Tools and providers
Part of Write the operating case before comparing landing page software products
Select landing page software with gates that a good score cannot compensate for
Select landing page software through a declared use case, seven pass-or-fail gates, supplier evidence, a controlled trial and a rehearsed exit.
Choose a landing page tool by proving that one exact edition can run one declared page workflow. Do not begin with a star rating, a feature count or a supplier demonstration. Begin with the event an authorised user must complete and the visitor must understand.
This is an editorial selection method, not legal, security, accessibility or procurement approval. A named specialist must assess the actual buyer, configuration and contract before purchase.
What to take away
- Start with the event an authorised user must complete and the visitor must understand, not a star rating.
- A failed privacy or accessibility gate cannot be rescued by a weighted total.
- Mark a capability unknown if the supplier cannot show it in the exact edition.
- Set stop conditions before the trial, because an unknown essential result is not a quiet pass.
- The lowest subscription figure need not be the least costly operating choice.
Write the test case
Use a real operational need but synthetic test data. Record the visitor population, acquisition message, page purpose, domain, form fields, tracking, destination systems, owner and withdrawal route.
Add what the existing website or manual process can already do, as set out in the selection checklist. That baseline stops a new subscription being treated as the only option.
Test case record fields
- Visitor population
- Acquisition message
- Page purpose
- Domain
- Form fields
- Tracking and destinations
- Owner and withdrawal route
How much confidence a provider must earn depends on how the service will be used. The NCSC cloud guidance makes the method depend on the level of confidence needed in the service. Turn that into an evidence request: a brochure page and a page collecting sensitive enquiries should not get the same security answer.
Create non-compensating gates
Give each gate an owner, test, proof source, expiry and a result of pass, fail or unknown.
Seven non-compensating gates
Gate
- Function
- Create, publish, restore
- Domain
- DNS and certificates
- Data
- Fields, retention, exports
- Security
- Identity, audit, incidents
- Accessibility
- Rendered page and editor
- Commercial
- Party, term, limits
- Exit
- Rebuild outside service
What it tests
- Function
- Domain
- Data
- Security
- Accessibility
- Commercial
- Exit
| Gate | What it tests | Proof source |
|---|---|---|
| 1. Domain control | Publish on, and recover, your own domain | Trial on a spare domain |
| 2. Privacy and contract | Roles, instructions, sub-processors, deletion | Draft order form and data terms |
| 3. Tracking | Scripts, pixels and cookies that actually load | Network review of the trial page |
| 4. Accessibility | Keyboard-only completion of the core task | Your own test, not a statement |
| 5. Security evidence | Independent validation that is recent | Supplier evidence pack |
| 6. Export and exit | Pages, forms and records leave intact | Trial export and withdrawal |
| 7. Operating cost | Whole-life cost in GBP with VAT status | Dated quote plus internal work |
For gate 4, use WCAG 2.2 level AA as the test benchmark. Section 20 of the Equality Act 2010 sets a duty to make reasonable adjustments where a provision, criterion or practice puts a disabled person at a substantial disadvantage, so a failed keyboard test is a legal risk, not a cosmetic issue.
Never use a weighted total to rescue a failed privacy, security or accessibility gate. A supplier's accessibility statement may help frame questions, but it is not test evidence for the buyer's finished page. A qualified reviewer must set the legal and product scope.
Candidates to run through the gates
Name the products before you score them. These are examples of landing page tools that a small team might shortlist. This site has not tested them and gives no scores or prices for them.
| Candidate | Edition to confirm | Gate result |
|---|---|---|
| Unbounce | Exact plan on the order form | Blank until tested |
| Instapage | Exact plan on the order form | Blank until tested |
| Leadpages | Exact plan on the order form | Blank until tested |
| Landingi | Exact plan on the order form | Blank until tested |
| HubSpot landing pages | Exact hub and tier | Blank until tested |
| Mailchimp landing pages | Exact plan on the order form | Blank until tested |
Also run the baseline: the existing website builder or a manual page. A tool that fails gate 1 or gate 6 should not reach a paid trial.
Build an evidence matrix
For every claimed capability, capture the official product page, exact edition, retrieval date, geography, limitation and renewal trigger. Ask for a demonstration in the edition named on the order form. Mark the result unknown if the supplier cannot show it.
For gate 5, ask about named schemes. Cyber Essentials is a certification scheme aligned to five technical controls, and Cyber Essentials Plus adds independent testing of those controls. ISO/IEC 27001 is another scheme to request, with its scope and date. A badge proves little by itself. The evidence behind a certification gives confidence, not the fact that a service holds one. The certificate must also apply to how and where the service is hosted, and it should be recent.
A buyer whose supplier will not provide independent validation is left relying on the supplier's own assertions. Compare each claim with the vendor due diligence record.
Review the data terms separately
Where the supplier handles personal data for you, UK GDPR Article 28 requires a contract under which the processor acts only on documented instructions from the controller. It also covers the use of further processors, so ask for the sub-processor list.
Detailed ICO guidance on controller and processor contracts is marked as under review following the Data (Use and Access) Act. Recheck that source status before signature. The data protection record should hold one row per purpose, and the commercial contracts review should cover the remaining terms.
Tracking is a separate test. ICO guidance on storage and access technologies was finalised on 29 April 2026, and the rules apply to any use of these technologies in web browsers, mobile apps and connected devices. Regulation 6 of PECR bars storing information in, or gaining access to information stored in, a user's terminal equipment, subject to its exceptions. Inspect the actual scripts and their purposes rather than relying on a template banner.
Use a bounded trial
Put each candidate through the same script. Follow the operating workflow to build the page, then use keyboard-only navigation and trigger valid and invalid form states.
Review network activity and pass a synthetic record to a segregated destination. Withdraw the page, restore a previous version and export the agreed evidence. Keep screenshots, configurations and timestamps.
Set stop conditions before the trial starts. Loss of domain control, an unapproved tracker, an inaccessible core task, a missing critical export or an unresolved contract party should stop the decision.
Finally, request a dated GBP quote from each supplier's own pricing or sales channel, because a third-party list is not a quote. This site publishes no figures for that reason.
The quote should show VAT status, billing unit, period, term, edition, limits, add-ons, support, renewal and promotion conditions. Add implementation, assurance, content, recovery and exit work in a separate sheet covering the hidden costs.
Before you act
- Write a test case using real needs and synthetic data.
- Give each gate an owner, test, proof source and expiry.
- Capture the official product page, edition and retrieval date.
- Review personal-data contracts separately before signature.
- Inspect actual scripts and purposes, not a template banner.
- Request a dated GBP quote with VAT status and term.
Common questions
What should I do before looking at ratings or supplier demonstrations?
Begin with the event an authorised user must complete and the visitor must understand. Record the visitor population, page purpose, domain, form fields, tracking, destination systems, owner and withdrawal route. Add what the existing website or manual process can already do.
Can a high score make up for a failed privacy or accessibility gate?
No. Do not use a weighted total to rescue a failed privacy or accessibility gate. A qualified reviewer must decide the legal and product scope, and a supplier statement is not test evidence for the finished page.
What should stop the decision during a trial?
Set stop conditions before the trial. Loss of domain control, an unapproved tracker, an inaccessible core task, a missing critical export or an unresolved contract party should stop the decision. An unknown essential result is not a quiet pass.
