1 What this draft is
TouchStone V3 is the scoring method proposed to replace today's V2. It is a draft: no score is calculated with V3 today, and every live measurement and record is made with V2.
The aim is to move the score from "a well-built site" to "a site you can trust and do business with". The question it asks: can a person, a buyer or an AI assistant trust this site and get things done on it?
Three things change
- High grades become scarce (they are given relative to peers).
- A weak area can't be made up for by another area.
- A grade can't be higher than the evidence behind it supports.
What stays the same
- Measurement is free.
- A score can't be bought.
- The basis of every check is published.
- The same rule applies to everyone, including ourselves.
- The test is passive (no Load Test or Security Scan without permission).
2 Six pillars and their weights
The eight layers of V2 are gathered into six pillars. The weights add up to 100.
| Pillar | Weight | The question it asks | In V2 |
|---|---|---|---|
| Security and Resilience | 20 | Are the connection, site settings and email secure; does the site go down with a single failure? | Security (20), Email (10) |
| Experience and Performance | 18 | Can real visitors use the site quickly and without trouble? | Speed (20) |
| AI Compatibility | 18 | Can an AI assistant read the site, understand it correctly and get its task done? | Visibility (10) |
| Trust and Authority | 18 | Is the organisation behind the site real, and can what it says be verified? | Trust (10) |
| Ethics and Carbon | 14 | How much of a burden does the site put on its visitors and on nature; does it do what it says? | Privacy (10), Environment (5) |
| Accessibility | 12 | Can everyone use it? | Accessibility (15) |
Accessibility seems to lose weight, but its effect grows: the names of buttons, links and form fields also count in AI Compatibility.
3 What each pillar measures
Each line shows its status:
- today measured in V2
- Phase 1 the first 3 months after the draft is published
- Phase 2 months 3 to 9 after that
Security and Resilience
- today Connection security, certificate, security headers, domain signing
- today Domain records against fake email
- Phase 1 Whether software versions visible on the site match vulnerabilities known to be actively exploited
- Phase 1 Support for post-quantum key exchange; basis NIST IR 8547
- Phase 1 Routing and mail server validation; basis RFC 6480 and RFC 7672
- Phase 1 Third-party script inventory and integrity checks; on payment pages PCI DSS 6.4.3
- Phase 2 Dependence on a single provider: content delivery, domain, payment
Experience and Performance
- today Core Web Vitals from real-visitor data; lab measurement if there is none
- Phase 1 The trend of real-visitor data and where it stands among peers
- Phase 1 The gap between lab measurement and real-visitor data: a site that only behaves well for test tools
AI Compatibility
- today Search and sharing basics: title, description, sitemap, structured data
- Phase 1 Access and policy: a clear, consistent rule for AI bots; blocking is not penalised, contradictory rules cost points
- Phase 1 Readability without rendering: how much of the main content arrives without running scripts
- Phase 1 Semantic structure: does the structured data match the visible content; names of buttons, links and form fields
- Phase 2 Task completion: can an assistant finish tasks suited to the type of site; at least two different models, three tries per task, the median
- Phase 2 Grounding fidelity: does the model correctly answer factual questions asked about the page
- Phase 2 Resistance to manipulation: is there a hidden instruction on the page aimed at assistants
- How often models cite the site does not count toward the grade; it is a measure of popularity.
Trust and Authority
- today Broken links, contact details, threat lists
- Phase 1 Identity: do the legal entity name and registration details match the official register
- Phase 1 Business transparency: prices, returns, delivery, terms, a way to complain
- Phase 1 Record: known data breaches and regulatory decisions, the age of the domain and changes of hands
- Phase 2 Content integrity: author, date, sources, corrections policy; labelling of AI-generated content
- Phase 2 Genuine reviews and claim checks: do claims of credentials, awards and memberships match the records
- Phase 2 Price honesty: was the crossed-out old price really charged
Ethics and Carbon
- today Tracking cookies set before consent, the cookie consent tool
- today The carbon estimate of one page view and the energy source of the hosting
- Phase 1 Real device mix and the country's grid intensity in the carbon calculation
- Phase 1 Respecting the "do not sell my data" signal (Global Privacy Control)
- Phase 2 Gap between statement and behaviour: are the recipients named in the privacy notice the same as the recipients observed
- Phase 2 Consent screen balance: is refusing as easy as accepting
- Phase 2 Dark patterns: fake countdowns, fake stock warnings, pre-ticked boxes, fees that appear in the basket, hard cancellation
Accessibility
- today Automated WCAG 2.2 A/AA check, page language, alternative text, heading structure
- Human review: keyboard and screen reader (only at evidence levels E3 and E4)
4 Calculation
Indicator score. Continuous measurements are converted to a percentile in the peer distribution. V2's rule "passing the good threshold earns 100" goes away; 100 is given only to the top 1 percent. Yes-or-no measurements become gates, not points. The exception is a saturated measure: if more than half of the peer group gets the best value, percentiles can't tell sites apart, so that indicator is scored 0–100 from its raw value. The best end of the scale gets 100, the worst end gets 0, and everything in between is proportional: if the share of links that open is 0.96, the score is 96. For numbers with no upper limit (for example, the number of errors found in the accessibility check), the worst end is a fixed value published with the peer table; that value and anything worse gets 0.
Median across organisations. If more than one organisation measures the same thing, the median is taken (V2's "one organisation, one vote"). In AI tests each model provider counts as one organisation. If the measurement from one of the organisations that should measure can't be taken because of a problem on that organisation's side, it is retried within 24 hours; if it still can't be taken, the indicator is calculated from the remaining organisations and the measurement counts as provisional. If the latest measurement behind a grade is provisional, the grade is provisional too: the result says "provisional", and it is left out of rankings that compare sites. This rule does not apply if the measurement can't be taken because the site blocks that organisation: that organisation's measurement counts as 0 points for that indicator, and the median is taken that way (step 8).
Pillar score. The weighted geometric mean of the sub-measurements. In an arithmetic mean a weak sub-measurement is covered up by the others; in a geometric mean it can't be.
Total. The weighted geometric mean of the pillars.
Gates. A single finding caps a pillar or the total (section 7).
Balance rule. The total grade can't be more than two steps above the weakest pillar. A site rated CCC for security gets at most BB in total.
Evidence level. A grade can't be higher than the evidence at hand can carry (section 6).
Coverage. Coverage is counted at pillar level: a pillar with at least one of its indicators measured counts as measured. If the weight that can't be measured exceeds 20 percent, no grade is given: NR (not rated). For each pillar, how many of its indicators were measured is written next to the grade. Closing a site to measurement does not lead to NR; it leads to the lowest score in the pillar concerned.
Time. The grade is calculated from the measurements of the last 90 days (the median per pillar). The trend sets the Outlook, an incident sets the Watch (section 8).
Letter. The total is converted to a letter by its percentile in the peer group (section 5). Each pillar also gets a letter from its own peer distribution, using the same bands; gates and the balance rule work with these letters. In a saturated distribution (more than half of the peer group at the top score), those with the top score get AAA; the others get their letter from their score: above 95 AA, above 85 A, above 65 BBB, above 40 BB, above 15 B, the rest CCC. Otherwise a single small flaw would drop the letter by several steps.
Every grade can be reproduced from three things: the method version, the evidence summary and the version of the peer table. All three are written on the Measurement Score.
5 Letter scale
| Grade | Condition | Minimum evidence |
|---|---|---|
| AAA | Top 1 percent of peers; no pillar below A | E4 |
| AA | Top 5 percent | E3 |
| A | Top 15 percent | E2 |
| BBB | Top 35 percent | E1 |
| BB | Top 60 percent | E1 |
| B | Top 85 percent | E1 |
| CCC | The remaining 15 percent | E1 |
| D | Gate: threat list or a planted hidden instruction | E1 |
| NR | Not enough coverage; not rated |
- Peer group: sites of the same type measured in the same country. The peer table is dated and versioned; it contains at least 500 sites, with at least 500 sites measured in every pillar. The first table is published in Phase 1; no letter grade is given until it is published.
- If more than half of the peers are at the top score, the score ranges in step 10 of section 4 are used instead of the percentile bands.
- This is not a credit rating; it describes the measurable state of a website.
6 Evidence levels
| Level | Evidence | How it is obtained | Highest possible grade |
|---|---|---|---|
| E1 | Passive measurement from outside and public registers | For everyone, without permission | BBB |
| E2 | Ownership verified; real-visitor and consent data connected by the owner | With a domain record; free | A |
| E3 | Deep Test: Load Test, Security Scan, human accessibility review (Manual Test), logged-in flow tests | With the owner's permission; fixed fee | AA |
| E4 | Independent auditor review and yearly oversight | Through the auditor network | AAA |
- An E1 grade is published with the note "based on public data".
- E2 stays free: an A grade is earned by verifying ownership, not by paying. A fee is charged only at levels that need human work, and it doesn't depend on the result.
7 Gates
| Gate | Result |
|---|---|
| On a threat list (the V2 rule) | Total D, "Suspicious" |
| A hidden instruction aimed at assistants, planted by the site owner | Total D |
| No valid HTTPS (the V2 rule) | Total at most CCC |
| A visible software version with an actively exploited vulnerability older than 30 days | Security and Resilience at most B; total at most BBB |
| The legal entity of a commercial site can't be verified | Total at most BBB |
| An ad tracker running before consent | Ethics and Carbon at most BB |
| Two proven dark patterns | Ethics and Carbon at most B |
| A made-up rating in structured data, or a credential claim not found in the records | Trust and Authority at most B |
| Less than half of the main content arrives without running scripts | AI Compatibility at most B |
| Price, stock or rating in structured data contradicts what is shown | AI Compatibility at most B |
| No way to refuse on the consent screen; undeclared session recording or data recipient | Ethics and Carbon at most B |
Version detection can be wrong: some versions are patched but keep an old number. That is why the known-vulnerability gate first opens as a Watch; if the site owner doesn't respond within 30 days, it turns into the cap.
8 Outlook and Watch
Outlook
- Tells the direction of the grade: Positive, Stable, Negative.
- The median of the last 30 days is compared with the median of the 60 days before; if the difference exceeds 3 points, the direction is written.
- If either period has fewer than three measurements, no Outlook is written.
Watch
- Stays open for 30 days after an incident: an announced data breach, getting onto a threat list, a known-vulnerability match, a large gap between lab and real-visitor data.
- A Watch doesn't change the grade; it says the grade is under review.
9 Sector profiles
A profile shifts the weights by at most 5 points (the total stays 100) and adds extra gates. How much is taken from which pillar is written in the profile table; profile tables are published before V3 takes effect. With larger shifts, grades could not be compared across sectors.
| Profile | Pillar with more weight | Extra gate |
|---|---|---|
| E-commerce | Trust and Authority, Ethics and Carbon | Script inventory on the payment page; e-commerce registration in Türkiye; return terms |
| Media and publishing | Trust and Authority | Corrections policy; labelling of AI content |
| Public sector, health, education | Accessibility, Security and Resilience | Gap between the accessibility statement and the measurement |
| Software | Security and Resilience, AI Compatibility | Incident reporting page; dependency map |
10 Grade glossary
| Term | Meaning | In Turkish |
|---|---|---|
| Grade | The site's result, written as letters (from AAA to D) | Not |
| Pillar | One of the six areas that make up the grade | Sütun |
| Peer group | Sites of the same country and type that the grade is compared with | Emsal |
| Saturated measure | A measure where more than half of the peers get the best value; scored from the raw value instead of the percentile | Doygun ölçüm |
| Gate | A finding that on its own caps a pillar or the total | Kapı |
| Balance rule | The total grade can't be more than two steps above the weakest pillar | Denge kuralı |
| Evidence level | The strength of the evidence behind the grade: E1, E2, E3, E4 | Kanıt düzeyi |
| Based on public data | A grade given by measuring from outside, without the site owner's input | Kamuya açık veriye dayalı |
| Outlook | The direction of the grade: Positive, Stable, Negative | Görünüm |
| Watch | A marker saying the grade is under review after an incident | İzleme |
| NR | Not rated: the part that could be measured is not enough | Notlanamadı |
| Provisional grade | A grade whose latest measurement is missing one organisation's measurement because of that organisation's own problem; left out of rankings that compare sites | Geçici not |
| Measurement Score | The signed record of a single measurement (the document issued today) | Ölçüm Belgesi |
| Rating | The result given with a letter grade, an Outlook and a 90-day window | Derecelendirme |
| Verified rating | A result valid for 12 months and under oversight, for a site whose ownership is verified and which has passed a deep test | Doğrulanmış Derecelendirme |
11 Comment period
The draft is open for comment for 30 days from the day it is published. The start and end dates are written at the top of the page.
What do you think?
Anyone can comment: site owners, agencies, developers, academics.
The button opens WhatsApp.
If you'd rather write by email: hello@traverta.dev
Every comment is recorded. When the period ends, a summary of the comments received and our answers are published on this page; no one's name is written without their permission.
- What comments can change: weights, thresholds, gates, the bands of the letter scale, terms. What won't change: the principles in section 1.
- For V3 to take effect, four conditions must all be met: the comment period has ended, the reliability study is published, the peer table is published, and every indicator marked Phase 1 in section 3 is being measured. The date it takes effect is announced at least 30 days in advance.
- Changes to the draft are written in this section with their dates. 11 November: four changes from a trial in which TRAVERTA applied this draft to 88 sites measured with V2: the saturated measure and saturated letter rule (section 4, steps 1 and 10), a provisional grade when an organisation is missing (step 2), counting coverage at pillar level (step 8), and the fourth condition for taking effect. The trial showed that, applied to the letter, the draft gave no site a grade today, and that a single broken link dropped a pillar from AAA to B.
- During the transition, Measurement Scores issued with V2 stay valid and show which method they were measured with.
12 What we don't measure
- Security vulnerabilities no one knows about yet can't be measured. What is measured is exposure to known, actively exploited vulnerabilities and how fast they are patched.
- The eyes and clicks of real visitors on someone else's site can't be tracked. This data is used only if the site owner connects it.
- Whether a site sells its visitors' data can't be proven from outside. What is measured are the traces of selling: tracking before consent, undeclared recipients, ignoring the signal.
- Whether a piece of content is true is not measured automatically. What is measured is the process: sources, author, corrections.
- Tests done with AI give slightly different results on every run. That is why several models and several tries are used, versions are recorded, and the margin of variation is published.
The method in force today: TouchStone V2. To measure your site: site check.