineering firms — where a compromised or slow digital front end is not merely a marketing inefficiency but a procurement and compliance liability. A buyer evaluating agencies for such an organisation is not shopping for a brochure. They are commissioning a piece of infrastructure that sits at the edge of the corporate network and represents the entity to both human prospects and machine intermediaries.

Performance: What to Request, and What to Verify Independently

Google’s ranking and user-experience model in 2025–2026 is built around three Core Web Vitals, and any agency proposing to build or rebuild an enterprise asset should be able to state, unprompted, what these are and what their own recent projects scored against them:

  • Largest Contentful Paint (LCP) — target ≤2.5 seconds. This measures loading performance: how long it takes the largest visible element to render.
  • Interaction to Next Paint (INP) — target ≤200 milliseconds. This replaced First Input Delay as the official interactivity metric, and it measures responsiveness across the full lifecycle of a page visit, not just the first click.
  • Cumulative Layout Shift (CLS) — target ≤0.1. This measures visual stability: whether content jumps around as assets load.

The distinction that separates a genuinely engineering-led agency from one reciting SEO checklist items is whether they understand the difference between lab data and field data. A Lighthouse score generated in a controlled test environment is a diagnostic tool, not a ranking input. Google’s algorithm weighs real-world field data collected from actual Chrome users via the Chrome User Experience Report (CrUX). An agency that only ever shows you a Lighthouse screenshot from their own testing rig — never a CrUX field data comparison — is showing you a number they control, not a number your future visitors will experience.

To verify this independently: run any of the agency’s live client sites through Google PageSpeed Insights. It returns both the lab score and, where sufficient traffic exists, the CrUX field data as a separate panel. Ask specifically to see the field data tab, not just the top-line score. If an agency cannot explain why their lab score and field score diverge — a common and legitimate occurrence caused by device mix, network conditions, or third-party script load — that is a competence gap worth noting, not a technicality to skip past.

As a worked example: Daryo89’s own published infrastructure benchmarks are available for direct comparison using the same tools described above. We do not ask buyers to take performance claims on faith — the same PageSpeed and field-data verification methods outlined here apply equally to our own asset as to any prospective competitor’s.

Security Headers: The Browser-Enforced Layer Most Agencies Skip

Security headers are HTTP response headers that instruct the browser to enforce specific protective behaviours — they cost nothing to serve, require no additional infrastructure, and are one of the fastest ways to distinguish an agency that treats security as a first-class engineering concern from one that treats it as an afterthought bolted on after a client complaint. Regulatory pressure through 2025–2026, particularly around GDPR and sector-specific data protection obligations, has made these headers a baseline expectation rather than a nice-to-have.

The essential set a buyer should request explicit confirmation of:

  • Content-Security-Policy (CSP) — restricts which sources of scripts, styles, and other resources the browser will execute, directly mitigating cross-site scripting and unauthorised data exfiltration.
  • X-Content-Type-Options: nosniff — prevents the browser from guessing (sniffing) a resource’s MIME type, closing a class of attack vectors that rely on type confusion.
  • Referrer-Policy — controls what information about the originating page is leaked to third-party destinations, relevant both for privacy compliance and for preventing sensitive URL parameters leaking outward.
  • Strict-Transport-Security (HSTS) — forces all future connections to use HTTPS, closing the door on protocol downgrade attacks.

The critical point for a buyer is that none of this needs to be taken on trust. Mozilla Observatory is a free, open-source tool that scans a live URL, evaluates the presence and configuration quality of these headers (including CSP directive strength, not just its existence), and returns a letter grade with specific remediation guidance. SecurityHeaders.com performs a similar function, checking roughly eight core headers, though buyers should note its API access is being retired in April 2026 — the free web scanner interface itself remains a live, usable check.

A practical due-diligence step: before any commercial conversation, run the agency’s own website — not a client’s, their own — through Mozilla Observatory. An agency selling security-conscious infrastructure to regulated Cambridgeshire clients while scoring poorly on its own headers is a signal worth weighing carefully. This is a five-minute check that costs the buyer nothing and cannot be gamed by the agency in the moment, because the scan reads the live production headers, not a sales deck.

Structured Data and AI-Crawler Access: Where Marketing Claims Diverge From Engineering Reality

This is the domain where the gap between claimed and actual capability is widest, because “AI-ready” has become a phrase agencies attach to conventional SEO work without changing the underlying deliverable. Genuine AI-readiness has specific, checkable components.

Structured data — machine-readable markup implemented via JSON-LD, following Schema.org vocabularies — is not itself a direct ranking factor, but it is the mechanism by which both traditional search engines and generative AI systems disambiguate entities, relationships, and content types. Pages carrying appropriate structured data have been shown to achieve materially higher click-through rates in rich results, and structured data is a foundational input for how AI Overviews and conversational assistants decide what to cite. The schema types a competent agency should be fluent in implementing, correctly and specifically, include:

  • Organization — establishing canonical brand and entity identity.
  • Article / BlogPosting — supporting editorial authority and author attribution.
  • Product — for e-commerce, carrying price and rating data machine-readably.
  • LocalBusiness — address, hours, and service area data, particularly relevant for Cambridgeshire firms competing on local and regional visibility.
  • BreadcrumbList — clarifying site hierarchy for both crawlers and rich-result display.

A specific and useful trap question: ask whether the agency is still recommending FAQPage schema as an SEO tactic for a general business site. Since the restrictions introduced in late 2023 and reinforced through 2025, FAQPage rich results have been largely limited to government and authoritative health domains. An agency still pitching FAQPage schema as a visibility lever for a commercial Cambridgeshire client is working from outdated playbooks — a small but revealing tell about whether their technical knowledge is current or inherited from a 2022 training deck.

Beyond schema, genuine AI-readiness requires that an agency can explain, mechanically, how their content architecture behaves when it is not read top-to-bottom by a human but retrieved in discrete passages by a language model. This is a different engineering problem from traditional on-page SEO, and it is one most agencies have not yet encountered in practice. It is worth asking directly whether headings, paragraph boundaries, and entity references are structured so that a passage retrieved in isolation — without its surrounding page context — still carries enough self-contained meaning to be cited accurately. An agency without a concrete answer to this question is not yet operating in the GEO discipline, regardless of what their marketing copy claims.

Five Questions That Separate Engineering Competence From Marketing Language

These questions are designed to be difficult to answer convincingly without genuine hands-on experience, and easy to answer badly if the agency’s “AI-readiness” is a rebrand rather than a rebuild:

  1. “Beyond basic SEO, how do you implement JSON-LD specifically to support entity recognition by large language models? Can you show a live example of the entity relationships you’ve encoded?”
  2. “What specific developments in AI-powered search over the last twelve months have changed how you architect content, and what did you change as a result?”
  3. “How do you structure content so that a passage retrieved in isolation by a retrieval system remains accurate and citable without its surrounding page context?”
  4. “How do you advise on content organisation to maximise the likelihood of being cited in AI-generated answers, as distinct from ranking in a traditional results page?”
  5. “Do you rely on field data — CrUX or equivalent real-user monitoring — to validate performance claims, or only lab-based Lighthouse scores from your own testing environment?”

The value of these questions is not the answer alone but the specificity of the answer. A competent technical partner will respond with mechanisms — named tools, named schema types, concrete examples of structural decisions and why they were made. A marketing-led response will respond with adjectives: “cutting-edge,” “future-proof,” “AI-optimised.” The absence of mechanism is the tell.

Applying the Checklist

None of the criteria above require an agency’s cooperation to verify. PageSpeed Insights, Mozilla Observatory, and a browser’s own developer tools inspecting live JSON-LD markup are all free, independent, and immune to sales-deck framing. A Cambridgeshire buyer evaluating three shortlisted agencies can, in under thirty minutes and without a single sales call, produce a comparative scorecard across performance field data, security header configuration, and structured data completeness for each agency’s own published work and, where accessible, a sample of their client sites.

The strategic implication is straightforward: the agencies most confident in their engineering will welcome this scrutiny, because their published metrics survive it. The ones relying on portfolio aesthetics and relationship selling will resist it, or redirect the conversation towards design sensibility and account management warmth. Both signals are informative. A partner selection process that incorporates this checklist converts a subjective, relationship-driven decision into a defensible, evidence-based one — which is precisely the standard that regulated Cambridgeshire enterprises should be applying to any vendor sitting at the perimeter of their corporate digital infrastructure.

Frequently asked questions

What are the three Core Web Vitals a web architecture partner should be able to report on?

The three Core Web Vitals are Largest Contentful Paint (target ≤2.5 seconds), Interaction to Next Paint (target ≤200 milliseconds), and Cumulative Layout Shift (target ≤0.1). A competent agency should be able to state its own recent projects’ scores against these thresholds unprompted.

Why does lab data differ from field data when assessing performance?

Lab data, such as a Lighthouse score, is generated in a controlled test environment and is a diagnostic tool, whereas field data comes from Google’s Chrome User Experience Report (CrUX) and reflects real visitor conditions, which is what the ranking algorithm actually weighs. An agency that only shows lab scores and cannot explain divergence from field data has a demonstrable competence gap.

How can a buyer independently verify an agency’s security header configuration?

Mozilla Observatory is a free tool that scans a live URL, evaluates the presence and configuration quality of headers including Content-Security-Policy, and returns a letter grade with remediation guidance, reading the actual production headers rather than any sales claim. SecurityHeaders.com performs a similar scan of roughly eight core headers, though its API access is being retired in April 2026.

Which security headers should a buyer explicitly request confirmation of?

The essential set includes Content-Security-Policy, X-Content-Type-Options: nosniff, Referrer-Policy, and Strict-Transport-Security (HSTS), each enforcing a specific browser-level protection at no additional infrastructure cost. These have moved from nice-to-have to baseline expectation under 2025–2026 regulatory pressure, particularly GDPR.

Is FAQPage schema still a valid SEO tactic for a general business website?

No. Since restrictions introduced in late 2023 and reinforced through 2025, FAQPage rich results have been largely limited to government and authoritative sources, so an agency still recommending it as a general-purpose tactic signals outdated practice.

Related reading