{ "url": "https://www.booking.com", "auditedAt": "2026-07-17T20:29:24.216Z", "mode": "report", "status": "completed", "statusDetail": "Coverage-complete representative audit of six paths/templates. Excludes authenticated account management, payment submission, post-booking management, partner extranet, cruises, cars, attractions, taxis, and locale-by-locale duplication because they require credentials/transactions or are separate product templates.", "page": { "appType": "hybrid", "framework": "React-like client application / server routing", "notes": "Public commerce MPA/hybrid with client-rendered core homepage content and distinct product templates." }, "evidenceUsed": [ "screenshot", "dom", "evaluate-probe", "layout-metrics", "trace", "har", "discoverability", "headers", "cookies", "trackers", "images", "secrets", "lighthouse", "axe-core", "heap-summary", "robots/sitemap fetch", "Modern Web Guidance 0.0.172" ], "guidanceConsulted": [ "dark-mode", "component-specific-light-dark-theme", "accessibility", "adapt-scrollbar-to-contrast-preferences", "same-document-transitions", "cross-document-transitions", "group-element-transitions", "faster-spa-view-transitions", "scrollytelling", "parallax-scroll-effects", "scroll-entry-exit-effects", "carousel-slide-effects", "physics-based-easing", "individual-transform-properties", "animate-element-entry-exit", "animate-to-from-top-layer", "animate-to-intrinsic-sizes", "dynamic-sibling-animations", "interactive-content-reveal", "pull-to-reveal", "swipe-to-remove", "shrinking-header-on-scroll", "scroll-progress-indicator", "scroll-position-aware-elements", "scroll-snap-realtime-feedback", "scroll-snap-state-sync", "scroll-target-on-load", "soft-edge-content-fade", "scrollability-affordance-hints", "anchor-positioning-tab-underline", "position-aware-tooltips", "interest-triggered-tooltips", "interest-triggered-action-previews", "directional-navigation-transitions", "carousel-snap-highlights", "navigation-drawer", "stack-drill-down", "persistent-app-tours", "persistent-toast-notifications", "light-dismiss-a-dialog", "platform-controls-dismiss-dialog", "declarative-dialog-popover-control", "animated-select-picker", "branded-select-styling", "brand-consistent-forms", "custom-select-picker-layouts", "rich-media-picker", "complex-shapes", "shaped-cutouts", "overflow-clipping-control", "visually-texture-content", "apply-webgl-shaders", "interactive-content-in-3d-scenes", "highlight-text-ranges", "prevent-text-wrapping", "customize-scrollbar-color-and-thickness", "export-html-media-from-canvas", "fluid-scaling", "calculate-with-intrinsic-sizes", "css-layout", "size-aware-styling", "content-based-styling", "child-state-based-styling", "design-token-reactivity", "dynamic-sibling-styling", "form-fields-automatically-fit-contents", "improve-text-layout-and-legibility", "forms", "accessible-error-announcement", "required-field-feedback", "validate-input-after-interaction", "identify-inp-causes", "schedule-tasks-by-priority", "optimize-preload-priority", "improve-next-page-load-performance", "interactions-in-complex-layouts", "performance", "visually-stable-font-fallbacks", "break-up-long-tasks", "identify-heavy-scripts", "optimize-script-priority", "defer-rendering-heavy-content", "defer-work-until-scroll-ends", "optimize-image-priority", "conditional-async-dependencies", "expose-canvas-content-to-browser-features", "move-dom-element-without-losing-state", "precise-text-alignment", "visually-stable-mixed-fonts", "css", "html", "reduce-style-repetition", "security", "privacy", "batch-analytics-events", "full-session-analytics", "calculate-total-foreground-time", "passkeys", "passkey-registration", "passkey-authentication", "passkey-reauthentication", "passkey-conditional-create", "passkey-management", "flicker-free-client-side-ab-testing", "consistent-cross-document-transitions", "stabilize-reactive-state", "resilient-context-menus-and-nested-dropdowns", "persistent-top-layer-ui", "detect-initial-visibility-state", "sequence-distributed-events", "translator", "language-detection", "support-global-calendar-systems", "capture-location-agnostic-data", "format-human-readable-durations", "manage-recurring-intervals", "calculate-event-differentials", "coordinate-global-events", "model-partial-time-concepts", "search-hidden-content", "select-menu-interaction", "style-parent-with-has", "autofill-address-form", "autofill-payment-form", "autofill-sign-in-form", "autofill-sign-up-form", "autofill-highlight-inputs", "deliver-optimized-decorative-images", "resolution-optimized-pseudo-elements", "deprioritize-background-fetches", "efficient-background-processing", "webmcp", "agentic-forms", "agentic-javascript-tools", "language-model", "summarizer" ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 58, "blocked": 0, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": true }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "issues", "confidence": "high", "method": "a screenshot or computed background under an emulated prefers-color-scheme: dark condition will reveal whether surfaces re-tint; the page CSS / a color-scheme declaration is corroborating evidence. The model chooses the method.", "evidence": "The dark-mode screenshot and preference probe show prefers-color-scheme: dark matched while color-scheme remained normal and body stayed rgb(255,255,255).", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dark.png", "evidence/preferences-probe.json" ], "findingIds": [ "F01" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "pass", "confidence": "high", "method": "a transition video, or an in-page probe of getAnimations()/computed animation under an emulated prefers-reduced-motion: reduce condition, can show whether motion stops. The model chooses.", "evidence": "Under emulated reduced motion, matchMedia matched and document.getAnimations() contained only one already-finished 0.01 ms animation.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "pass", "confidence": "high", "method": "a screenshot under emulated prefers-contrast: more / forced-colors, or an axe/contrast probe, can show whether controls and text survive. The model chooses.", "evidence": "Axe passed color-contrast and CSS inspection found forced-colors/prefers-contrast handling.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "issues", "confidence": "high", "method": "a transition video of a route/state change shows whether it animates; the page source / ::view-transition usage corroborates. The model chooses.", "evidence": "Live CSS inspection found no view-transition rules across the homepage application CSS.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ], "findingIds": [ "F02" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "issues", "confidence": "high", "method": "source/CSS inspection for animation-timeline: scroll()/view(); a long-task / scroll-handler probe can flag the main-thread anti-pattern. The model chooses.", "evidence": "Live CSS inspection found no animation-timeline or scroll-timeline usage.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ], "findingIds": [ "F03" ] }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "issues", "confidence": "high", "method": "CSS inspection for scroll-snap / overscroll-behavior / physics-based easing vs custom pointermove listeners. The model chooses.", "evidence": "Live CSS inspection found no scroll-snap rules on a homepage containing horizontally presented destination/property groups.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json", "evidence/home-mobile.png" ], "findingIds": [ "F04" ] }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "issues", "confidence": "high", "method": "a transition video of scrolling, or CSS inspection for scroll-state container queries. The model chooses.", "evidence": "CSS inspection found no scroll-state container queries or scroll timeline, while long pages retain substantial navigation chrome.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json", "evidence/home-desktop.png" ], "findingIds": [ "F05" ] }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "issues", "confidence": "high", "method": "CSS inspection for anchor-name / position-anchor / position-try on overlays; a screenshot of an open overlay near a viewport edge can show drift. The model chooses.", "evidence": "The homepage contains custom date and occupancy overlays, but CSS inspection found no anchor-name, position-anchor, or position-try rules.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json", "evidence/city-desktop.png" ], "findingIds": [ "F06" ] }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "pass", "confidence": "high", "method": "CSS inspection for ::highlight / scroll-marker; a transition video can show whether attention is cued after navigation. The model chooses.", "evidence": "City and property screenshots show breadcrumbs, selected product navigation, section tabs, and explicit Reserve/Search actions.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "pass", "confidence": "high", "method": "a screenshot on load, or a DOM probe for full-viewport overlays present before interaction. The model chooses.", "evidence": "Desktop/mobile load screenshots show the search remains usable; the sign-in info is dismissible and does not cover the primary form.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "issues", "confidence": "high", "method": "DOM/source inspection for popover / /
vs custom overlay divs with manual dismiss handling. The model chooses.", "evidence": "The DOM probe found 0 dialog, 0 popover, and 0 details elements despite date, occupancy, menu, and sign-in overlays.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json", "evidence/form-error.png" ], "findingIds": [ "F07" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "issues", "confidence": "high", "method": "a screenshot plus layout metrics can show the proportion of the viewport given to chrome vs content. The model chooses.", "evidence": "The first viewport uses the only H1 for “Earn $150 in Travel Credits”; screenshots also show dense product navigation and promotional cards before destination content.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/platform-probe.json" ], "findingIds": [ "F08" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "pass", "confidence": "high", "method": "layout metrics (scrollWidth vs innerWidth) and a screenshot at an emulated narrow mobile viewport reveal overflow. The model chooses.", "evidence": "At 360x800 the layout primitive measured scrollWidth=clientWidth=360 and 0 horizontal overflow with viewport meta present.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "issues", "confidence": "high", "method": "CSS inspection for @container / container-type; a computed-style probe of the same component in a wide vs narrow container shows whether it adapts. The model chooses.", "evidence": "Inspection of accessible stylesheets found no @container rule, although reusable search, card, and navigation components appear at multiple widths.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json", "evidence/home-mobile.png" ], "findingIds": [ "F09" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "pass", "confidence": "high", "method": "a focus probe (focus an element, read the computed outline) or an axe target-size check; a screenshot of a focused control corroborates. The model chooses.", "evidence": "Mobile layout is touch-oriented; Lighthouse accessibility was 0.99 and axe found no target/focus violation in the exercised page.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "issues", "confidence": "high", "method": "screenshot the first viewport and key scrolled states; inspect heading structure, nav labels, button text, and visual hierarchy; a task walkthrough can show whether the next action is obvious. The model chooses.", "evidence": "The rendered H1 is “Earn $150 in Travel Credits”; the destination search has no equivalent page-level heading even though it is the primary task.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/platform-probe.json" ], "findingIds": [ "F10" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "pass", "confidence": "high", "method": "run the flow manually with screenshots/DOM snapshots at each step; compare expected vs actual path length; inspect form requirements, navigation continuity, and blockers. The model chooses.", "evidence": "The tested homepage -> New York listing -> Hotel Indigo detail path remained continuous and exposed Search then Reserve without an account wall.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "pass", "confidence": "high", "method": "exercise network delay/failure, invalid input, empty data and success states; screenshot the state messaging and recovery controls; inspect whether browser history and focus remain sensible. The model chooses.", "evidence": "Invalid search focused an invalid destination and announced “Enter a destination to start searching” via an alert; the 404 page offered search, home, destination list, and bug report recovery.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "high", "method": "Lighthouse reports LCP/CLS/TBT directly and the model may run it; layout metrics + a layout-shift observer + a long-task observer (the evidence primitives) give the same signal first-party. The model chooses.", "evidence": "Lighthouse measured performance 0.43, LCP 26.8 s, FCP 6.0 s, TBT 450 ms, and TTI 42.1 s; a separate trace measured LCP 1.96 s but still recorded blocking work.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/home-trace-summary.json" ], "findingIds": [ "F11" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "pass", "confidence": "high", "method": "the layout primitive's CLS observer captures shifts; a transition video of the first seconds shows content jumping. The model chooses.", "evidence": "Lighthouse CLS was 0.075 (good range) and mobile layout observation recorded CLS 0 with no shifts.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "issues", "confidence": "high", "method": "the layout primitive records long tasks; a heap summary shows the object population; Lighthouse reports TBT. The model chooses.", "evidence": "Lighthouse reported 5.8 s main-thread work and 3.5 s JavaScript execution; the trace found 3 long tasks, the longest 211 ms, with 191 ms TBT.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/home-trace-summary.json" ], "findingIds": [ "F12" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "a HAR summary can reveal cache headers, redirects, render-blocking candidates, weight offenders and dependency shape; a trace/Lighthouse insight report can corroborate LCP discovery, render-blocking, font-display and document latency. The model chooses.", "evidence": "HAR captured 166 requests and 4.53 MB transferred, including 74 scripts (3.96 MB) and at least 10 parser-inserted VeryHigh-priority stylesheets; Lighthouse saw 8.7 MiB under its run.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-network-summary.json", "evidence/home-network", "evidence/lighthouse.json" ], "findingIds": [ "F13" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "high", "method": "Lighthouse/trace/code-coverage style evidence can flag unused JS/CSS, duplicated JavaScript and legacy code; a HAR summary shows third-party byte cost and request count. The model chooses.", "evidence": "Lighthouse estimated 2,183 KiB unused JavaScript and 69 KiB unused CSS; the HAR shows 74 script requests.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/home-network-summary.json" ], "findingIds": [ "F14" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "issues", "confidence": "high", "method": "axe-core (injectable via the evaluate primitive) or Lighthouse's a11y audits enumerate these; a DOM probe of the accessibility-relevant attributes is a first-party alternative. The model chooses.", "evidence": "Lighthouse identified five label-content-name mismatches, including “Rent a car”, airport transfer, flight, attractions, and currency controls.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json" ], "findingIds": [ "F15" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "pass", "confidence": "high", "method": "axe contrast rules, a Lighthouse contrast audit, or an in-page probe computing contrast ratios from computed colours. The model chooses.", "evidence": "Injected axe reported no violations and passed color-contrast; Lighthouse accessibility scored 0.99.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "issues", "confidence": "high", "method": "axe/Lighthouse structural audits; a focus-walk probe (tab through, read activeElement + computed outline) is a first-party alternative. The model chooses.", "evidence": "Lighthouse flagged a heading-order failure; DOM inspection shows H1 credit-card promotion followed directly by H3 benefit cards before the first H2.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/platform-probe.json" ], "findingIds": [ "F16" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "pass", "confidence": "medium", "method": "a screenshot of body and heading text, plus CSS inspection for text-wrap / text alignment / font fallback handling. The model chooses.", "evidence": "Desktop and mobile screenshots show readable body sizing, wrapping, spacing, and no clipping in the sampled templates.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "pass", "confidence": "high", "method": "Lighthouse/axe target-size, meta-viewport and media-caption audits are useful signals; screenshots at narrow and zoomed conditions plus DOM/media inspection can corroborate. The model chooses.", "evidence": "Viewport permits initial-scale without disabling zoom; 360px reflow had no overflow and axe/Lighthouse found no corresponding failure.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "issues", "confidence": "high", "method": "capture Runtime/Log CDP events, or a probe that reads collected errors; Lighthouse reports this too. The model chooses.", "evidence": "Lighthouse captured a 404 console/network error for https://www.booking.com/favicon.ico.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json" ], "findingIds": [ "F17" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "issues", "confidence": "high", "method": "a DOM/source probe for doctype/charset/img dimensions; CSS inspection for repetition; Lighthouse best-practices audits cover the rest. The model chooses.", "evidence": "The image primitive found all 84 images lacked width/height attributes; Lighthouse independently failed the unsized-images audit.", "pathIds": [ "home" ], "artifacts": [ "evidence/images.json", "evidence/lighthouse.json" ], "findingIds": [ "F18" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "issues", "confidence": "high", "method": "Lighthouse best-practices audits and DevTools inspector/deprecation signals can surface these; DOM/source probes can verify paste handlers and prompt timing. The model chooses.", "evidence": "Lighthouse failed valid-source-maps for the challenge script and numerous remoteEntry bundles.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json" ], "findingIds": [ "F19" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "pass", "confidence": "high", "method": "a DOM probe reads and meta[name=description]; Lighthouse SEO audits cover the same ground. The model chooses.", "evidence": "DOM probe found a descriptive title and meta description on the homepage.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "issues", "confidence": "high", "method": "a DOM probe for anchor hrefs, viewport meta, and robots; Lighthouse SEO audits corroborate. The model chooses.", "evidence": "Lighthouse found a crawlable “See more” link with no destination-specific wording.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json" ], "findingIds": [ "F21" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "pass", "confidence": "high", "method": "inspect response status and headers, <link rel=canonical>, hreflang links, robots meta, robots.txt and sitemap.xml; Lighthouse SEO audits cover several of these. The model chooses.", "evidence": "Homepage exposes canonical, index,follow, 46 hreflang links; robots.txt publishes extensive sitemap indexes.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "pass", "confidence": "high", "method": "inspect JSON-LD/microdata and social preview tags against visible content; Lighthouse has a manual structured-data audit, and ad-hoc probes can parse schema.org blocks. The model chooses.", "evidence": "Homepage exposes one JSON-LD block and seven Open Graph tags matching the visible Booking.com travel service.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "issues", "confidence": "high", "method": "inspect response headers / page protocol via an evaluate probe or the network layer; Lighthouse best-practices flags HTTPS and CSP issues. The model chooses.", "evidence": "Headers evidence found no CSP, X-Content-Type-Options, clickjacking policy, Referrer-Policy, or Permissions-Policy; cookies evidence found g_state lacked Secure and used SameSite=None. HSTS is strong.", "pathIds": [ "home" ], "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ], "findingIds": [ "F22" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "issues", "confidence": "high", "method": "inspect network requests and third-party origins; a probe of analytics/beacon calls. The model chooses.", "evidence": "HAR recorded 141 third-party requests and 3.80 MB third-party transfer across 13 origins, including consent, Google account, WAF, telemetry, and CDN services.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-network-summary.json", "evidence/trackers.json" ], "findingIds": [ "F23" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "pass", "confidence": "high", "method": "a probe for permission requests fired on load; source inspection for passkey / WebAuthn / navigator.credentials usage in auth flows. The model chooses.", "evidence": "Lighthouse passed geolocation-on-start and notification-on-start; sign-in uses username/current-password autocomplete and page code exposes WebAuthn/passkey signals.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "high", "method": "inspect response headers and browser security state; Lighthouse/DevTools security audits can corroborate HSTS, clickjacking, Trusted Types, origin isolation and third-party cookie findings. The model chooses.", "evidence": "The response had HSTS but no CSP/frame-ancestors or X-Frame-Options, Referrer-Policy, Permissions-Policy, or nosniff.", "pathIds": [ "home" ], "artifacts": [ "evidence/headers.json" ], "findingIds": [ "F24" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "issues", "confidence": "high", "method": "load with scripting disabled or compare a no-JS fetch of the HTML against the rendered page; check for Baseline-aware fallbacks in source. The model chooses.", "evidence": "Raw HTML returned status 202 but only 157 text characters and 1% of rendered content; non-JS view omitted title, H1, description, destination search, and travel content.", "pathIds": [ "home" ], "artifacts": [ "evidence/discoverability", "evidence/discoverability-crawler.png" ], "findingIds": [ "F25" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "pass", "confidence": "high", "method": "exercise menus near viewport edges with a screenshot; a probe of async/visibility behaviour. The model chooses.", "evidence": "Date/occupancy overlays and multi-template navigation remained usable in exercised screenshots with no clipped blocking UI.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "issues", "confidence": "high", "method": "a probe for a service worker registration and a web app manifest; test behaviour offline. The model chooses.", "evidence": "Platform probe found no manifest link and no controlling service worker on a multi-product booking application.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ], "findingIds": [ "F26" ] }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "pass", "confidence": "high", "method": "simulate failed fetches/offline mode or inspect representative 404/500 routes; screenshots and DOM snapshots of error/loading/empty states show whether recovery is possible. The model chooses.", "evidence": "An invalid route produced a clear Page Not Found state with explanation, a search form, home/destination links, and report-a-bug recovery.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "issues", "confidence": "high", "method": "a DOM probe for <html lang>/dir and CSS inspection for logical vs physical properties. The model chooses.", "evidence": "The document correctly sets lang=en-us and dir=ltr and exposes 46 hreflang links, but stylesheet inspection found no logical properties and 106 physical left/right declarations.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ], "findingIds": [ "F27" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "pass", "confidence": "high", "method": "source inspection for Intl.* usage vs hand-rolled formatting; a probe of rendered dates/numbers under a different locale. The model chooses.", "evidence": "US locale rendered dollar currency, localized date labels, and language/currency controls; 46 hreflang variants were present.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ] }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "pass", "confidence": "medium", "method": "source inspection for time-zone-aware date handling vs naive local Date math. The model chooses.", "evidence": "Flights surface clearly labels travel dates and route endpoints; no ambiguous timestamp or DST-sensitive event was exposed in the sampled public flow.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ] }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "pass", "confidence": "high", "method": "a screenshot of consent/upsell/cancel flows; source inspection for declarative button actions vs misleading controls. The model chooses.", "evidence": "Sampled search, listing, detail, auth, and 404 surfaces used explicit Search/Reserve/Sign in labels and disclosed card terms; no forced continuity or disguised ad was observed.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "pass", "confidence": "high", "method": "exercise a form, submit invalid input, and observe timing and clarity of errors via a screenshot or a :user-invalid / aria-invalid probe. The model chooses.", "evidence": "Submitting an empty destination produced a specific aria-live alert and an invalid field rather than blame or data loss.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ] }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "pass", "confidence": "high", "method": "source/DOM inspection for autocomplete attributes on form fields; a probe of autofill affordances. The model chooses.", "evidence": "Auth inputs use autocomplete=username/current-password; travel fields use labelled custom combobox/date/traveller assistance.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ] }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "pass", "confidence": "high", "method": "walkthrough checkout/subscription/auth/account flows when present; screenshot pricing, confirmation, cancellation and reauthentication states; inspect passkey/autocomplete support for sign-in and payment. The model chooses.", "evidence": "Property page clearly exposes Reserve, reviews, address, house rules, legal info and price-match context; auth discloses terms/privacy before continuation.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ] }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "issues", "confidence": "high", "method": "inspect transferred image bytes vs displayed size; source inspection for modern formats and resolution handling. The model chooses.", "evidence": "Images evidence found 63 legacy-format images, 62 without srcset, 6 oversized, and all 84 without intrinsic dimensions.", "pathIds": [ "home" ], "artifacts": [ "evidence/images.json" ], "findingIds": [ "F28" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "issues", "confidence": "high", "method": "a long-task / network probe for background fetches and processing while idle or backgrounded. The model chooses.", "evidence": "HAR attributes 3.80 MB of 4.53 MB and 141 of 166 requests to third-party origins; scripts account for 3.96 MB.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-network-summary.json", "evidence/home-network" ], "findingIds": [ "F29" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "issues", "confidence": "high", "method": "a HAR summary shows third-party bytes, font/media weight and caching; screenshots/video reveal autoplay and decorative media; trace/layout evidence shows whether media/animation keeps work running. The model chooses.", "evidence": "HAR attributes 3.80 MB of 4.53 MB and 141 of 166 requests to third-party origins; scripts account for 3.96 MB.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-network-summary.json", "evidence/home-network" ], "findingIds": [ "F29" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "issues", "confidence": "high", "method": "source inspection for WebMCP / agentic-tool registration and agent-readable affordances. The model chooses.", "evidence": "Platform probe found no WebMCP/modelContext registration despite search and reservation workflows that are valuable to agents; non-JS content is also only 1% complete.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json", "evidence/discoverability" ], "findingIds": [ "F30" ] }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "medium", "method": "source inspection for built-in AI (language model / summariser) usage. The model chooses.", "evidence": "On-device summarisation or generation is not necessary to complete the sampled deterministic travel search and reservation entry tasks; absence is not a failure.", "pathIds": [ "home" ], "reason": "On-device summarisation or generation is not necessary to complete the sampled deterministic travel search and reservation entry tasks; absence is not a failure." }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "pass", "confidence": "medium", "method": "compare heap snapshots for retained growth - a baseline, then one taken after repeating the interaction with `--interact` about 10x (the memory-tracer methodology: baseline -> repeat -> post -> compare). Performance.getMetrics (JSHeapUsedSize, Nodes) across the same before/after window is corroborat", "evidence": "After 10 occupancy open/close interactions, heap self size fell from 60.6 MB to 58.5 MB and sampled used JS heap fell from 78.7 MB to 69.5 MB.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "issues", "confidence": "high", "method": "a single `heap` summary's totals (nodeCount, totalSelfSizeBytes, constructor population) plus Performance.getMetrics (Nodes, JSHeapUsedSize) give the current footprint to judge against the page's purpose. Chrome DevTools MCP heap snapshots and memlab snapshot analysis can provide the same memory dis", "evidence": "Baseline heap summary contained 1,206,314 heap nodes, 5,492,295 edges, and 60.6 MB self size before user interaction.", "pathIds": [ "home" ], "artifacts": [ "evidence/heap-baseline" ], "findingIds": [ "F31" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "pass", "confidence": "high", "method": "the `heap` summary by constructor (Detached* nodes) compared across a before/after pair shows a growing detached-DOM population; an `evaluate` probe can sample listener/timer counts (e.g. getEventListeners-style counting, or instrumenting addEventListener/setInterval) before and after the repeated i", "evidence": "Repeated interaction did not increase total heap nodes (1,206,314 baseline to 1,140,811 post); no accumulation signal appeared in the compared summaries.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F01" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "issues", "findingIds": [ "F02", "F03", "F04" ] }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "issues", "findingIds": [ "F05", "F06" ] }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "issues", "findingIds": [ "F07", "F08" ] }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "issues", "findingIds": [ "F09" ] }, { "principleId": "support-core-task-success", "expectation": "default", "status": "issues", "findingIds": [ "F10" ] }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F11", "F12", "F13", "F14" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F15", "F16" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "issues", "findingIds": [ "F17", "F18", "F19" ] }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F21" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F22", "F23", "F24" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "issues", "findingIds": [ "F25", "F26" ] }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "issues", "findingIds": [ "F27" ] }, { "principleId": "be-trustworthy", "expectation": "default", "status": "pass" }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F28", "F29" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "issues", "findingIds": [ "F30" ] }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "issues", "findingIds": [ "F31" ] } ], "paths": [ { "id": "home", "description": "Homepage and stay-search entry point; represents global navigation, offers, destination search, and shared chrome.", "url": "https://www.booking.com/", "conditions": [ "desktop", "viewport: 360x800", "prefers-color-scheme: dark", "prefers-reduced-motion: reduce", "keyboard focus", "invalid form submission", "no JavaScript crawler" ], "result": "issues" }, { "id": "city-listing", "description": "New York city/listing template reached from search; represents destination search results, filters, dates, and property cards.", "url": "https://www.booking.com/city/us/new-york.html", "conditions": [ "desktop" ], "result": "issues" }, { "id": "property-detail", "description": "Hotel detail and reservation entry template; represents property information, reviews, pricing entry, and reserve action.", "url": "https://www.booking.com/hotel/us/indigo-world-trade-center-nyc-an-ihg.html", "conditions": [ "desktop" ], "result": "issues" }, { "id": "flights", "description": "Flights search landing page; represents a second core product and locale-sensitive date/traveller form.", "url": "https://www.booking.com/flights/index.html", "conditions": [ "desktop" ], "result": "issues" }, { "id": "auth", "description": "Account sign-in entry; checked permission timing, autocomplete, and WebAuthn/passkey signals.", "url": "https://account.booking.com/sign-in", "conditions": [ "desktop" ], "result": "pass" }, { "id": "not-found", "description": "Deliberately invalid route; represents HTTP/navigation recovery.", "url": "https://www.booking.com/this-route-does-not-exist-web-uplift.html", "conditions": [ "desktop" ], "result": "pass" } ], "findings": [ { "id": "F01", "severity": "medium", "confidence": "high", "summary": "The site ignores the user’s dark-color preference.", "evidence": "The dark-mode screenshot and preference probe show prefers-color-scheme: dark matched while color-scheme remained normal and body stayed rgb(255,255,255).", "suggestedFix": "Declare color-scheme and provide preference-driven light/dark design tokens with accessible contrast.", "principleId": "respect-user-preferences", "principleCheckId": "respects-color-scheme", "guidanceId": "dark-mode", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/home-dark.png", "evidence/preferences-probe.json" ], "effort": "medium", "pathId": "home", "url": "https://www.booking.com/" }, { "id": "F02", "severity": "low", "confidence": "high", "summary": "Major state and route changes do not use View Transitions.", "evidence": "Live CSS inspection found no view-transition rules across the homepage application CSS.", "suggestedFix": "Use same-document and cross-document View Transitions for meaningful route and state continuity, with reduced-motion handling.", "principleId": "implement-natural-interactions", "principleCheckId": "view-transitions", "guidanceId": "same-document-transitions", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/platform-probe.json" ], "effort": "medium", "pathId": "home", "url": "https://www.booking.com/" }, { "id": "F03", "severity": "low", "confidence": "high", "summary": "Scroll-linked UI is not implemented with declarative scroll timelines.", "evidence": "Live CSS inspection found no animation-timeline or scroll-timeline usage.", "suggestedFix": "Use CSS scroll-driven animations for any scroll-linked effects rather than main-thread listeners.", "principleId": "implement-natural-interactions", "principleCheckId": "scroll-driven-animations", "guidanceId": "scroll-position-aware-elements", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/platform-probe.json" ], "effort": "small", "pathId": "home", "url": "https://www.booking.com/" }, { "id": "F04", "severity": "low", "confidence": "high", "summary": "Carousel-like content lacks platform-native snap/gesture styling.", "evidence": "Live CSS inspection found no scroll-snap rules on a homepage containing horizontally presented destination/property groups.", "suggestedFix": "Use overflow scrolling plus scroll-snap and overscroll behavior for touch-friendly carousels.", "principleId": "implement-natural-interactions", "principleCheckId": "physical-gestures", "guidanceId": "carousel-slide-effects", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/platform-probe.json", "evidence/home-mobile.png" ], "effort": "small", "pathId": "home", "url": "https://www.booking.com/" }, { "id": "F05", "severity": "low", "confidence": "high", "summary": "Page chrome does not expose declarative scroll-state feedback.", "evidence": "CSS inspection found no scroll-state container queries or scroll timeline, while long pages retain substantial navigation chrome.", "suggestedFix": "Use scroll-state queries or a declarative progress/shrinking-header treatment where it aids orientation.", "principleId": "provide-guided-navigation", "principleCheckId": "scroll-state-aware-chrome", "guidanceId": "shrinking-header-on-scroll", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/platform-probe.json", "evidence/home-desktop.png" ], "effort": "small", "pathId": "home", "url": "https://www.booking.com/" }, { "id": "F06", "severity": "low", "confidence": "high", "summary": "Menus and calendar overlays do not use CSS anchor positioning.", "evidence": "The homepage contains custom date and occupancy overlays, but CSS inspection found no anchor-name, position-anchor, or position-try rules.", "suggestedFix": "Anchor transient UI to its trigger and provide position-try fallbacks.", "principleId": "provide-guided-navigation", "principleCheckId": "anchored-positioning", "guidanceId": "position-aware-tooltips", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/platform-probe.json", "evidence/city-desktop.png" ], "effort": "medium", "pathId": "home", "url": "https://www.booking.com/" }, { "id": "F07", "severity": "medium", "confidence": "high", "summary": "Rich overlays are built without semantic dialog/popover/details primitives.", "evidence": "The DOM probe found 0 dialog, 0 popover, and 0 details elements despite date, occupancy, menu, and sign-in overlays.", "suggestedFix": "Use dialog for modal flows and popover for transient UI with declarative light-dismiss and correct focus behavior.", "principleId": "maximize-content-reduce-noise", "principleCheckId": "semantic-dismissible-primitives", "guidanceId": "declarative-dialog-popover-control", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/platform-probe.json", "evidence/form-error.png" ], "effort": "medium", "pathId": "home", "url": "https://www.booking.com/" }, { "id": "F08", "severity": "medium", "confidence": "high", "summary": "Commercial chrome competes with the core accommodation search.", "evidence": "The first viewport uses the only H1 for “Earn $150 in Travel Credits”; screenshots also show dense product navigation and promotional cards before destination content.", "suggestedFix": "Restore the primary travel search as the page’s semantic and visual lead, and demote promotional chrome.", "principleId": "maximize-content-reduce-noise", "principleCheckId": "reduced-chrome", "guidanceId": "reduce-style-repetition", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/home-desktop.png", "evidence/platform-probe.json" ], "effort": "medium", "pathId": "home", "url": "https://www.booking.com/" }, { "id": "F09", "severity": "low", "confidence": "high", "summary": "Components rely on viewport/global styling rather than container queries.", "evidence": "Inspection of accessible stylesheets found no @container rule, although reusable search, card, and navigation components appear at multiple widths.", "suggestedFix": "Adopt container-type and size-aware component queries for reusable modules.", "principleId": "adapt-to-the-form-factor", "principleCheckId": "component-level-responsiveness", "guidanceId": "size-aware-styling", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/platform-probe.json", "evidence/home-mobile.png" ], "effort": "medium", "pathId": "home", "url": "https://www.booking.com/" }, { "id": "F10", "severity": "high", "confidence": "high", "summary": "The homepage heading hierarchy prioritises a credit-card promotion over the core booking task.", "evidence": "The rendered H1 is “Earn $150 in Travel Credits”; the destination search has no equivalent page-level heading even though it is the primary task.", "suggestedFix": "Make accommodation/travel search the H1 and primary visual action; label financial promotion as secondary content.", "principleId": "support-core-task-success", "principleCheckId": "clear-purpose-and-primary-action", "guidanceId": "improve-text-layout-and-legibility", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/home-desktop.png", "evidence/platform-probe.json" ], "effort": "small", "pathId": "home", "url": "https://www.booking.com/" }, { "id": "F11", "severity": "high", "confidence": "high", "summary": "Laboratory loading performance is poor.", "evidence": "Lighthouse measured performance 0.43, LCP 26.8 s, FCP 6.0 s, TBT 450 ms, and TTI 42.1 s; a separate trace measured LCP 1.96 s but still recorded blocking work.", "suggestedFix": "Profile the LCP path, remove redirects, prioritise the actual LCP resource, and defer non-critical application and anti-abuse work.", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "guidanceId": "performance", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/lighthouse.json", "evidence/home-trace-summary.json" ], "effort": "large", "pathId": "home", "url": "https://www.booking.com/" }, { "id": "F12", "severity": "high", "confidence": "high", "summary": "Heavy JavaScript blocks the main thread.", "evidence": "Lighthouse reported 5.8 s main-thread work and 3.5 s JavaScript execution; the trace found 3 long tasks, the longest 211 ms, with 191 ms TBT.", "suggestedFix": "Reduce boot-time JavaScript, split long tasks, schedule lower-priority work, and defer nonessential modules.", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-main-thread", "guidanceId": "break-up-long-tasks", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/lighthouse.json", "evidence/home-trace-summary.json" ], "effort": "large", "pathId": "home", "url": "https://www.booking.com/" }, { "id": "F13", "severity": "high", "confidence": "high", "summary": "The critical network path is large and fragmented.", "evidence": "HAR captured 166 requests and 4.53 MB transferred, including 74 scripts (3.96 MB) and at least 10 parser-inserted VeryHigh-priority stylesheets; Lighthouse saw 8.7 MiB under its run.", "suggestedFix": "Consolidate critical CSS, remove the redirect/challenge duplication where possible, and set explicit resource priorities and durable caching.", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "guidanceId": "optimize-script-priority", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/home-network-summary.json", "evidence/home-network", "evidence/lighthouse.json" ], "effort": "large", "pathId": "home", "url": "https://www.booking.com/" }, { "id": "F14", "severity": "high", "confidence": "high", "summary": "The page ships substantial unused code.", "evidence": "Lighthouse estimated 2,183 KiB unused JavaScript and 69 KiB unused CSS; the HAR shows 74 script requests.", "suggestedFix": "Measure coverage by route, remove unused modules and duplicated dependencies, and conditionally load secondary products.", "principleId": "be-fast-and-stable", "principleCheckId": "trim-unused-and-duplicate-code", "guidanceId": "identify-heavy-scripts", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/lighthouse.json", "evidence/home-network-summary.json" ], "effort": "large", "pathId": "home", "url": "https://www.booking.com/" }, { "id": "F15", "severity": "medium", "confidence": "high", "summary": "Some visible control labels do not match their accessible names.", "evidence": "Lighthouse identified five label-content-name mismatches, including “Rent a car”, airport transfer, flight, attractions, and currency controls.", "suggestedFix": "Ensure each accessible name contains the visible label and preserve concise supplemental context in descriptions.", "principleId": "be-inclusive", "principleCheckId": "names-roles-labels", "guidanceId": "accessibility", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/lighthouse.json" ], "effort": "small", "pathId": "home", "url": "https://www.booking.com/" }, { "id": "F16", "severity": "medium", "confidence": "high", "summary": "Heading order is not consistently hierarchical.", "evidence": "Lighthouse flagged a heading-order failure; DOM inspection shows H1 credit-card promotion followed directly by H3 benefit cards before the first H2.", "suggestedFix": "Use a content-led H1 and sequential H2/H3 hierarchy for sections and cards.", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "guidanceId": "accessibility", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/lighthouse.json", "evidence/platform-probe.json" ], "effort": "small", "pathId": "home", "url": "https://www.booking.com/" }, { "id": "F17", "severity": "low", "confidence": "high", "summary": "The homepage logs a network error.", "evidence": "Lighthouse captured a 404 console/network error for https://www.booking.com/favicon.ico.", "suggestedFix": "Serve a valid favicon at the requested URL or remove the stale request.", "principleId": "follow-best-practices", "principleCheckId": "no-console-errors", "guidanceId": "html", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/lighthouse.json" ], "effort": "trivial", "pathId": "home", "url": "https://www.booking.com/" }, { "id": "F18", "severity": "medium", "confidence": "high", "summary": "Image elements broadly omit intrinsic dimensions.", "evidence": "The image primitive found all 84 images lacked width/height attributes; Lighthouse independently failed the unsized-images audit.", "suggestedFix": "Emit width and height or an equivalent reserved aspect-ratio for every image.", "principleId": "follow-best-practices", "principleCheckId": "sound-document-and-assets", "guidanceId": "html", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/images.json", "evidence/lighthouse.json" ], "effort": "medium", "pathId": "home", "url": "https://www.booking.com/" }, { "id": "F19", "severity": "low", "confidence": "high", "summary": "Large production scripts expose broken or missing source-map references.", "evidence": "Lighthouse failed valid-source-maps for the challenge script and numerous remoteEntry bundles.", "suggestedFix": "Publish valid production source maps to the declared URLs or stop emitting broken sourceMappingURL metadata.", "principleId": "follow-best-practices", "principleCheckId": "browser-platform-hygiene", "guidanceId": "html", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/lighthouse.json" ], "effort": "small", "pathId": "home", "url": "https://www.booking.com/" }, { "id": "F20", "severity": "high", "confidence": "high", "summary": "The main content is effectively absent for non-JavaScript crawlers.", "evidence": "Discoverability measured only 1% rendered-word coverage in raw HTML, isJsShell=true, and raw HTML lacked title, H1, and meta description; browser and crawler screenshots diverge sharply.", "suggestedFix": "Server-render core page content and metadata, then hydrate it progressively; retain crawlable href navigation.", "principleId": "be-discoverable", "principleCheckId": "crawlable-and-mobile-friendly", "guidanceId": "html", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/discoverability", "evidence/discoverability-rendered.png", "evidence/discoverability-crawler.png" ], "effort": "large", "pathId": "home", "url": "https://www.booking.com/" }, { "id": "F21", "severity": "low", "confidence": "high", "summary": "At least one link uses generic text.", "evidence": "Lighthouse found a crawlable “See more” link with no destination-specific wording.", "suggestedFix": "Use descriptive link text or a contextual accessible name that identifies the destination.", "principleId": "be-discoverable", "principleCheckId": "crawlable-and-mobile-friendly", "guidanceId": "html", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/lighthouse.json" ], "effort": "trivial", "pathId": "home", "url": "https://www.booking.com/" }, { "id": "F22", "severity": "high", "confidence": "high", "summary": "The main document omits several baseline security headers and sets one insecure cookie.", "evidence": "Headers evidence found no CSP, X-Content-Type-Options, clickjacking policy, Referrer-Policy, or Permissions-Policy; cookies evidence found g_state lacked Secure and used SameSite=None. HSTS is strong.", "suggestedFix": "Deploy a nonce/hash CSP with frame-ancestors, nosniff, a strict referrer policy and scoped permissions policy; mark all HTTPS cookies Secure with the narrowest SameSite.", "principleId": "be-private-and-secure", "principleCheckId": "secure-transport-and-headers", "guidanceId": "security", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ], "effort": "medium", "pathId": "home", "url": "https://www.booking.com/" }, { "id": "F23", "severity": "high", "confidence": "high", "summary": "The default third-party/network footprint is disproportionate.", "evidence": "HAR recorded 141 third-party requests and 3.80 MB third-party transfer across 13 origins, including consent, Google account, WAF, telemetry, and CDN services.", "suggestedFix": "Inventory each third party, load optional services after consent/intent, batch telemetry, and remove calls without direct user value.", "principleId": "be-private-and-secure", "principleCheckId": "data-minimisation-and-third-parties", "guidanceId": "privacy", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/home-network-summary.json", "evidence/trackers.json" ], "effort": "large", "pathId": "home", "url": "https://www.booking.com/" }, { "id": "F24", "severity": "medium", "confidence": "high", "summary": "Browser-enforced defensive policies are incomplete.", "evidence": "The response had HSTS but no CSP/frame-ancestors or X-Frame-Options, Referrer-Policy, Permissions-Policy, or nosniff.", "suggestedFix": "Add defense-in-depth headers, including CSP frame-ancestors, nosniff, referrer and permissions policy; evaluate Trusted Types for this script-heavy app.", "principleId": "be-private-and-secure", "principleCheckId": "defensive-browser-policies", "guidanceId": "security", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/headers.json" ], "effort": "medium", "pathId": "home", "url": "https://www.booking.com/" }, { "id": "F25", "severity": "medium", "confidence": "high", "summary": "Core public content depends on JavaScript.", "evidence": "Raw HTML returned status 202 but only 157 text characters and 1% of rendered content; non-JS view omitted title, H1, description, destination search, and travel content.", "suggestedFix": "Server-render core content/forms and preserve useful HTML submission before hydrating enhancements.", "principleId": "be-resilient", "principleCheckId": "progressive-enhancement", "guidanceId": "stabilize-reactive-state", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/discoverability", "evidence/discoverability-crawler.png" ], "effort": "large", "pathId": "home", "url": "https://www.booking.com/" }, { "id": "F26", "severity": "medium", "confidence": "high", "summary": "The app-like commerce experience has no manifest, service worker, or offline fallback.", "evidence": "Platform probe found no manifest link and no controlling service worker on a multi-product booking application.", "suggestedFix": "Provide a web app manifest and a service-worker-backed offline/retry shell for saved itinerary and interrupted searches.", "principleId": "be-resilient", "principleCheckId": "offline-and-installable", "guidanceId": "detect-initial-visibility-state", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/platform-probe.json" ], "effort": "large", "pathId": "home", "url": "https://www.booking.com/" }, { "id": "F27", "severity": "medium", "confidence": "high", "summary": "CSS is not prepared for bidirectional/writing-mode adaptation.", "evidence": "The document correctly sets lang=en-us and dir=ltr and exposes 46 hreflang links, but stylesheet inspection found no logical properties and 106 physical left/right declarations.", "suggestedFix": "Replace physical layout properties with logical inline/block properties and test an RTL locale.", "principleId": "be-internationalised", "principleCheckId": "lang-dir-and-logical-properties", "guidanceId": "translator", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/platform-probe.json" ], "effort": "medium", "pathId": "home", "url": "https://www.booking.com/" }, { "id": "F28", "severity": "high", "confidence": "high", "summary": "Most images lack responsive/modern delivery.", "evidence": "Images evidence found 63 legacy-format images, 62 without srcset, 6 oversized, and all 84 without intrinsic dimensions.", "suggestedFix": "Serve AVIF/WebP variants through picture/srcset, size candidates to display density, and reserve dimensions.", "principleId": "be-sustainable", "principleCheckId": "optimised-assets", "guidanceId": "deliver-optimized-decorative-images", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/images.json" ], "effort": "large", "pathId": "home", "url": "https://www.booking.com/" }, { "id": "F29", "severity": "high", "confidence": "high", "summary": "Third-party code dominates page weight.", "evidence": "HAR attributes 3.80 MB of 4.53 MB and 141 of 166 requests to third-party origins; scripts account for 3.96 MB.", "suggestedFix": "Set a third-party byte/request budget, defer nonessential vendors until intent, and trim duplicated challenge/consent code.", "principleId": "be-sustainable", "principleCheckId": "third-party-and-media-budget", "guidanceId": "deprioritize-background-fetches", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/home-network-summary.json", "evidence/home-network" ], "effort": "large", "pathId": "home", "url": "https://www.booking.com/" }, { "id": "F30", "severity": "medium", "confidence": "high", "summary": "The commerce site exposes no structured agent capabilities.", "evidence": "Platform probe found no WebMCP/modelContext registration despite search and reservation workflows that are valuable to agents; non-JS content is also only 1% complete.", "suggestedFix": "Expose narrowly scoped, confirmable search and reservation-assistance tools with clear schemas and user control.", "principleId": "be-agent-ready", "principleCheckId": "structured-agent-capabilities", "guidanceId": "webmcp", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/platform-probe.json", "evidence/discoverability" ], "effort": "large", "pathId": "home", "url": "https://www.booking.com/" }, { "id": "F31", "severity": "medium", "confidence": "high", "summary": "The initial page has a very large heap/object footprint for a search landing page.", "evidence": "Baseline heap summary contained 1,206,314 heap nodes, 5,492,295 edges, and 60.6 MB self size before user interaction.", "suggestedFix": "Reduce boot-time modules, release one-shot setup state, and lazy-load below-fold/product code; track heap and DOM budgets in CI.", "principleId": "be-memory-efficient", "principleCheckId": "bounded-footprint", "guidanceId": "performance", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/heap-baseline" ], "effort": "large", "pathId": "home", "url": "https://www.booking.com/" } ], "taskList": [ { "id": "T01", "title": "Profile the LCP path, remove redirects, prioritise the actual LCP resource, and defer non-critical application and anti-abuse work.", "priority": 1, "findingIds": [ "F11" ], "guidanceId": "performance", "status": "open" }, { "id": "T02", "title": "Server-render core page content and metadata, then hydrate it progressively; retain crawlable href navigation.", "priority": 2, "findingIds": [ "F20" ], "guidanceId": "html", "status": "open" }, { "id": "T03", "title": "Deploy a nonce/hash CSP with frame-ancestors, nosniff, a strict referrer policy and scoped permissions policy; mark all HTTPS cookies Secure with the narrowest SameSite.", "priority": 3, "findingIds": [ "F22" ], "guidanceId": "security", "status": "open" }, { "id": "T04", "title": "Make accommodation/travel search the H1 and primary visual action; label financial promotion as secondary content.", "priority": 4, "findingIds": [ "F10" ], "guidanceId": "improve-text-layout-and-legibility", "status": "open" }, { "id": "T05", "title": "Reduce boot-time JavaScript, split long tasks, schedule lower-priority work, and defer nonessential modules.", "priority": 5, "findingIds": [ "F12" ], "guidanceId": "break-up-long-tasks", "status": "open" }, { "id": "T06", "title": "Consolidate critical CSS, remove the redirect/challenge duplication where possible, and set explicit resource priorities and durable caching.", "priority": 6, "findingIds": [ "F13" ], "guidanceId": "optimize-script-priority", "status": "open" }, { "id": "T07", "title": "Measure coverage by route, remove unused modules and duplicated dependencies, and conditionally load secondary products.", "priority": 7, "findingIds": [ "F14" ], "guidanceId": "identify-heavy-scripts", "status": "open" }, { "id": "T08", "title": "Inventory each third party, load optional services after consent/intent, batch telemetry, and remove calls without direct user value.", "priority": 8, "findingIds": [ "F23" ], "guidanceId": "privacy", "status": "open" }, { "id": "T09", "title": "Serve AVIF/WebP variants through picture/srcset, size candidates to display density, and reserve dimensions.", "priority": 9, "findingIds": [ "F28" ], "guidanceId": "deliver-optimized-decorative-images", "status": "open" }, { "id": "T10", "title": "Set a third-party byte/request budget, defer nonessential vendors until intent, and trim duplicated challenge/consent code.", "priority": 10, "findingIds": [ "F29" ], "guidanceId": "deprioritize-background-fetches", "status": "open" }, { "id": "T11", "title": "Reduce boot-time modules, release one-shot setup state, and lazy-load below-fold/product code; track heap and DOM budgets in CI.", "priority": 11, "findingIds": [ "F31" ], "guidanceId": "performance", "status": "open" }, { "id": "T12", "title": "Declare color-scheme and provide preference-driven light/dark design tokens with accessible contrast.", "priority": 12, "findingIds": [ "F01" ], "guidanceId": "dark-mode", "status": "open" }, { "id": "T13", "title": "Use dialog for modal flows and popover for transient UI with declarative light-dismiss and correct focus behavior.", "priority": 13, "findingIds": [ "F07" ], "guidanceId": "declarative-dialog-popover-control", "status": "open" }, { "id": "T14", "title": "Restore the primary travel search as the page’s semantic and visual lead, and demote promotional chrome.", "priority": 14, "findingIds": [ "F08" ], "guidanceId": "reduce-style-repetition", "status": "open" }, { "id": "T15", "title": "Ensure each accessible name contains the visible label and preserve concise supplemental context in descriptions.", "priority": 15, "findingIds": [ "F15" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T16", "title": "Use a content-led H1 and sequential H2/H3 hierarchy for sections and cards.", "priority": 16, "findingIds": [ "F16" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T17", "title": "Emit width and height or an equivalent reserved aspect-ratio for every image.", "priority": 17, "findingIds": [ "F18" ], "guidanceId": "html", "status": "open" }, { "id": "T18", "title": "Add defense-in-depth headers, including CSP frame-ancestors, nosniff, referrer and permissions policy; evaluate Trusted Types for this script-heavy app.", "priority": 18, "findingIds": [ "F24" ], "guidanceId": "security", "status": "open" }, { "id": "T19", "title": "Server-render core content/forms and preserve useful HTML submission before hydrating enhancements.", "priority": 19, "findingIds": [ "F25" ], "guidanceId": "stabilize-reactive-state", "status": "open" }, { "id": "T20", "title": "Provide a web app manifest and a service-worker-backed offline/retry shell for saved itinerary and interrupted searches.", "priority": 20, "findingIds": [ "F26" ], "guidanceId": "detect-initial-visibility-state", "status": "open" }, { "id": "T21", "title": "Replace physical layout properties with logical inline/block properties and test an RTL locale.", "priority": 21, "findingIds": [ "F27" ], "guidanceId": "translator", "status": "open" }, { "id": "T22", "title": "Expose narrowly scoped, confirmable search and reservation-assistance tools with clear schemas and user control.", "priority": 22, "findingIds": [ "F30" ], "guidanceId": "webmcp", "status": "open" }, { "id": "T23", "title": "Use same-document and cross-document View Transitions for meaningful route and state continuity, with reduced-motion handling.", "priority": 23, "findingIds": [ "F02" ], "guidanceId": "same-document-transitions", "status": "open" }, { "id": "T24", "title": "Use CSS scroll-driven animations for any scroll-linked effects rather than main-thread listeners.", "priority": 24, "findingIds": [ "F03" ], "guidanceId": "scroll-position-aware-elements", "status": "open" }, { "id": "T25", "title": "Use overflow scrolling plus scroll-snap and overscroll behavior for touch-friendly carousels.", "priority": 25, "findingIds": [ "F04" ], "guidanceId": "carousel-slide-effects", "status": "open" }, { "id": "T26", "title": "Use scroll-state queries or a declarative progress/shrinking-header treatment where it aids orientation.", "priority": 26, "findingIds": [ "F05" ], "guidanceId": "shrinking-header-on-scroll", "status": "open" }, { "id": "T27", "title": "Anchor transient UI to its trigger and provide position-try fallbacks.", "priority": 27, "findingIds": [ "F06" ], "guidanceId": "position-aware-tooltips", "status": "open" }, { "id": "T28", "title": "Adopt container-type and size-aware component queries for reusable modules.", "priority": 28, "findingIds": [ "F09" ], "guidanceId": "size-aware-styling", "status": "open" }, { "id": "T29", "title": "Serve a valid favicon at the requested URL or remove the stale request.", "priority": 29, "findingIds": [ "F17" ], "guidanceId": "html", "status": "open" }, { "id": "T30", "title": "Publish valid production source maps to the declared URLs or stop emitting broken sourceMappingURL metadata.", "priority": 30, "findingIds": [ "F19" ], "guidanceId": "html", "status": "open" }, { "id": "T31", "title": "Use descriptive link text or a contextual accessible name that identifies the destination.", "priority": 31, "findingIds": [ "F21" ], "guidanceId": "html", "status": "open" } ], "artifacts": [ { "type": "screenshot", "path": "evidence/home-desktop.png", "caption": "home desktop.png" }, { "type": "screenshot", "path": "evidence/home-mobile.png", "caption": "home mobile.png" }, { "type": "screenshot", "path": "evidence/home-dark.png", "caption": "home dark.png" }, { "type": "other", "path": "evidence/preferences-probe.json", "caption": "preferences probe" }, { "type": "layout", "path": "evidence/home-mobile-layout.json", "caption": "home mobile layout" }, { "type": "other", "path": "evidence/platform-probe.json", "caption": "platform probe" }, { "type": "screenshot", "path": "evidence/form-error.png", "caption": "form error.png" }, { "type": "other", "path": "evidence/form-probe.json", "caption": "form probe" }, { "type": "screenshot", "path": "evidence/city-desktop.png", "caption": "city desktop.png" }, { "type": "screenshot", "path": "evidence/property-desktop.png", "caption": "property desktop.png" }, { "type": "screenshot", "path": "evidence/flights-desktop.png", "caption": "flights desktop.png" }, { "type": "other", "path": "evidence/auth-probe.json", "caption": "auth probe" }, { "type": "screenshot", "path": "evidence/not-found.png", "caption": "not found.png" }, { "type": "other", "path": "evidence/not-found-probe.json", "caption": "not found probe" }, { "type": "discoverability", "path": "evidence/discoverability", "caption": "discoverability" }, { "type": "screenshot", "path": "evidence/discoverability-rendered.png", "caption": "discoverability rendered.png" }, { "type": "screenshot", "path": "evidence/discoverability-crawler.png", "caption": "discoverability crawler.png" }, { "type": "trace", "path": "evidence/home-trace", "caption": "home trace" }, { "type": "trace-summary", "path": "evidence/home-trace-summary.json", "caption": "home trace summary" }, { "type": "har", "path": "evidence/home-network", "caption": "home network" }, { "type": "har-summary", "path": "evidence/home-network-summary.json", "caption": "home network summary" }, { "type": "lighthouse", "path": "evidence/lighthouse.json", "caption": "lighthouse" }, { "type": "other", "path": "evidence/axe.json", "caption": "axe" }, { "type": "other", "path": "evidence/headers.json", "caption": "headers" }, { "type": "other", "path": "evidence/cookies.json", "caption": "cookies" }, { "type": "other", "path": "evidence/trackers.json", "caption": "trackers" }, { "type": "other", "path": "evidence/images.json", "caption": "images" }, { "type": "other", "path": "evidence/secrets.json", "caption": "secrets" }, { "type": "heap", "path": "evidence/heap-baseline", "caption": "heap baseline" }, { "type": "heap", "path": "evidence/heap-post", "caption": "heap post" }, { "type": "other", "path": "evidence/interaction-probe.json", "caption": "interaction probe" }, { "type": "other", "path": "evidence/robots.txt", "caption": "robots.txt" } ], "budget": { "wallClockSeconds": 900, "pathCount": 6, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-17T20-29-24-216Z" }