Seven England web agencies named, and identity checks to run before reputation

What to take away

How this named review works

This review names England web agencies so you can check identity before reputation. It uses public records, first-party service pages and regulator guidance. It does not claim that any agency was appointed, interviewed or tested for this article. An agency review can support a shortlist decision, not a quality ranking.

The eligible set is England-based agencies with public web design and development pages. I checked the brand name against a matching company record where one is visible. I did not inspect contracts, code, hosting or client references. The privacy and security checklist still applies before any appointment.

No supplier funded this work. There are no affiliate links. This is desk research. Publication remains on hold until a named human reviewer signs the disclosure.

Named England agencies to inspect

Torchbox

Torchbox is an Oxfordshire agency founded in 2000. It builds websites and digital services for charities, public bodies and non-profits. Its public pages highlight Wagtail CMS work and accessibility. Pricing is project-based, so ask for a scope and day-rate model. Check the Companies House record behind the Torchbox name before reading client stories.

Cyber-Duck

Cyber-Duck is a London agency founded in 2005. It covers research, design, development and support. Public pages mention ISO 27001 and cyber security work. It does not publish fixed prices. Ask for the legal entity that would sign, the security owner and the support exit route. A certificate claim needs issuer, scope and expiry checked.

Nomensa

Nomensa is a Bristol agency founded in 2001. It works on user experience, accessibility and digital strategy. Public pages list accessibility audits and training. It suits buyers who need inclusive design evidence. Its pricing is not listed, so request a defined evaluation scope, method and retest owner. Identity and accessibility evidence are separate gates.

Clearleft

Clearleft is a Brighton agency founded in 2005. It focuses on user experience, research and product design. Public pages describe design sprints and UX consulting. It may suit a buyer that already has a development team. It does not publish fixed prices. Ask who owns the research artefacts and how design handover is accepted.

Evoluted

Evoluted is a Sheffield agency founded in 2006. It offers web design, development, SEO and digital marketing. Public pages mention Umbraco and Kentico work. It may suit a buyer wanting one supplier for build and ongoing marketing. Pricing is quote-based. Check whether the marketing entity and development entity are the same company.

Fhoke

Fhoke is a Wiltshire web design studio. Public pages describe custom website design and WordPress builds. It presents a smaller studio model, which can suit direct access to designers. It does not list fixed prices. Ask for capacity evidence, subcontractor use and the support term. A polished portfolio is not delivery proof.

Mud

Mud is a London digital agency. Public pages describe brand, web design and development for consumer brands. It may suit retail and lifestyle projects. Pricing is project-based. Check the exact company record and whether media or ecommerce work is handled inside the same legal entity. Awards need category, year and entrant checked.

Compare identity before reputation

Record the exact legal entity, trading name, registered office, company status and people authorised to negotiate. A near match is not enough. If a website names one brand and the proposal names another company, ask for the liability route in writing.

Do not use an active-company label as an endorsement. Companies House warns in its company-information disclaimer that placing supplied information on the register does not mean it has been verified or validated. Use the register to resolve the contracting party, then reconcile it with invoices, insurance and data terms.

Treat supplier claims as claims

Separate each proposition into supplier statement, evidence opened, buyer verification and unresolved point. A service page can establish that the supplier advertises a service on the evidence date. It cannot prove staffing, competence, outcome or capacity for your project.

Awards, partner badges, directory positions and testimonials need the same restraint. Check the issuer, scope, holder, expiry and exact benefit claimed. The ASA and CAP testimonials guidance says marketers should hold documentary evidence that testimonials are genuine. CAP advice is not legal advice.

Grade evidence by what it can establish

The Competition and Markets Authority's guidance for businesses and agencies addresses fake reviews and inducements. Its separate guidance for review sites covers clear processes, the full picture and disclosure of interests. Apply those sources where this site publishes or derives information from reviews.

Compare delivery with one script

Use the same evidence request for every agency. Cover discovery, research, content, design and development. Then cover integration, hosting, migration, accessibility and security. Finally cover analytics, acceptance, support, change and exit. For each lane, ask for the owner and deliverable. Ask for the dependency, acceptance method, exception route and handover artefact.

Do not replace evidence with a presentation score. If testing is proportionate and authorised, use synthetic or permissioned fixtures. Keep the task, environment and build constant. Keep the browser or assistive technology, assessor, expected result and evidence method constant. A failed test rejects the tested configuration only.

The W3C conformance evaluation overview explains scope, sampling, expertise and reporting for accessibility evaluation. It does not determine English legal duties or certify an agency. Use it to design an accessibility evidence request, then obtain qualified legal review.

Review platforms separately from agencies

An agency and its chosen platform are different subjects. Record the exact service edition and account owner. Record the hosting model and plugin boundary. Record the source-control route and permissions. Record data export, backup, support and termination terms. A platform feature does not prove the agency configured it correctly.

For a bounded CMS comparison, first-party records may show documented functions. WordPress.com's current Business plan record describes its managed plan. Webflow's Site plan guidance explains its site-level plan structure. These products are not exact equivalents. Commercial terms and buyer acceptance remain unknown until current order documents exist.

Keep risk gates non-compensating

A strong design presentation cannot offset a failed security or rights gate. Record separate pass, fail or unresolved decisions for delivery scope, accessibility and privacy. Do the same for security, rights, advertising, procurement and exit.

The NCSC's supplier assurance questions cover governance, incidents and data. They also cover offshoring, testing and contracts. Answering a questionnaire is not certification. The ICO's controller-processor contract guidance is under review following legal change. Roles depend on the actual decisions and processing.

The Intellectual Property Office overview notes that a self-employed creator usually owns commissioned intellectual property unless the contract changes the position. The real agreement must identify existing materials, new work and licences. It must also cover territories, duration, moral rights and handover.

Write a bounded verdict

The final review should say one of four things: proceed to a specified next gate, proceed with conditions, hold pending named evidence, or reject against a declared mandatory criterion. Name the evidence, owner and expiry behind the decision.

Do not write best overall unless the eligible population is complete and the ranking method can bear that claim. This named review covers seven England agencies and selected platforms. It has no project-specific tests, so it publishes no winner.

Next step: issue one evidence request

Send each candidate the same brief, evidence schedule and authorised test script. Reconcile the legal identity, then log every response as verified, supplier-stated or unresolved. Stop if a mandatory gate lacks an accountable owner.

Before any 2027 use, re-open every company record, first-party service page, regulator page, product edition and contract term. Name the human reviewer, rerun agreed tests and publish corrections without erasing the earlier evidence state.

Before you act

Common questions

What should a review disclosure contain?

It should name the reviewer, role, competence and approval authority. It should give the legal entity and edition examined. It should give discovery and cut-off dates. It should list the eligible universe, inclusion rules and exclusions. It should state funding, gifts, affiliate links and supplier access. It should publish the scoring formula, missing-data treatment, correction route and evidence expiry.

Why is an active-company label not an endorsement?

Companies House warns that placing supplied information on its register does not mean it has been verified or validated. The register can resolve the contracting party, but it cannot show trading performance, competence, solvency or service quality. Identity is one gate, not a proxy score.

How should practical testing be handled?

Use synthetic or permissioned fixtures. Keep the task, environment and build constant. Keep the browser or assistive technology, assessor, expected result and evidence method constant. A failed test can reject the tested configuration, but it does not establish that an entire agency is incompetent.