Nothing loads before consent: how we rebuilt our own site

Agency websites tend to be heavy: a page builder, a dozen plugins, a cookie banner that sets cookies before you answer it. Ours was no exception. When we rebuilt it we wrote down a short list of rules first and treated them as requirements, not aspirations.

Rule one: nothing tracks you until you say yes

On most sites the analytics script loads immediately and is merely told to behave until you accept. On this one it is not downloaded at all before you click accept. Decline, or ignore the notice, and the browser never contacts Google. Advertising storage stays switched off even if you accept, and the choice can be reversed on the cookie policy page.

Rule two: the browser only runs code we wrote

The site sends a content security policy that lists exactly which scripts may run, each pinned by a cryptographic hash that is recalculated on every build. There are no inline styles and no third-party widgets. If someone managed to inject a script, the browser would refuse to run it.

Rule three: everyone can use it

Every page is tested automatically against the WCAG 2.2 AA rule sets at desktop and mobile sizes, and a release does not go out if a check fails. Animations switch off for visitors who ask their device to reduce motion. Nothing scrolls sideways on a 320-pixel screen.

Rule four: fast because there is little to load

The whole site, every page, image and font, is under three megabytes. Fonts are hosted here, images are WebP with explicit sizes, and files are named after their contents so browsers can cache them for a year and still pick up changes at once.

What it cost

No page builder means changes go through a build step, and effects that a plugin would add in a click have to be written. For a site that changes weekly and is edited by many people, a content management system is still the right tool. For a site like this, the trade is worth it. If you want either kind built with the same rules, that is our website design service.