{ "url": "https://web.facebook.com", "auditedAt": "2026-07-18T06:38:53.414Z", "mode": "report", "status": "completed", "statusDetail": "Complete atomic audit of public logged-out Facebook templates. Authenticated feed/content, successful credential completion, commerce and account settings were not covered because no test account was supplied.", "page": { "appType": "hybrid", "framework": "Meta/Facebook server-rendered shell with client-side modules", "notes": "web.facebook.com redirects to www.facebook.com. Audited login, signup, recovery and unavailable-content templates. Excluded authenticated feed/profile/group/video templates because they require credentials." }, "evidenceUsed": [ "screenshot", "dom", "evaluate-probe", "layout-metrics", "trace", "har", "discoverability", "headers", "cookies", "trackers", "secrets", "images", "heap-summary", "lighthouse", "curl robots/sitemap", "Modern Web Guidance 0.0.172 search/retrieve" ], "guidanceConsulted": [ "accessibility", "accessible-error-announcement", "autofill-sign-in-form", "autofill-sign-up-form", "break-up-long-tasks", "dark-mode", "deliver-optimized-decorative-images", "efficient-background-processing", "fluid-scaling", "forms", "improve-text-layout-and-legibility", "light-dismiss-a-dialog", "manage-recurring-intervals", "optimize-image-priority", "performance", "privacy", "same-document-transitions", "security" ], "artifacts": [ { "type": "screenshot", "path": "evidence/404-mobile.png", "caption": "404 mobile", "findingIds": [] }, { "type": "other", "path": "evidence/404-probe.json", "caption": "404 probe", "findingIds": [] }, { "type": "other", "path": "evidence/consent-control.json", "caption": "consent control", "findingIds": [] }, { "type": "other", "path": "evidence/cookies.json", "caption": "cookies", "findingIds": [] }, { "type": "screenshot", "path": "evidence/discoverability-crawler.png", "caption": "discoverability crawler", "findingIds": [ "F18", "F21" ] }, { "type": "screenshot", "path": "evidence/discoverability-rendered.png", "caption": "discoverability rendered", "findingIds": [ "F21" ] }, { "type": "discoverability", "path": "evidence/discoverability.json", "caption": "discoverability", "findingIds": [ "F18", "F21" ] }, { "type": "other", "path": "evidence/headers.json", "caption": "headers", "findingIds": [ "F20" ] }, { "type": "heap", "path": "evidence/heap-baseline.json", "caption": "heap baseline", "findingIds": [] }, { "type": "heap", "path": "evidence/heap-post.json", "caption": "heap post", "findingIds": [] }, { "type": "screenshot", "path": "evidence/home-contrast.png", "caption": "home contrast", "findingIds": [] }, { "type": "screenshot", "path": "evidence/home-dark.png", "caption": "home dark", "findingIds": [ "F01" ] }, { "type": "screenshot", "path": "evidence/home-desktop.png", "caption": "home desktop", "findingIds": [ "F01", "F03" ] }, { "type": "dom", "path": "evidence/home-dom.json", "caption": "home dom", "findingIds": [] }, { "type": "other", "path": "evidence/home-images.json", "caption": "home images", "findingIds": [ "F06", "F10", "F15" ] }, { "type": "layout", "path": "evidence/home-layout-desktop.json", "caption": "home layout desktop", "findingIds": [ "F09" ] }, { "type": "layout", "path": "evidence/home-layout-mobile.json", "caption": "home layout mobile", "findingIds": [ "F04", "F06", "F13" ] }, { "type": "screenshot", "path": "evidence/home-mobile.png", "caption": "home mobile", "findingIds": [ "F04", "F13" ] }, { "type": "other", "path": "evidence/home-summary.json", "caption": "home summary", "findingIds": [ "F07", "F08", "F23", "F24" ] }, { "type": "trace-summary", "path": "evidence/home-trace-summary.json", "caption": "home trace summary", "findingIds": [ "F05", "F09" ] }, { "type": "trace", "path": "evidence/home-trace.json", "caption": "home trace", "findingIds": [] }, { "type": "har", "path": "evidence/home.har", "caption": "home", "findingIds": [ "F07", "F08", "F23", "F24" ] }, { "type": "other", "path": "evidence/invalid-login-probe.json", "caption": "invalid login probe", "findingIds": [ "F02" ] }, { "type": "lighthouse", "path": "evidence/lighthouse-mobile.json", "caption": "lighthouse mobile", "findingIds": [] }, { "type": "lighthouse", "path": "evidence/lighthouse-summary.json", "caption": "lighthouse summary", "findingIds": [ "F05", "F10", "F11", "F14", "F16" ] }, { "type": "screenshot", "path": "evidence/login-dark.png", "caption": "login dark", "findingIds": [] }, { "type": "screenshot", "path": "evidence/login-desktop.png", "caption": "login desktop", "findingIds": [] }, { "type": "screenshot", "path": "evidence/login-mobile.png", "caption": "login mobile", "findingIds": [] }, { "type": "other", "path": "evidence/login-probe.json", "caption": "login probe", "findingIds": [ "F02", "F04", "F12", "F17", "F18", "F19", "F22" ] }, { "type": "other", "path": "evidence/motion-probe.json", "caption": "motion probe", "findingIds": [] }, { "type": "other", "path": "evidence/post-consent.json", "caption": "post consent", "findingIds": [] }, { "type": "other", "path": "evidence/recon.json", "caption": "recon", "findingIds": [] }, { "type": "screenshot", "path": "evidence/recovery-mobile.png", "caption": "recovery mobile", "findingIds": [ "F03" ] }, { "type": "screenshot", "path": "evidence/recovery-post-consent-mobile.png", "caption": "recovery post consent mobile", "findingIds": [] }, { "type": "other", "path": "evidence/recovery-probe.json", "caption": "recovery probe", "findingIds": [ "F12" ] }, { "type": "other", "path": "evidence/robots-headers.txt", "caption": "robots headers", "findingIds": [] }, { "type": "other", "path": "evidence/robots.txt", "caption": "robots", "findingIds": [] }, { "type": "other", "path": "evidence/runtime-metrics.json", "caption": "runtime metrics", "findingIds": [] }, { "type": "other", "path": "evidence/secrets.json", "caption": "secrets", "findingIds": [] }, { "type": "other", "path": "evidence/signup-invalid-probe.json", "caption": "signup invalid probe", "findingIds": [] }, { "type": "screenshot", "path": "evidence/signup-mobile.png", "caption": "signup mobile", "findingIds": [ "F03" ] }, { "type": "screenshot", "path": "evidence/signup-post-consent-mobile.png", "caption": "signup post consent mobile", "findingIds": [] }, { "type": "other", "path": "evidence/signup-probe.json", "caption": "signup probe", "findingIds": [ "F12", "F22" ] }, { "type": "other", "path": "evidence/sitemap-headers.txt", "caption": "sitemap headers", "findingIds": [ "F19" ] }, { "type": "other", "path": "evidence/sitemap.xml", "caption": "sitemap", "findingIds": [ "F19" ] }, { "type": "other", "path": "evidence/trackers.json", "caption": "trackers", "findingIds": [] } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 58, "blocked": 0, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": true }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "issues", "confidence": "high", "method": "Dark/light screenshot comparison plus computed style", "evidence": "Dark and light captures are identical; body remains white and color-scheme is normal.", "pathIds": [ "login" ], "artifacts": [ "evidence/home-dark.png", "evidence/home-desktop.png" ], "findingIds": [ "F01" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "pass", "confidence": "high", "method": "getAnimations under prefers-reduced-motion: reduce", "evidence": "The reduced-motion probe matched the preference and found no active animations on the initial surface.", "pathIds": [ "login" ], "artifacts": [ "evidence/motion-probe.json" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "issues", "confidence": "high", "method": "prefers-contrast capture plus Lighthouse contrast audit", "evidence": "The contrast capture does not adapt and Lighthouse measures the accept control at 4.23:1, below 4.5:1.", "pathIds": [ "login" ], "artifacts": [ "evidence/home-contrast.png", "evidence/lighthouse-summary.json" ], "findingIds": [ "F11" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "issues", "confidence": "medium", "method": "Route and invalid-state walkthrough plus stylesheet probe", "evidence": "Exercised public links and invalid login update without an observed transition despite stylesheet text mentioning view-transition.", "pathIds": [ "login", "recovery" ], "artifacts": [ "evidence/login-probe.json", "evidence/invalid-login-probe.json" ], "findingIds": [ "F02" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "not-applicable", "confidence": "high", "method": "Visual and animation recon", "evidence": "No parallax, scrollytelling, reveal, carousel or other scroll-linked motion exists on the audited pre-auth templates.", "reason": "No parallax, scrollytelling, reveal, carousel or other scroll-linked motion exists on the audited pre-auth templates." }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "not-applicable", "confidence": "high", "method": "Interaction recon across login, signup and recovery", "evidence": "The audited pre-auth forms expose no swipe, pull, drag, snapping carousel or other gesture-driven control.", "reason": "The audited pre-auth forms expose no swipe, pull, drag, snapping carousel or other gesture-driven control." }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "not-applicable", "confidence": "high", "method": "Screenshots and DOM recon", "evidence": "The short pre-auth forms have no sticky/affixed scroll chrome or progress surface that needs scroll-state adaptation.", "reason": "The short pre-auth forms have no sticky/affixed scroll chrome or progress surface that needs scroll-state adaptation." }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "not-applicable", "confidence": "medium", "method": "Overlay and control DOM inspection", "evidence": "No tooltip, anchored menu or edge-sensitive popover was present in the audited pre-auth states; cookie consent is modal dialog content.", "reason": "No tooltip, anchored menu or edge-sensitive popover was present in the audited pre-auth states; cookie consent is modal dialog content." }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "pass", "confidence": "high", "method": "First-viewport screenshots and task walkthrough", "evidence": "Login, recovery and signup expose one prominent primary action and recovery links with clear state copy.", "pathIds": [ "login", "signup", "recovery" ], "artifacts": [ "evidence/home-desktop.png", "evidence/signup-probe.json", "evidence/recovery-probe.json" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "issues", "confidence": "high", "method": "Initial desktop/mobile screenshots", "evidence": "A cookie dialog covers the core task on every audited route before interaction.", "pathIds": [ "login", "signup", "recovery" ], "artifacts": [ "evidence/home-desktop.png", "evidence/signup-mobile.png", "evidence/recovery-mobile.png" ], "findingIds": [ "F03" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "pass", "confidence": "high", "method": "DOM semantics and exercised decline action", "evidence": "Consent is exposed as a dialog and its role=button choice can be activated; declining removes the dialog.", "pathIds": [ "login" ], "artifacts": [ "evidence/consent-control.json", "evidence/post-consent.json" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "pass", "confidence": "high", "method": "Desktop screenshot and DOM review", "evidence": "After consent, the public surface is a focused form with minimal chrome and compact secondary footer navigation.", "pathIds": [ "login" ], "artifacts": [ "evidence/post-consent.json", "evidence/login-probe.json" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "issues", "confidence": "high", "method": "360x800 layout metrics and screenshot", "evidence": "Requested 360px viewport becomes a 980px CSS layout scaled to 0.367 because viewport meta is absent.", "pathIds": [ "login" ], "artifacts": [ "evidence/home-layout-mobile.json", "evidence/home-mobile.png" ], "findingIds": [ "F04" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "pass", "confidence": "medium", "method": "Rendered stylesheet and multi-template probe", "evidence": "The login probe detects @container rules, while signup and recovery serve dedicated mobile-width layouts.", "pathIds": [ "login", "signup", "recovery" ], "artifacts": [ "evidence/login-probe.json", "evidence/signup-probe.json", "evidence/recovery-probe.json" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "pass", "confidence": "medium", "method": "Control geometry and Lighthouse target-size audit", "evidence": "Primary form controls are 38-44px high, major actions are 44px high, and Lighthouse target-size passes.", "pathIds": [ "login" ], "artifacts": [ "evidence/login-probe.json", "evidence/lighthouse-summary.json" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "pass", "confidence": "high", "method": "First viewport and text hierarchy walkthrough", "evidence": "The pages say Log in to Facebook, Get started on Facebook, and Find Your Account, each with one prominent next action.", "pathIds": [ "login", "signup", "recovery" ], "artifacts": [ "evidence/recon.json", "evidence/signup-probe.json", "evidence/recovery-probe.json" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "pass", "confidence": "medium", "method": "Login invalid-state and recovery route walkthrough", "evidence": "The public authentication flow accepts input, reports invalid identity, links to account recovery, and recovery loads a continuation form; authenticated completion was outside the logged-out scope.", "pathIds": [ "login", "recovery" ], "artifacts": [ "evidence/invalid-login-probe.json", "evidence/recovery-probe.json" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "pass", "confidence": "high", "method": "Invalid login, empty signup and nonexistent-route tests", "evidence": "Errors are visible and actionable, aria-invalid/role=alert is used, and unavailable content offers Feed, Back and Help recovery.", "pathIds": [ "login", "signup", "error404" ], "artifacts": [ "evidence/invalid-login-probe.json", "evidence/signup-invalid-probe.json", "evidence/404-probe.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "high", "method": "Lighthouse plus DevTools trace", "evidence": "Lighthouse LCP is 6.9s and FCP 5.3s; trace LCP is 2.42s, indicating variable but often poor load performance.", "pathIds": [ "login" ], "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-trace-summary.json" ], "findingIds": [ "F05" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "issues", "confidence": "high", "method": "Layout observer plus image audit", "evidence": "Mobile CLS is 0.0851 and four illustrations omit complete intrinsic dimensions.", "pathIds": [ "login" ], "artifacts": [ "evidence/home-layout-mobile.json", "evidence/home-images.json" ], "findingIds": [ "F06" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "issues", "confidence": "high", "method": "Trace and long-task observer", "evidence": "Trace found two >130ms tasks and 176.35ms TBT; layout independently saw two >100ms tasks.", "pathIds": [ "login" ], "artifacts": [ "evidence/home-trace-summary.json", "evidence/home-layout-desktop.json" ], "findingIds": [ "F09" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "HAR summary and trace", "evidence": "Initial delivery is 9.44MB and includes a 7.4MB secondary QR image plus a VeryHigh parser stylesheet.", "pathIds": [ "login" ], "artifacts": [ "evidence/home-summary.json", "evidence/home.har" ], "findingIds": [ "F07" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "medium", "method": "HAR payload review", "evidence": "A basic pre-auth form loads 24 scripts totaling 1.32MB before secondary interactions.", "pathIds": [ "login" ], "artifacts": [ "evidence/home-summary.json" ], "findingIds": [ "F08" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "issues", "confidence": "high", "method": "Lighthouse accessibility and images probes", "evidence": "Lighthouse finds an unlabeled consent checkbox; all four cookie illustrations lack alt text.", "pathIds": [ "login" ], "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-images.json" ], "findingIds": [ "F10" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "issues", "confidence": "high", "method": "Lighthouse colour-contrast audit", "evidence": "The Allow all cookies label is 4.23:1 against blue, below WCAG AA 4.5:1.", "pathIds": [ "login" ], "artifacts": [ "evidence/lighthouse-summary.json" ], "findingIds": [ "F11" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "issues", "confidence": "high", "method": "Heading/landmark and alert probes", "evidence": "No semantic headings exist on login, signup or recovery, although main and alert semantics are present.", "pathIds": [ "login", "signup", "recovery" ], "artifacts": [ "evidence/login-probe.json", "evidence/signup-probe.json", "evidence/recovery-probe.json" ], "findingIds": [ "F12" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "pass", "confidence": "medium", "method": "Desktop and mobile visual review", "evidence": "Form labels, instructions and errors are readable with comfortable line lengths after the intended mobile variants load.", "pathIds": [ "login", "signup", "recovery" ], "artifacts": [ "evidence/home-desktop.png", "evidence/signup-mobile.png", "evidence/recovery-mobile.png" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "issues", "confidence": "high", "method": "Mobile reflow metrics, target audit and media probe", "evidence": "Main route is scaled from 980px at 360px because viewport meta is absent; no video/audio needs captions and target-size audit passes.", "pathIds": [ "login" ], "artifacts": [ "evidence/home-layout-mobile.json", "evidence/lighthouse-summary.json" ], "findingIds": [ "F13" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "issues", "confidence": "high", "method": "Lighthouse console audit", "evidence": "An uncaught getElementsByTagName TypeError occurs in scrollToHeader.", "pathIds": [ "login" ], "artifacts": [ "evidence/lighthouse-summary.json" ], "findingIds": [ "F14" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "issues", "confidence": "high", "method": "DOM, Lighthouse and image audit", "evidence": "Doctype and UTF-8 pass, but four images lack complete dimensions and modern responsive sources.", "pathIds": [ "login" ], "artifacts": [ "evidence/login-probe.json", "evidence/home-images.json" ], "findingIds": [ "F15" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "issues", "confidence": "high", "method": "Lighthouse deprecation audit", "evidence": "An unload event listener deprecation is reported; no permission prompt appeared on load.", "pathIds": [ "login" ], "artifacts": [ "evidence/lighthouse-summary.json" ], "findingIds": [ "F16" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "issues", "confidence": "high", "method": "Direct DOM metadata probe", "evidence": "Final desktop document title is only Facebook and meta description is absent.", "pathIds": [ "login" ], "artifacts": [ "evidence/login-probe.json" ], "findingIds": [ "F17" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "issues", "confidence": "high", "method": "DOM link/viewport probe plus no-JS comparison", "evidence": "Links use href, but viewport meta is absent and raw HTML has only 1% of rendered words.", "pathIds": [ "login" ], "artifacts": [ "evidence/login-probe.json", "evidence/discoverability.json" ], "findingIds": [ "F18" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "issues", "confidence": "high", "method": "Canonical, robots and sitemap requests", "evidence": "Canonical targets en-gb while final host is www; robots is valid, but /sitemap.xml responds with HTML rather than XML.", "pathIds": [ "login" ], "artifacts": [ "evidence/login-probe.json", "evidence/robots.txt", "evidence/sitemap.xml" ], "findingIds": [ "F19" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "not-applicable", "confidence": "high", "method": "Entity and metadata inspection", "evidence": "The generic login/account-gateway page is not an article, product, event, place or other rich entity requiring schema.org/share metadata.", "reason": "The generic login/account-gateway page is not an article, product, event, place or other rich entity requiring schema.org/share metadata." }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "pass", "confidence": "high", "method": "Headers, cookies and secrets primitives", "evidence": "HTTPS, HSTS, CSP, nosniff and DENY framing are present; no cookies or client-side secrets were found before consent.", "pathIds": [ "login" ], "artifacts": [ "evidence/headers.json", "evidence/cookies.json", "evidence/secrets.json" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "pass", "confidence": "medium", "method": "HAR, trackers and cookies review", "evidence": "No known trackers or pre-consent cookies were observed; network origins are Facebook/Meta-controlled, with one Instagram identity request.", "pathIds": [ "login" ], "artifacts": [ "evidence/trackers.json", "evidence/cookies.json", "evidence/home-summary.json" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "pass", "confidence": "medium", "method": "Load behaviour and authentication attribute probe", "evidence": "No permission prompt appeared on load; username uses autocomplete=\"username webauthn\", showing passkey-capable conditional auth support.", "pathIds": [ "login" ], "artifacts": [ "evidence/login-probe.json" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "high", "method": "Security-header primitive", "evidence": "Strong HSTS, clickjacking and Permissions-Policy controls are present, but Referrer-Policy is absent and style-src allows unsafe-inline.", "pathIds": [ "login" ], "artifacts": [ "evidence/headers.json" ], "findingIds": [ "F20" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "issues", "confidence": "high", "method": "Raw HTML/rendered DOM diff and crawler screenshots", "evidence": "Raw HTML retains only 1% of rendered words and crawler view is effectively blank.", "pathIds": [ "login" ], "artifacts": [ "evidence/discoverability.json", "evidence/discoverability-crawler.png" ], "findingIds": [ "F21" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "pass", "confidence": "medium", "method": "Consent dismissal, invalid state and route navigation walkthrough", "evidence": "Dialog dismissal, validation state, recovery navigation and unavailable-content controls remained stable without cut-off on exercised routes.", "pathIds": [ "login", "recovery", "error404" ], "artifacts": [ "evidence/post-consent.json", "evidence/invalid-login-probe.json", "evidence/404-probe.json" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "not-applicable", "confidence": "high", "method": "Manifest/service-worker probe and site-purpose judgement", "evidence": "The audited gateway is for an intrinsically networked authenticated social service; no manifest or controlling service worker exists, and offline sign-in is not a meaningful task.", "reason": "The audited gateway is for an intrinsically networked authenticated social service; no manifest or controlling service worker exists, and offline sign-in is not a meaningful task." }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "pass", "confidence": "high", "method": "Intentional nonexistent-route test", "evidence": "Unavailable content explains the state and offers Go to Feed, Go back and Visit Help Centre.", "pathIds": [ "error404" ], "artifacts": [ "evidence/404-probe.json", "evidence/404-mobile.png" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "pass", "confidence": "high", "method": "DOM language/direction and locale-link probe", "evidence": "Document declares lang=en and dir=ltr, rendered CSS contains logical properties, and multiple explicit language choices are offered.", "pathIds": [ "login" ], "artifacts": [ "evidence/login-probe.json", "evidence/recon.json" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "not-applicable", "confidence": "high", "method": "Content inventory across representative paths", "evidence": "The audited pre-auth templates render no dates, numbers, currencies, durations or calendars requiring locale formatting.", "reason": "The audited pre-auth templates render no dates, numbers, currencies, durations or calendars requiring locale formatting." }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "not-applicable", "confidence": "high", "method": "Content inventory across representative paths", "evidence": "The audited pre-auth templates contain no event times, time-zone data or DST-sensitive scheduling.", "reason": "The audited pre-auth templates contain no event times, time-zone data or DST-sensitive scheduling." }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "pass", "confidence": "medium", "method": "Consent and signup visual/copy review", "evidence": "Decline optional cookies is explicit without confirmshaming, signup commitments link to Terms/Privacy/Cookies, and account recovery is easy to find.", "pathIds": [ "login", "signup" ], "artifacts": [ "evidence/home-desktop.png", "evidence/signup-probe.json" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "pass", "confidence": "high", "method": "Invalid login and empty signup submission", "evidence": "Errors appear after submission, use aria-invalid and role=alert, and give concrete corrective text.", "pathIds": [ "login", "signup" ], "artifacts": [ "evidence/invalid-login-probe.json", "evidence/signup-invalid-probe.json" ] }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "issues", "confidence": "high", "method": "Autocomplete attribute inspection", "evidence": "Signup sets autocomplete=off on all core fields and login password has no current-password token.", "pathIds": [ "login", "signup" ], "artifacts": [ "evidence/login-probe.json", "evidence/signup-probe.json" ], "findingIds": [ "F22" ] }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "pass", "confidence": "medium", "method": "Public account-flow review", "evidence": "Signup states account creation terms and data use before Submit, login offers recovery, and username webauthn indicates phishing-resistant auth support; no commercial flow appears pre-auth.", "pathIds": [ "login", "signup" ], "artifacts": [ "evidence/signup-probe.json", "evidence/login-probe.json" ] }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "issues", "confidence": "high", "method": "HAR and image audit", "evidence": "A secondary QR JPG transfers 7.4MB; four PNG illustrations lack responsive sources and modern formats.", "pathIds": [ "login" ], "artifacts": [ "evidence/home-summary.json", "evidence/home-images.json" ], "findingIds": [ "F23" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "pass", "confidence": "medium", "method": "HAR, tracker and media review", "evidence": "Only three xhr/fetch requests were seen, no autoplay media exists, and no known tracker was detected pre-consent.", "pathIds": [ "login" ], "artifacts": [ "evidence/home-summary.json", "evidence/trackers.json", "evidence/login-probe.json" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "issues", "confidence": "high", "method": "HAR budget review", "evidence": "The login surface transfers 9.44MB, dominated by 7.4MB QR media plus 1.32MB scripts and 183KB font.", "pathIds": [ "login" ], "artifacts": [ "evidence/home-summary.json" ], "findingIds": [ "F24" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "not-applicable", "confidence": "high", "method": "Robots and surface-purpose judgement", "evidence": "Facebook explicitly disallows major AI agent crawlers including ClaudeBot, GPTBot and PerplexityBot, indicating this public gateway is intentionally not agent-facing.", "reason": "Facebook explicitly disallows major AI agent crawlers including ClaudeBot, GPTBot and PerplexityBot, indicating this public gateway is intentionally not agent-facing." }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "high", "method": "Feature and task inventory", "evidence": "The login/signup/recovery tasks have no appropriate summarisation or language-model need; absence of on-device inference is not a quality gap here.", "reason": "The login/signup/recovery tasks have no appropriate summarisation or language-model need; absence of on-device inference is not a quality gap here." }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "not-applicable", "confidence": "medium", "method": "Interaction inventory and attempted heap exercise", "evidence": "No safe representative repeatable interaction exists on the pre-auth page without account state; separate-session heap captures cannot establish retained-growth causality.", "reason": "No safe representative repeatable interaction exists on the pre-auth page without account state; separate-session heap captures cannot establish retained-growth causality." }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "pass", "confidence": "medium", "method": "Heap summary and Performance.memory probe", "evidence": "Baseline snapshot totals 43.6MB self size and runtime reports 20.7MB JS used for 685 live DOM nodes, proportionate though not minimal.", "pathIds": [ "login" ], "artifacts": [ "evidence/heap-baseline.json", "evidence/runtime-metrics.json" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "pass", "confidence": "low", "method": "Heap constructor summaries comparison", "evidence": "Neither heap summary surfaces Detached* constructors among the dominant populations; no evidence of unbounded detached DOM/listeners was found in this bounded pre-auth state.", "pathIds": [ "login" ], "artifacts": [ "evidence/heap-baseline.json", "evidence/heap-post.json" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F01", "F11" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "issues", "findingIds": [ "F02" ] }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "pass" }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "issues", "findingIds": [ "F03" ] }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "issues", "findingIds": [ "F04" ] }, { "principleId": "support-core-task-success", "expectation": "default", "status": "pass" }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F05", "F06", "F09", "F07", "F08" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F10", "F11", "F12", "F13" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "issues", "findingIds": [ "F14", "F15", "F16" ] }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F17", "F18", "F19" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F20" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "issues", "findingIds": [ "F21" ] }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "pass" }, { "principleId": "be-trustworthy", "expectation": "default", "status": "issues", "findingIds": [ "F22" ] }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F23", "F24" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "not-applicable", "reason": "Facebook explicitly blocks major AI crawlers and the audited authentication gateway has no intended agent-facing capability." }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "pass" } ], "paths": [ { "id": "login", "description": "Logged-out landing and login archetype; inspected initial consent, post-consent DOM, invalid credentials, desktop/mobile and preference conditions.", "url": "https://web.facebook.com", "conditions": [ "desktop", "viewport 360x800", "prefers-color-scheme: dark", "prefers-reduced-motion: reduce", "prefers-contrast: more", "invalid credentials", "JavaScript disabled crawler" ], "result": "issues" }, { "id": "signup", "description": "Account creation form archetype; inspected field semantics, autocomplete and empty-submit validation.", "url": "https://www.facebook.com/reg/", "conditions": [ "viewport 360x800", "empty submit" ], "result": "issues" }, { "id": "recovery", "description": "Account-recovery archetype; inspected recovery copy, form and route continuity.", "url": "https://www.facebook.com/recover/initiate/", "conditions": [ "viewport 360x800" ], "result": "pass" }, { "id": "error404", "description": "Unavailable-content/error archetype; verified recovery actions on an intentionally nonexistent URL.", "url": "https://www.facebook.com/this-path-should-not-exist-web-uplift-20260718", "conditions": [ "viewport 360x800" ], "result": "pass" } ], "findings": [ { "id": "F01", "severity": "medium", "principleId": "respect-user-preferences", "principleCheckId": "respects-color-scheme", "guidanceId": "dark-mode", "guidanceCategory": "user-experience", "summary": "Logged-out Facebook ignores the user’s dark colour-scheme preference.", "evidence": "The light and dark captures are byte-identical (75,968 bytes), and the DOM reports color-scheme: normal with a white body under dark emulation.", "artifacts": [ "evidence/home-dark.png", "evidence/home-desktop.png" ], "suggestedFix": "Declare color-scheme: light dark and retint surfaces and controls with prefers-color-scheme or light-dark().", "effort": "medium", "confidence": "high", "pathId": "login", "url": "https://web.facebook.com" }, { "id": "F02", "severity": "low", "principleId": "implement-natural-interactions", "principleCheckId": "view-transitions", "guidanceId": "same-document-transitions", "guidanceCategory": "user-experience", "summary": "Public route and state changes are abrupt.", "evidence": "The route/state probe found stylesheet View Transition text, but exercised navigation uses ordinary full-page links and the invalid-login state swaps without an observed transition.", "artifacts": [ "evidence/login-probe.json", "evidence/invalid-login-probe.json" ], "suggestedFix": "Apply same-document View Transitions to validation/state changes and cross-document transitions to compatible public routes, while respecting reduced motion.", "effort": "medium", "confidence": "high", "pathId": "login", "url": "https://web.facebook.com" }, { "id": "F03", "severity": "medium", "principleId": "maximize-content-reduce-noise", "principleCheckId": "no-intrusive-interruptions", "guidanceId": "light-dismiss-a-dialog", "guidanceCategory": "user-experience", "summary": "Cookie consent obscures the entire primary task on first load.", "evidence": "Desktop and 360px screenshots show a modal overlay hiding login, signup, recovery and error content until a cookie choice is made.", "artifacts": [ "evidence/home-desktop.png", "evidence/signup-mobile.png", "evidence/recovery-mobile.png" ], "suggestedFix": "Keep legally required consent concise and content-first, preserve equally prominent choices, and avoid the long educational card stack in the blocking first-load layer.", "effort": "medium", "confidence": "high", "pathId": "login", "url": "https://web.facebook.com" }, { "id": "F04", "severity": "high", "principleId": "adapt-to-the-form-factor", "principleCheckId": "responsive-no-horizontal-scroll", "guidanceId": "fluid-scaling", "guidanceCategory": "user-experience", "summary": "The main logged-out route omits the viewport meta tag and renders as a scaled 980px desktop canvas on mobile.", "evidence": "At a requested 360x800 viewport, layout reports innerWidth 980, scale 0.3673 and hasViewportMeta false; the screenshot shows tiny page content.", "artifacts": [ "evidence/home-layout-mobile.json", "evidence/home-mobile.png", "evidence/login-probe.json" ], "suggestedFix": "Add to this variant and use intrinsic, fluid sizing without disabling zoom.", "effort": "small", "confidence": "high", "pathId": "login", "url": "https://web.facebook.com" }, { "id": "F05", "severity": "high", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "guidanceId": "performance", "guidanceCategory": "performance", "summary": "Mobile loading is slow.", "evidence": "Lighthouse reports LCP 6.9s, FCP 5.3s and Speed Index 7.8s (performance 0.60); the independent trace reports LCP 2.42s, showing material run variance but still late paint.", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-trace-summary.json" ], "suggestedFix": "Prioritise the LCP element, remove the oversized QR asset from initial delivery, and defer noncritical scripts and styles.", "effort": "large", "confidence": "high", "pathId": "login", "url": "https://web.facebook.com" }, { "id": "F06", "severity": "medium", "principleId": "be-fast-and-stable", "principleCheckId": "visual-stability", "guidanceId": "optimize-image-priority", "guidanceCategory": "performance", "summary": "Cookie illustrations do not reserve complete dimensions and shift the mobile layout.", "evidence": "Images reports all four cookie PNGs missing a height attribute; mobile layout observed CLS 0.0851 with a shift at about 2.4s.", "artifacts": [ "evidence/home-images.json", "evidence/home-layout-mobile.json" ], "suggestedFix": "Set width and height or aspect-ratio on every illustration and preserve its slot before loading.", "effort": "small", "confidence": "high", "pathId": "login", "url": "https://web.facebook.com" }, { "id": "F07", "severity": "high", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "guidanceId": "optimize-image-priority", "guidanceCategory": "performance", "summary": "A hidden/secondary QR illustration dominates initial transfer.", "evidence": "HAR reports 9,444,146 transferred bytes; QrCodeLoginPizza.jpg alone transfers 7,395,126 bytes and takes 1.68s.", "artifacts": [ "evidence/home-summary.json", "evidence/home.har" ], "suggestedFix": "Do not fetch the QR artwork until the QR-login affordance is opened; resize and encode it in an efficient modern format.", "effort": "medium", "confidence": "high", "pathId": "login", "url": "https://web.facebook.com" }, { "id": "F08", "severity": "medium", "principleId": "be-fast-and-stable", "principleCheckId": "trim-unused-and-duplicate-code", "guidanceId": "break-up-long-tasks", "guidanceCategory": "performance", "summary": "The simple logged-out form ships a disproportionate script payload.", "evidence": "HAR records 24 scripts and 1.32MB of script transfer for the login/consent surface, with 32 redirect-host requests treated as third-party by the capture.", "artifacts": [ "evidence/home-summary.json", "evidence/home.har" ], "suggestedFix": "Code-split the logged-out route, conditionally load QR/consent detail modules, and audit coverage for unused bundles.", "effort": "large", "confidence": "high", "pathId": "login", "url": "https://web.facebook.com" }, { "id": "F09", "severity": "medium", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-main-thread", "guidanceId": "break-up-long-tasks", "guidanceCategory": "performance", "summary": "Startup includes avoidable long main-thread tasks.", "evidence": "The trace records two long tasks (142.77ms and 133.58ms) and 176.35ms total blocking time; layout independently observed 101ms and 135ms tasks.", "artifacts": [ "evidence/home-trace-summary.json", "evidence/home-layout-desktop.json" ], "suggestedFix": "Break startup work into schedulable tasks and defer noncritical hydration and consent-detail code.", "effort": "medium", "confidence": "high", "pathId": "login", "url": "https://web.facebook.com" }, { "id": "F10", "severity": "high", "principleId": "be-inclusive", "principleCheckId": "names-roles-labels", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "summary": "The consent and image content contains missing accessible names.", "evidence": "Lighthouse reports an unlabeled cookie preference checkbox; images reports all four cookie illustrations without alt text.", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-images.json" ], "suggestedFix": "Give every functional form control an explicit accessible name and provide meaningful alt text or empty alt for genuinely decorative images.", "effort": "small", "confidence": "high", "pathId": "login", "url": "https://web.facebook.com" }, { "id": "F11", "severity": "medium", "principleId": "be-inclusive", "principleCheckId": "sufficient-contrast", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "summary": "The primary cookie acceptance label misses WCAG AA contrast.", "evidence": "Lighthouse measures white text on #1877f2 at 4.23:1 where 4.5:1 is required.", "artifacts": [ "evidence/lighthouse-summary.json" ], "suggestedFix": "Darken the blue surface or adjust text styling until the control reaches at least 4.5:1 in every preference state.", "effort": "trivial", "confidence": "high", "pathId": "login", "url": "https://web.facebook.com" }, { "id": "F12", "severity": "medium", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "summary": "Public authentication pages have no semantic headings.", "evidence": "DOM probes found zero h1-h6 elements on login, signup and recovery despite visible page-title text; the login page relies on a div with role=main.", "artifacts": [ "evidence/login-probe.json", "evidence/signup-probe.json", "evidence/recovery-probe.json" ], "suggestedFix": "Use a real h1 for each page purpose, preserve the main landmark, and verify keyboard focus order and focus-visible treatment.", "effort": "small", "confidence": "high", "pathId": "login", "url": "https://web.facebook.com" }, { "id": "F13", "severity": "high", "principleId": "be-inclusive", "principleCheckId": "zoom-reflow-targets-and-media", "guidanceId": "fluid-scaling", "guidanceCategory": "accessibility", "summary": "The main login variant fails mobile reflow because it lacks a viewport declaration.", "evidence": "The 360px capture is rendered at 980 CSS pixels and scaled to 36.7%; the page probe confirms no viewport meta.", "artifacts": [ "evidence/home-layout-mobile.json", "evidence/home-mobile.png" ], "suggestedFix": "Use an accessible viewport declaration and reflow the form at narrow widths without maximum-scale restrictions.", "effort": "small", "confidence": "high", "pathId": "login", "url": "https://web.facebook.com" }, { "id": "F14", "severity": "medium", "principleId": "follow-best-practices", "principleCheckId": "no-console-errors", "guidanceId": "performance", "guidanceCategory": "best-practices", "summary": "Facebook logs an uncaught exception during audit load.", "evidence": "Lighthouse captured TypeError: Cannot read properties of undefined (reading getElementsByTagName) in scrollToHeader.", "artifacts": [ "evidence/lighthouse-summary.json" ], "suggestedFix": "Guard the missing node path and add regression coverage for the logged-out mobile route.", "effort": "small", "confidence": "high", "pathId": "login", "url": "https://web.facebook.com" }, { "id": "F15", "severity": "medium", "principleId": "follow-best-practices", "principleCheckId": "sound-document-and-assets", "guidanceId": "optimize-image-priority", "guidanceCategory": "best-practices", "summary": "Image markup is incomplete and contributes to layout shift.", "evidence": "The image audit found four of four PNG illustrations without complete width/height dimensions and all use legacy PNG without srcset.", "artifacts": [ "evidence/home-images.json" ], "suggestedFix": "Provide intrinsic dimensions, responsive sources, and efficient formats for cookie illustrations.", "effort": "small", "confidence": "high", "pathId": "login", "url": "https://web.facebook.com" }, { "id": "F16", "severity": "medium", "principleId": "follow-best-practices", "principleCheckId": "browser-platform-hygiene", "guidanceId": "performance", "guidanceCategory": "best-practices", "summary": "The page registers deprecated unload listeners.", "evidence": "Lighthouse reports one deprecation warning for unload event listeners in D4XXlyqmJxr.js, which can also harm BFCache eligibility.", "artifacts": [ "evidence/lighthouse-summary.json" ], "suggestedFix": "Replace unload with pagehide or visibilitychange and verify BFCache restoration.", "effort": "small", "confidence": "high", "pathId": "login", "url": "https://web.facebook.com" }, { "id": "F17", "severity": "medium", "principleId": "be-discoverable", "principleCheckId": "title-and-description", "guidanceId": "improve-text-layout-and-legibility", "guidanceCategory": "seo", "summary": "The desktop logged-out document has generic metadata.", "evidence": "The direct DOM probe reports title “Facebook” and no meta description; this does not describe the login surface.", "artifacts": [ "evidence/login-probe.json" ], "suggestedFix": "Use a route-specific descriptive title and concise meta description for public logged-out pages.", "effort": "trivial", "confidence": "high", "pathId": "login", "url": "https://web.facebook.com" }, { "id": "F18", "severity": "high", "principleId": "be-discoverable", "principleCheckId": "crawlable-and-mobile-friendly", "guidanceId": "fluid-scaling", "guidanceCategory": "seo", "summary": "Crawler/mobile signals differ across variants, and the desktop route lacks viewport metadata.", "evidence": "The direct logged-out DOM has real href links but no viewport meta; discoverability reports only 1% raw/rendered word coverage.", "artifacts": [ "evidence/login-probe.json", "evidence/discoverability.json", "evidence/discoverability-crawler.png" ], "suggestedFix": "Serve the core login purpose and links in HTML consistently and include the viewport meta on every variant.", "effort": "medium", "confidence": "high", "pathId": "login", "url": "https://web.facebook.com" }, { "id": "F19", "severity": "medium", "principleId": "be-discoverable", "principleCheckId": "canonical-and-indexing-signals", "guidanceId": "improve-text-layout-and-legibility", "guidanceCategory": "seo", "summary": "Indexing signals are inconsistent.", "evidence": "The document canonical points to en-gb.facebook.com while the audited final URL is www.facebook.com; /sitemap.xml returns a 295KB HTML page rather than sitemap XML.", "artifacts": [ "evidence/login-probe.json", "evidence/sitemap-headers.txt", "evidence/sitemap.xml" ], "suggestedFix": "Return a valid sitemap or a clear 404, and align canonical/hreflang signals with the locale variant served.", "effort": "medium", "confidence": "high", "pathId": "login", "url": "https://web.facebook.com" }, { "id": "F20", "severity": "low", "principleId": "be-private-and-secure", "principleCheckId": "defensive-browser-policies", "guidanceId": "security", "guidanceCategory": "security", "summary": "The otherwise strong header set omits Referrer-Policy and permits inline styles.", "evidence": "Headers confirms HSTS, CSP, nosniff, DENY framing and Permissions-Policy, but Referrer-Policy is absent and style-src contains unsafe-inline.", "artifacts": [ "evidence/headers.json" ], "suggestedFix": "Set an explicit strict-origin-when-cross-origin or stricter Referrer-Policy and migrate inline styles toward nonce/hash-backed policy where feasible.", "effort": "medium", "confidence": "high", "pathId": "login", "url": "https://web.facebook.com" }, { "id": "F21", "severity": "high", "principleId": "be-resilient", "principleCheckId": "progressive-enhancement", "guidanceId": "same-document-transitions", "guidanceCategory": "user-experience", "summary": "The core logged-out content is almost absent without JavaScript.", "evidence": "Discoverability fetched 377,678 bytes of raw HTML but found only 8 text characters and 1% content-word coverage; crawler screenshot is effectively blank.", "artifacts": [ "evidence/discoverability.json", "evidence/discoverability-rendered.png", "evidence/discoverability-crawler.png" ], "suggestedFix": "Server-render the login purpose, form labels and recovery/signup links, then progressively enhance interactions.", "effort": "large", "confidence": "high", "pathId": "login", "url": "https://web.facebook.com" }, { "id": "F22", "severity": "high", "principleId": "be-trustworthy", "principleCheckId": "trustworthy-input-assistance", "guidanceId": "autofill-sign-up-form", "guidanceCategory": "forms", "summary": "Signup disables autofill and the login password lacks a suitable autocomplete token.", "evidence": "Signup probe reports autocomplete=\"off\" for name, contact and password fields; login uses username webauthn for identity but no password autocomplete.", "artifacts": [ "evidence/signup-probe.json", "evidence/login-probe.json" ], "suggestedFix": "Use name/given-name/family-name, email or tel, new-password for signup, and current-password for login while retaining webauthn on the username field.", "effort": "small", "confidence": "high", "pathId": "signup", "url": "https://www.facebook.com/reg/" }, { "id": "F23", "severity": "high", "principleId": "be-sustainable", "principleCheckId": "optimised-assets", "guidanceId": "deliver-optimized-decorative-images", "guidanceCategory": "performance", "summary": "A 7.4MB image is delivered for a secondary QR-login affordance.", "evidence": "HAR identifies QrCodeLoginPizza.jpg as 7,395,126 transferred bytes, 78% of the 9.44MB page load.", "artifacts": [ "evidence/home-summary.json", "evidence/home.har" ], "suggestedFix": "Generate an appropriately sized AVIF/WebP asset and lazy-load it only when the QR flow is requested.", "effort": "medium", "confidence": "high", "pathId": "login", "url": "https://web.facebook.com" }, { "id": "F24", "severity": "high", "principleId": "be-sustainable", "principleCheckId": "third-party-and-media-budget", "guidanceId": "efficient-background-processing", "guidanceCategory": "performance", "summary": "Initial transfer is disproportionate to a basic login form.", "evidence": "HAR records 9.44MB across 41 requests, including a 7.4MB image, 1.32MB scripts and 183KB font before the secondary QR flow is opened.", "artifacts": [ "evidence/home-summary.json", "evidence/home.har" ], "suggestedFix": "Set a logged-out page-weight budget, defer secondary media and scripts, and monitor first-load bytes in CI.", "effort": "large", "confidence": "high", "pathId": "login", "url": "https://web.facebook.com" } ], "taskList": [ { "id": "T01", "title": "Fix the mobile viewport and reflow on the main logged-out route", "priority": 1, "findingIds": [ "F04", "F13", "F18" ], "guidanceId": "fluid-scaling", "status": "open" }, { "id": "T02", "title": "Remove the 7.4MB QR image from initial delivery and set a logged-out page-weight budget", "priority": 2, "findingIds": [ "F05", "F07", "F23", "F24" ], "guidanceId": "optimize-image-priority", "status": "open" }, { "id": "T03", "title": "Server-render the core login content and metadata for no-JS resilience and discovery", "priority": 3, "findingIds": [ "F17", "F18", "F21" ], "guidanceId": "same-document-transitions", "status": "open" }, { "id": "T04", "title": "Repair consent accessibility: labels, alt text, contrast and headings", "priority": 4, "findingIds": [ "F10", "F11", "F12" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T05", "title": "Restore standards-based autocomplete across login and signup", "priority": 5, "findingIds": [ "F22" ], "guidanceId": "autofill-sign-up-form", "status": "open" }, { "id": "T06", "title": "Reduce startup script/main-thread work and remove unload/console failures", "priority": 6, "findingIds": [ "F08", "F09", "F14", "F16" ], "guidanceId": "break-up-long-tasks", "status": "open" }, { "id": "T07", "title": "Reserve image dimensions and modernise cookie illustration delivery", "priority": 7, "findingIds": [ "F06", "F15" ], "guidanceId": "optimize-image-priority", "status": "open" }, { "id": "T08", "title": "Add user-preference theming and calm state transitions", "priority": 8, "findingIds": [ "F01", "F02" ], "guidanceId": "dark-mode", "status": "open" }, { "id": "T09", "title": "Tighten indexing and defensive-header signals", "priority": 9, "findingIds": [ "F19", "F20" ], "guidanceId": "security", "status": "open" }, { "id": "T10", "title": "Shorten the blocking cookie-consent first layer", "priority": 10, "findingIds": [ "F03" ], "guidanceId": "light-dismiss-a-dialog", "status": "open" } ], "budget": { "pathCount": 4, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-18T06-38-53-414Z" }