{ "url": "https://www.choiceadvantage.com", "auditedAt": "2026-07-18T07:31:37.854Z", "mode": "report", "status": "completed", "statusDetail": "Atomic coverage complete across 58 checks and four representative page archetypes plus a failure state.", "page": { "appType": "mpa", "framework": "Server-rendered legacy HTML/JSP with jQuery and Akamai mPulse telemetry", "notes": "Public brochure pages share one fixed-width template; system status and authenticated login are distinct archetypes." }, "evidenceUsed": [ "screenshot", "DOM+computed CSS", "layout metrics", "evaluate probes", "trace", "HAR", "Lighthouse", "discoverability/no-JS", "headers", "cookies", "trackers", "secrets", "images", "heap summaries", "manual representative journey review", "Modern Web Guidance" ], "guidanceConsulted": [ "dark-mode", "accessibility", "same-document-transitions", "scrollytelling", "position-aware-tooltips", "navigation-drawer", "light-dismiss-a-dialog", "declarative-dialog-popover-control", "fluid-scaling", "size-aware-styling", "forms", "accessible-error-announcement", "identify-inp-causes", "break-up-long-tasks", "optimize-image-priority", "identify-heavy-scripts", "improve-text-layout-and-legibility", "html", "security", "privacy", "passkeys", "stabilize-reactive-state", "translator", "coordinate-global-events", "validate-input-after-interaction", "autofill-sign-in-form", "deliver-optimized-decorative-images", "efficient-background-processing", "webmcp", "language-model", "manage-recurring-intervals" ], "artifacts": [ { "type": "screenshot", "path": "evidence/home-desktop.png", "caption": "Public homepage, desktop, full page", "findingIds": [ "F04", "F13" ] }, { "type": "screenshot", "path": "evidence/home-mobile.png", "caption": "Public homepage requested at 360x800; desktop canvas is scaled down", "condition": "viewport: 360x800", "findingIds": [ "F05", "F14" ] }, { "type": "layout", "path": "evidence/home-mobile-layout.json", "caption": "Mobile layout metrics showing 980 CSS px viewport and missing viewport meta", "findingIds": [ "F05", "F14", "F19" ] }, { "type": "screenshot", "path": "evidence/home-dark.png", "caption": "Homepage under prefers-color-scheme: dark", "condition": "prefers-color-scheme: dark", "findingIds": [ "F01" ] }, { "type": "screenshot", "path": "evidence/home-forced-colors.png", "caption": "Homepage under forced colors and increased contrast", "condition": "forced-colors: active, prefers-contrast: more", "findingIds": [] }, { "type": "dom", "path": "evidence/home-dom.json", "caption": "Rendered homepage DOM and CSS", "findingIds": [ "F02", "F04", "F06", "F13", "F16", "F18", "F20", "F28" ] }, { "type": "other", "path": "evidence/home-probe.json", "caption": "Homepage metadata, focus, CSS-feature and structure probe", "findingIds": [ "F03", "F06", "F12", "F16", "F20", "F21", "F26", "F28" ] }, { "type": "other", "path": "evidence/preferences.json", "caption": "Dark and reduced-motion preference probe", "findingIds": [ "F01", "F02" ] }, { "type": "screenshot", "path": "evidence/delivers.png", "caption": "Representative informational detail page", "findingIds": [ "F03", "F18" ] }, { "type": "screenshot", "path": "evidence/status.png", "caption": "System status surface", "findingIds": [] }, { "type": "dom", "path": "evidence/status-dom.json", "caption": "System status rendered DOM", "findingIds": [] }, { "type": "screenshot", "path": "evidence/login.png", "caption": "Account login surface", "findingIds": [ "F24", "F31" ] }, { "type": "dom", "path": "evidence/login-dom.json", "caption": "Login rendered DOM", "findingIds": [ "F30" ] }, { "type": "other", "path": "evidence/login-probe.json", "caption": "Login form, autocomplete, labels and auth-capability probe", "findingIds": [ "F24", "F28", "F29", "F30", "F31" ] }, { "type": "screenshot", "path": "evidence/login-empty-submit.png", "caption": "Login after blank submission; no error appeared", "findingIds": [ "F07", "F29" ] }, { "type": "screenshot", "path": "evidence/not-found.png", "caption": "Raw Apache 404 response", "findingIds": [ "F07", "F27" ] }, { "type": "dom", "path": "evidence/not-found-dom.json", "caption": "Unknown-route DOM", "findingIds": [ "F27" ] }, { "type": "trace", "path": "evidence/home-trace.json", "caption": "Raw DevTools load trace", "findingIds": [] }, { "type": "trace-summary", "path": "evidence/home-trace-summary.json", "caption": "Compact load trace: FCP/LCP and long tasks", "findingIds": [] }, { "type": "har", "path": "evidence/home.har", "caption": "Load network archive", "findingIds": [] }, { "type": "har-summary", "path": "evidence/home-summary.json", "caption": "Compact network totals, third parties and delivery signals", "findingIds": [ "F08", "F23", "F33" ] }, { "type": "lighthouse", "path": "evidence/lighthouse-home.json", "caption": "Lighthouse home audit", "findingIds": [ "F08", "F09", "F11", "F12", "F15", "F17", "F23", "F32", "F33" ] }, { "type": "lighthouse", "path": "evidence/lighthouse-login.json", "caption": "Lighthouse login audit", "findingIds": [ "F09", "F10", "F11", "F18" ] }, { "type": "other", "path": "evidence/headers.json", "caption": "Public security headers", "findingIds": [ "F22", "F25" ] }, { "type": "other", "path": "evidence/login-headers.json", "caption": "Login security headers", "findingIds": [ "F22", "F25" ] }, { "type": "other", "path": "evidence/cookies.json", "caption": "Public cookie audit", "findingIds": [] }, { "type": "other", "path": "evidence/login-cookies.json", "caption": "Login cookie audit", "findingIds": [ "F22" ] }, { "type": "other", "path": "evidence/trackers.json", "caption": "Third-party tracker origins", "findingIds": [ "F23" ] }, { "type": "other", "path": "evidence/secrets.json", "caption": "Client secret scan; no findings", "findingIds": [] }, { "type": "other", "path": "evidence/images.json", "caption": "Image dimensions, formats, srcset and alt audit", "findingIds": [ "F10", "F16", "F32" ] }, { "type": "heap", "path": "evidence/home-heap.json", "caption": "Baseline homepage heap summary", "findingIds": [] }, { "type": "heap", "path": "evidence/home-heap-post-resize.json", "caption": "Heap summary after ten resize interactions", "findingIds": [] }, { "type": "discoverability", "path": "evidence/discoverability", "caption": "Raw HTML versus rendered discoverability result", "findingIds": [ "F19" ] }, { "type": "screenshot", "path": "evidence/discoverability-rendered.png", "caption": "Rendered browser view", "findingIds": [] }, { "type": "screenshot", "path": "evidence/discoverability-crawler.png", "caption": "No-JS crawler view", "findingIds": [] }, { "type": "discoverability", "path": "evidence/login-discoverability", "caption": "Login raw HTML versus rendered result", "findingIds": [] }, { "type": "other", "path": "evidence/runtime-metrics.json", "caption": "Runtime DOM/resource/service worker metrics", "findingIds": [ "F26" ] }, { "type": "other", "path": "evidence/guidance-retrieved.md", "caption": "Retrieved Modern Web Guidance", "findingIds": [] }, { "type": "other", "path": "coverage-manifest.json", "caption": "Planned atomic coverage manifest", "findingIds": [] } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 58, "blocked": 0, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": true }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "The dark-condition screenshot is pixel-identical to the light capture; the probe reports colorScheme \"normal\" and no preference media rules.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dark.png", "evidence/preferences.json" ], "findingIds": [ "F01" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "CSS applies 0.2s hover transitions while the reduced-motion probe found no prefers-reduced-motion rule.", "pathIds": [ "home" ], "artifacts": [ "evidence/preferences.json", "evidence/home-dom.json" ], "findingIds": [ "F02" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "pass", "confidence": "high", "method": "Forced-colors and prefers-contrast screenshot review", "evidence": "Controls and text remain visible in the forced-colors capture.", "artifacts": [ "evidence/home-forced-colors.png" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "DOM/CSS inspection found no view-transition-name or @view-transition rule across the informational MPA routes.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-probe.json", "evidence/delivers.png" ], "findingIds": [ "F03" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "not-applicable", "confidence": "high", "method": "DOM/CSS and visual review", "evidence": "No parallax, scrollytelling, carousel, or scroll-linked motion exists on the representative routes.", "artifacts": [ "evidence/home-probe.json" ], "reason": "No parallax, scrollytelling, carousel, or scroll-linked motion exists on the representative routes." }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "not-applicable", "confidence": "high", "method": "DOM/CSS and interaction review", "evidence": "No swipe, pull, carousel, draggable, or other custom gesture surface exists.", "artifacts": [ "evidence/home-probe.json" ], "reason": "No swipe, pull, carousel, draggable, or other custom gesture surface exists." }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "not-applicable", "confidence": "medium", "method": "Screenshot and CSS review", "evidence": "The pages have no sticky/affixed chrome or scroll-progress surface whose state needs adaptation.", "artifacts": [ "evidence/home-desktop.png", "evidence/home-probe.json" ], "reason": "The pages have no sticky/affixed chrome or scroll-progress surface whose state needs adaptation." }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "not-applicable", "confidence": "high", "method": "DOM and CSS overlay inspection", "evidence": "No tooltip, popover, contextual menu, or anchored overlay appears on audited routes.", "artifacts": [ "evidence/home-probe.json" ], "reason": "No tooltip, popover, contextual menu, or anchored overlay appears on audited routes." }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "The CSS defines .nav a.active, but rendered home and delivers DOM never apply it, so all links look equivalent.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/home-dom.json" ], "findingIds": [ "F04" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "pass", "confidence": "high", "method": "Load screenshots on representative routes", "evidence": "No load-time popup, interstitial, consent wall, or obscuring banner appeared.", "artifacts": [ "evidence/home-desktop.png", "evidence/login.png" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "not-applicable", "confidence": "high", "method": "DOM probe for dialog/popover/details and overlay classes", "evidence": "No overlay or rich disclosure control appears on the audited routes.", "artifacts": [ "evidence/home-probe.json" ], "reason": "No overlay or rich disclosure control appears on the audited routes." }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "pass", "confidence": "medium", "method": "Desktop screenshots and layout review", "evidence": "The public template is content-led with modest header/navigation chrome and no competing widgets.", "artifacts": [ "evidence/home-desktop.png", "evidence/delivers.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "At a requested 360px viewport, Chrome lays out a 980px page at scale 0.367 because viewport meta is absent; CSS enforces min-width:980px.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile.png", "evidence/home-mobile-layout.json" ], "findingIds": [ "F05" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "CSS inspection found no container queries; header, hero, login card, nav and wrapper use fixed widths and global breakpoints.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json", "evidence/home-probe.json" ], "findingIds": [ "F06" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "pass", "confidence": "high", "method": "Programmatic focus and target geometry probe", "evidence": "All focusable public controls retained a visible 1px auto outline; sampled targets were at least 29px tall and not hover-only.", "artifacts": [ "evidence/home-probe.json" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "pass", "confidence": "high", "method": "First-viewport screenshots and heading/link review", "evidence": "The product purpose, benefit navigation, status link, and account login are immediately identifiable.", "artifacts": [ "evidence/home-desktop.png", "evidence/status.png", "evidence/login.png" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "pass", "confidence": "medium", "method": "Representative public journey walkthrough", "evidence": "Benefits pages, system status, PDF link, and login entry are reachable through real links with no public-flow dead end.", "artifacts": [ "evidence/home-desktop.png", "evidence/delivers.png", "evidence/status.png", "evidence/login.png" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "Blank login submission produced no visible error, and an unknown URL returns the raw Apache 404 with no navigation, retry, or support path.", "pathIds": [ "home" ], "artifacts": [ "evidence/login-empty-submit.png", "evidence/not-found.png" ], "findingIds": [ "F07" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "pass", "confidence": "high", "method": "Lighthouse plus trace summary", "evidence": "Lighthouse measured LCP 2.0s, CLS 0.001 and TBT 0ms; raw trace measured LCP 468ms and no long tasks.", "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-trace-summary.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "pass", "confidence": "high", "method": "Layout observer and Lighthouse", "evidence": "Observed CLS was 0.0004 on mobile and Lighthouse CLS was 0.001, both well within the good range.", "artifacts": [ "evidence/home-mobile-layout.json", "evidence/lighthouse-home.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "pass", "confidence": "high", "method": "Trace and layout long-task observers", "evidence": "The trace recorded zero long tasks and 0ms total blocking time; layout observer also found no long tasks.", "artifacts": [ "evidence/home-trace-summary.json", "evidence/home-mobile-layout.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "Lighthouse logged two 404 font requests, a cache-control:no-store BFCache blocker, and no fetchpriority hint on the hero LCP image; LCP was still 2.0s.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-summary.json" ], "findingIds": [ "F08" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "Lighthouse estimated 38 KiB unused in Boomerang; login also shipped 27 KiB unused first-party JS and 14 KiB of 94% unused Bootstrap CSS.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/lighthouse-login.json" ], "findingIds": [ "F09" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "The image primitive found all four public-page images missing alt; Lighthouse found both login inputs without associated labels and an unnamed footer link.", "pathIds": [ "home" ], "artifacts": [ "evidence/images.json", "evidence/lighthouse-login.json" ], "findingIds": [ "F10" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "Lighthouse measured public nav links at 4.36:1 and login labels at 3.54:1; the login footer was 2.34:1.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/lighthouse-login.json" ], "findingIds": [ "F11" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "Lighthouse reports no main landmark on public and login pages; public HTML has only presentation role markup. Native focus outlines are present.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-probe.json" ], "findingIds": [ "F12" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "Rendered CSS uses 13px #999 body text and an 11px #d3d3d3 footer; screenshots show low-emphasis text across long content.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/home-dom.json" ], "findingIds": [ "F13" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "The 360px audit is rendered as a scaled 980px desktop page, making text and controls physically small despite no CSS overflow.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile.png", "evidence/home-mobile-layout.json" ], "findingIds": [ "F14" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "Lighthouse captured two 404 errors for Sansation regular and bold font URLs.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json" ], "findingIds": [ "F15" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "The probe reports no doctype and BackCompat; DOM shows conflicting UTF-8 and ISO-8859-1 declarations, while images lack dimensions and the hero has a mismatched aspect ratio.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-probe.json", "evidence/home-dom.json", "evidence/images.json" ], "findingIds": [ "F16" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "Lighthouse reports a deprecated unload listener in Boomerang and BFCache failure from no-store plus a subframe unload handler.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json" ], "findingIds": [ "F17" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "Home and delivers both use \"ChoiceADVANTAGE.com\"; Lighthouse reports no meta description on home or login.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json", "evidence/delivers.png", "evidence/lighthouse-login.json" ], "findingIds": [ "F18" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "Links are real hrefs and raw-HTML coverage is 99%, but the public page omits viewport meta and renders a 980px layout on mobile.", "pathIds": [ "home" ], "artifacts": [ "evidence/discoverability", "evidence/home-mobile-layout.json" ], "findingIds": [ "F19" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "Recon found /robots.txt and /sitemap.xml return 404, and the DOM has no canonical or robots metadata.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-probe.json", "evidence/home-dom.json" ], "findingIds": [ "F20" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "The probe found zero JSON-LD blocks and no Open Graph metadata despite visible Choice Hotels product/organization content.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-probe.json" ], "findingIds": [ "F21" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "HTTPS and HSTS are present, but CSP is absent; the public route lacks nosniff and RT/ROUTEID cookies are not Secure with SameSite=None.", "pathIds": [ "home" ], "artifacts": [ "evidence/headers.json", "evidence/login-headers.json", "evidence/login-cookies.json" ], "findingIds": [ "F22" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "Trackers evidence records two mPulse origins; HAR attributes 59,280 bytes and two requests to third parties, with Boomerang mostly unused.", "pathIds": [ "home" ], "artifacts": [ "evidence/trackers.json", "evidence/home-summary.json", "evidence/lighthouse-home.json" ], "findingIds": [ "F23" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "Login DOM contains only username/password fields, disables autocomplete, and the probe found no WebAuthn or navigator.credentials integration.", "pathIds": [ "login" ], "artifacts": [ "evidence/login.png", "evidence/login-probe.json" ], "findingIds": [ "F24" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "Both routes omit CSP, Referrer-Policy and Permissions-Policy; clickjacking and HSTS are present, and the public route omits nosniff.", "pathIds": [ "home" ], "artifacts": [ "evidence/headers.json", "evidence/login-headers.json" ], "findingIds": [ "F25" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "pass", "confidence": "high", "method": "Discoverability raw-HTML comparison", "evidence": "Raw HTML contains 99% of rendered content and the crawler screenshot remains useful; the site is not a JS shell.", "artifacts": [ "evidence/discoverability", "evidence/discoverability-crawler.png" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "pass", "confidence": "medium", "method": "Representative route and static runtime inspection", "evidence": "Static navigation, login, and status routes loaded without cut-off overlays or fragile async UI; no overlays exist.", "artifacts": [ "evidence/home-desktop.png", "evidence/login.png", "evidence/status.png" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "The probe found no web app manifest; the only registration is Akamai’s telemetry/service worker and no user-facing offline fallback was evidenced.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-probe.json", "evidence/runtime-metrics.json" ], "findingIds": [ "F26" ] }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "The tested unknown route shows a raw Apache 2.4.58 404 with no branded navigation or recovery action.", "pathIds": [ "not-found" ], "artifacts": [ "evidence/not-found.png", "evidence/not-found-dom.json" ], "findingIds": [ "F27" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "Public and login DOM report no html lang; CSS inspection found no logical properties and relies on left/right positioning.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json", "evidence/login-probe.json", "evidence/home-probe.json" ], "findingIds": [ "F28" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "not-applicable", "confidence": "high", "method": "Rendered content and DOM review", "evidence": "The audited pre-auth routes expose no dates, currencies, locale-sensitive numbers, or user-entered locale data.", "artifacts": [ "evidence/home-dom.json", "evidence/login-dom.json" ], "reason": "The audited pre-auth routes expose no dates, currencies, locale-sensitive numbers, or user-entered locale data." }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "not-applicable", "confidence": "high", "method": "Rendered content and DOM review", "evidence": "The audited surfaces expose no events, schedules, timestamps, or time-zone-sensitive controls.", "artifacts": [ "evidence/home-dom.json", "evidence/status-dom.json" ], "reason": "The audited surfaces expose no events, schedules, timestamps, or time-zone-sensitive controls." }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "pass", "confidence": "medium", "method": "Public, status, and login visual walkthrough", "evidence": "No consent nag, upsell, confirmshaming, disguised advertising, forced continuity, or hidden pricing was observed.", "artifacts": [ "evidence/home-desktop.png", "evidence/login.png", "evidence/status.png" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "Inputs are not required, lack associated labels, and clicking Login with empty values left the same screen with no visible or announced error.", "pathIds": [ "login" ], "artifacts": [ "evidence/login-empty-submit.png", "evidence/login-probe.json" ], "findingIds": [ "F29" ] }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "Both username and password inputs use autocomplete=\"off\"; the username field is not identified as username and the password as current-password.", "pathIds": [ "login" ], "artifacts": [ "evidence/login-dom.json", "evidence/login-probe.json" ], "findingIds": [ "F30" ] }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "The login says users who forgot a password must contact support and exposes no passkey or account-management entry point.", "pathIds": [ "login" ], "artifacts": [ "evidence/login.png", "evidence/login-probe.json" ], "findingIds": [ "F31" ] }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "All four public images are PNG/JPEG; three lack srcset, all lack dimensions, and Lighthouse flags low-resolution logos on high-density displays.", "pathIds": [ "home" ], "artifacts": [ "evidence/images.json", "evidence/lighthouse-home.json" ], "findingIds": [ "F32" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "pass", "confidence": "high", "method": "HAR and trace review", "evidence": "The page made 19 requests, transferred 293KB, and generated no long tasks or background media work during capture.", "artifacts": [ "evidence/home-summary.json", "evidence/home-trace-summary.json" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "issues", "confidence": "high", "method": "Targeted visual/objective evidence review against consulted guidance", "evidence": "HAR totals 293,468 transferred bytes; 59,280 bytes are third-party, and Lighthouse estimates 38 KiB of Boomerang is unused.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/lighthouse-home.json" ], "findingIds": [ "F33" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "not-applicable", "confidence": "high", "method": "Site-purpose and DOM capability review", "evidence": "This legacy brochure plus gated property-management login exposes no declared agent-facing surface; emerging WebMCP capability is out of scope.", "artifacts": [ "evidence/home-probe.json", "evidence/login-probe.json" ], "reason": "This legacy brochure plus gated property-management login exposes no declared agent-facing surface; emerging WebMCP capability is out of scope." }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "high", "method": "Site-purpose and source signal review", "evidence": "No summarisation or language-model task is present where built-in on-device inference would improve the audited experience.", "artifacts": [ "evidence/home-probe.json" ], "reason": "No summarisation or language-model task is present where built-in on-device inference would improve the audited experience." }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "pass", "confidence": "medium", "method": "Baseline and post-resize heap-summary comparison", "evidence": "After 10 representative resize events, snapshot totals changed from 2,344,119 to 2,400,648 bytes and 55,432 to 55,715 nodes; no unbounded pattern was evidenced in this bounded test.", "artifacts": [ "evidence/home-heap.json", "evidence/home-heap-post-resize.json" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "pass", "confidence": "high", "method": "Heap summary plus DOM/runtime metrics", "evidence": "The static page used a 2.34MB self-size heap summary with 65 live DOM elements, proportionate to this small page.", "artifacts": [ "evidence/home-heap.json", "evidence/runtime-metrics.json" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "pass", "confidence": "medium", "method": "Heap constructor review before/after bounded interaction", "evidence": "Neither summary surfaced Detached* among top constructors, and ten resize dispatches produced only small bounded growth; no accumulation signal was observed.", "artifacts": [ "evidence/home-heap.json", "evidence/home-heap-post-resize.json" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F01", "F02" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "issues", "findingIds": [ "F03" ] }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "issues", "findingIds": [ "F04" ] }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "pass" }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "issues", "findingIds": [ "F05", "F06" ] }, { "principleId": "support-core-task-success", "expectation": "default", "status": "issues", "findingIds": [ "F07" ] }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F08", "F09" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F10", "F11", "F12", "F13", "F14" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "issues", "findingIds": [ "F15", "F16", "F17" ] }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F18", "F19", "F20", "F21" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F22", "F23", "F24", "F25" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "issues", "findingIds": [ "F26", "F27" ] }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "issues", "findingIds": [ "F28" ] }, { "principleId": "be-trustworthy", "expectation": "default", "status": "issues", "findingIds": [ "F29", "F30", "F31" ] }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F32", "F33" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "not-applicable", "reason": "All checks were judged not applicable to this site’s audited surfaces." }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "pass" } ], "paths": [ { "id": "home", "description": "Homepage and shared public brochure template; represents key-benefit and marketing content routes.", "url": "https://www.choiceadvantage.com/", "conditions": [ "desktop", "360x800", "prefers-color-scheme: dark", "forced-colors", "prefers-reduced-motion", "no JavaScript crawler" ], "result": "issues" }, { "id": "detail", "description": "Delivers More Reservations page; representative second instance of the shared informational template.", "url": "https://www.choiceadvantage.com/delivers.html", "conditions": [ "desktop" ], "result": "issues" }, { "id": "status", "description": "System-status archetype; highest-risk public operational state surface.", "url": "https://www.choiceadvantage.com/cc-status/current.html", "conditions": [ "desktop", "360x800" ], "result": "pass" }, { "id": "login", "description": "Primary account-entry form and password authentication surface; audited without credentials.", "url": "https://www.choiceadvantage.com/choicehotels/", "conditions": [ "desktop", "360x800", "blank submission", "no JavaScript crawler" ], "result": "issues" }, { "id": "not-found", "description": "Unknown-route recovery state used to judge HTTP failure handling.", "url": "https://www.choiceadvantage.com/definitely-not-a-real-page-web-uplift", "conditions": [ "desktop" ], "result": "issues" }, { "id": "not-covered", "description": "Authenticated property-management screens, successful sign-in, password reset, the PDF body, and destructive/account flows were not covered because credentials or non-HTML document interaction were unavailable; representative public templates were de-duplicated.", "result": "skipped" } ], "findings": [ { "id": "F01", "severity": "medium", "confidence": "high", "summary": "The site ignores the user’s dark color-scheme preference.", "evidence": "The dark-condition screenshot is pixel-identical to the light capture; the probe reports colorScheme \"normal\" and no preference media rules.", "suggestedFix": "Declare light/dark color schemes before paint and use preference-driven surface and text colors.", "effort": "small", "principleId": "respect-user-preferences", "principleCheckId": "respects-color-scheme", "guidanceId": "dark-mode", "pathId": "home", "url": "https://www.choiceadvantage.com/", "artifacts": [ "evidence/home-dark.png", "evidence/preferences.json" ] }, { "id": "F02", "severity": "low", "confidence": "high", "summary": "Transitions do not account for reduced-motion preference.", "evidence": "CSS applies 0.2s hover transitions while the reduced-motion probe found no prefers-reduced-motion rule.", "suggestedFix": "Wrap non-essential transitions in no-preference and provide a reduced-motion override.", "effort": "small", "principleId": "respect-user-preferences", "principleCheckId": "respects-reduced-motion", "guidanceId": "accessibility", "pathId": "home", "url": "https://www.choiceadvantage.com/", "artifacts": [ "evidence/preferences.json", "evidence/home-dom.json" ] }, { "id": "F03", "severity": "low", "confidence": "high", "summary": "Cross-document navigation swaps abruptly.", "evidence": "DOM/CSS inspection found no view-transition-name or @view-transition rule across the informational MPA routes.", "suggestedFix": "Add progressive cross-document View Transitions, with reduced-motion handling.", "effort": "medium", "principleId": "implement-natural-interactions", "principleCheckId": "view-transitions", "guidanceId": "same-document-transitions", "pathId": "home", "url": "https://www.choiceadvantage.com/", "artifacts": [ "evidence/home-probe.json", "evidence/delivers.png" ] }, { "id": "F04", "severity": "medium", "confidence": "high", "summary": "Section navigation does not indicate the current page.", "evidence": "The CSS defines .nav a.active, but rendered home and delivers DOM never apply it, so all links look equivalent.", "suggestedFix": "Apply aria-current=\"page\" and a persistent visual current-page treatment.", "effort": "small", "principleId": "provide-guided-navigation", "principleCheckId": "directs-attention", "guidanceId": "navigation-drawer", "pathId": "home", "url": "https://www.choiceadvantage.com/", "artifacts": [ "evidence/home-desktop.png", "evidence/home-dom.json" ] }, { "id": "F05", "severity": "high", "confidence": "high", "summary": "The public and login pages ship a desktop canvas to mobile.", "evidence": "At a requested 360px viewport, Chrome lays out a 980px page at scale 0.367 because viewport meta is absent; CSS enforces min-width:980px.", "suggestedFix": "Add a viewport meta tag, remove fixed minimum widths, and recompose navigation/content into a true single-column mobile layout.", "effort": "medium", "principleId": "adapt-to-the-form-factor", "principleCheckId": "responsive-no-horizontal-scroll", "guidanceId": "fluid-scaling", "pathId": "home", "url": "https://www.choiceadvantage.com/", "artifacts": [ "evidence/home-mobile.png", "evidence/home-mobile-layout.json" ] }, { "id": "F06", "severity": "medium", "confidence": "high", "summary": "Components do not adapt to their available container.", "evidence": "CSS inspection found no container queries; header, hero, login card, nav and wrapper use fixed widths and global breakpoints.", "suggestedFix": "Give reusable regions containment and use size container queries for local layout changes.", "effort": "medium", "principleId": "adapt-to-the-form-factor", "principleCheckId": "component-level-responsiveness", "guidanceId": "size-aware-styling", "pathId": "home", "url": "https://www.choiceadvantage.com/", "artifacts": [ "evidence/home-dom.json", "evidence/home-probe.json" ] }, { "id": "F07", "severity": "high", "confidence": "high", "summary": "Failure and invalid states offer no actionable recovery.", "evidence": "Blank login submission produced no visible error, and an unknown URL returns the raw Apache 404 with no navigation, retry, or support path.", "suggestedFix": "Add inline, announced validation and a branded error page with clear recovery actions.", "effort": "medium", "principleId": "support-core-task-success", "principleCheckId": "clear-system-state-and-recovery", "guidanceId": "accessible-error-announcement", "pathId": "home", "url": "https://www.choiceadvantage.com/", "artifacts": [ "evidence/login-empty-submit.png", "evidence/not-found.png" ] }, { "id": "F08", "severity": "medium", "confidence": "high", "summary": "Resource delivery has avoidable broken and unprioritised dependencies.", "evidence": "Lighthouse logged two 404 font requests, a cache-control:no-store BFCache blocker, and no fetchpriority hint on the hero LCP image; LCP was still 2.0s.", "suggestedFix": "Fix font URLs, apply deliberate caching/BFCache policy, and mark the LCP image fetchpriority=\"high\" with dimensions.", "effort": "small", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "guidanceId": "optimize-image-priority", "pathId": "home", "url": "https://www.choiceadvantage.com/", "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-summary.json" ] }, { "id": "F09", "severity": "low", "confidence": "high", "summary": "Third-party and login bundles ship substantial unused code.", "evidence": "Lighthouse estimated 38 KiB unused in Boomerang; login also shipped 27 KiB unused first-party JS and 14 KiB of 94% unused Bootstrap CSS.", "suggestedFix": "Conditionally load telemetry and trim the login bundle/CSS to the controls used.", "effort": "medium", "principleId": "be-fast-and-stable", "principleCheckId": "trim-unused-and-duplicate-code", "guidanceId": "identify-heavy-scripts", "pathId": "home", "url": "https://www.choiceadvantage.com/", "artifacts": [ "evidence/lighthouse-home.json", "evidence/lighthouse-login.json" ] }, { "id": "F10", "severity": "high", "confidence": "high", "summary": "Images and login controls lack accessible names and associations.", "evidence": "The image primitive found all four public-page images missing alt; Lighthouse found both login inputs without associated labels and an unnamed footer link.", "suggestedFix": "Add meaningful or empty alt text, explicitly associate labels and inputs, and name every interactive link.", "effort": "small", "principleId": "be-inclusive", "principleCheckId": "names-roles-labels", "guidanceId": "accessibility", "pathId": "home", "url": "https://www.choiceadvantage.com/", "artifacts": [ "evidence/images.json", "evidence/lighthouse-login.json" ] }, { "id": "F11", "severity": "high", "confidence": "high", "summary": "Text and navigation fail WCAG contrast minimums.", "evidence": "Lighthouse measured public nav links at 4.36:1 and login labels at 3.54:1; the login footer was 2.34:1.", "suggestedFix": "Darken low-contrast text/links or adjust backgrounds to meet at least 4.5:1 for normal text.", "effort": "small", "principleId": "be-inclusive", "principleCheckId": "sufficient-contrast", "guidanceId": "accessibility", "pathId": "home", "url": "https://www.choiceadvantage.com/", "artifacts": [ "evidence/lighthouse-home.json", "evidence/lighthouse-login.json" ] }, { "id": "F12", "severity": "medium", "confidence": "high", "summary": "Pages lack robust semantic structure.", "evidence": "Lighthouse reports no main landmark on public and login pages; public HTML has only presentation role markup. Native focus outlines are present.", "suggestedFix": "Use header/nav/main/footer landmarks and preserve the currently visible native focus treatment.", "effort": "small", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "guidanceId": "accessibility", "pathId": "home", "url": "https://www.choiceadvantage.com/", "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-probe.json" ] }, { "id": "F13", "severity": "medium", "confidence": "high", "summary": "Core copy is too small and faint for comfortable reading.", "evidence": "Rendered CSS uses 13px #999 body text and an 11px #d3d3d3 footer; screenshots show low-emphasis text across long content.", "suggestedFix": "Raise base text size/line height and use stronger text colors and comfortable line lengths.", "effort": "small", "principleId": "be-inclusive", "principleCheckId": "legible-text", "guidanceId": "improve-text-layout-and-legibility", "pathId": "home", "url": "https://www.choiceadvantage.com/", "artifacts": [ "evidence/home-desktop.png", "evidence/home-dom.json" ] }, { "id": "F14", "severity": "high", "confidence": "high", "summary": "Mobile reflow is disabled by the missing viewport configuration.", "evidence": "The 360px audit is rendered as a scaled 980px desktop page, making text and controls physically small despite no CSS overflow.", "suggestedFix": "Restore 1:1 mobile viewport scaling and implement true reflow without fixed minimum widths.", "effort": "medium", "principleId": "be-inclusive", "principleCheckId": "zoom-reflow-targets-and-media", "guidanceId": "fluid-scaling", "pathId": "home", "url": "https://www.choiceadvantage.com/", "artifacts": [ "evidence/home-mobile.png", "evidence/home-mobile-layout.json" ] }, { "id": "F15", "severity": "medium", "confidence": "high", "summary": "The page logs resource errors.", "evidence": "Lighthouse captured two 404 errors for Sansation regular and bold font URLs.", "suggestedFix": "Correct the font paths and add monitoring that catches production asset 404s.", "effort": "trivial", "principleId": "follow-best-practices", "principleCheckId": "no-console-errors", "guidanceId": "html", "pathId": "home", "url": "https://www.choiceadvantage.com/", "artifacts": [ "evidence/lighthouse-home.json" ] }, { "id": "F16", "severity": "high", "confidence": "high", "summary": "The public document is in quirks mode and has malformed asset metadata.", "evidence": "The probe reports no doctype and BackCompat; DOM shows conflicting UTF-8 and ISO-8859-1 declarations, while images lack dimensions and the hero has a mismatched aspect ratio.", "suggestedFix": "Emit a valid HTML5 doctype, one early UTF-8 charset, and explicit intrinsic image dimensions/aspect ratios.", "effort": "small", "principleId": "follow-best-practices", "principleCheckId": "sound-document-and-assets", "guidanceId": "html", "pathId": "home", "url": "https://www.choiceadvantage.com/", "artifacts": [ "evidence/home-probe.json", "evidence/home-dom.json", "evidence/images.json" ] }, { "id": "F17", "severity": "medium", "confidence": "high", "summary": "Deprecated lifecycle code and cache policy block modern browser behavior.", "evidence": "Lighthouse reports a deprecated unload listener in Boomerang and BFCache failure from no-store plus a subframe unload handler.", "suggestedFix": "Update or defer the telemetry library, remove unload handlers, and use BFCache-compatible lifecycle events and caching where safe.", "effort": "medium", "principleId": "follow-best-practices", "principleCheckId": "browser-platform-hygiene", "guidanceId": "html", "pathId": "home", "url": "https://www.choiceadvantage.com/", "artifacts": [ "evidence/lighthouse-home.json" ] }, { "id": "F18", "severity": "high", "confidence": "high", "summary": "Public pages have generic duplicate titles and no descriptions.", "evidence": "Home and delivers both use \"ChoiceADVANTAGE.com\"; Lighthouse reports no meta description on home or login.", "suggestedFix": "Give each route a unique descriptive title and concise, content-matching meta description.", "effort": "small", "principleId": "be-discoverable", "principleCheckId": "title-and-description", "guidanceId": "html", "pathId": "home", "url": "https://www.choiceadvantage.com/", "artifacts": [ "evidence/home-dom.json", "evidence/delivers.png", "evidence/lighthouse-login.json" ] }, { "id": "F19", "severity": "medium", "confidence": "high", "summary": "Crawler-visible pages are not mobile friendly.", "evidence": "Links are real hrefs and raw-HTML coverage is 99%, but the public page omits viewport meta and renders a 980px layout on mobile.", "suggestedFix": "Keep crawlable links and add mobile viewport/reflow support.", "effort": "small", "principleId": "be-discoverable", "principleCheckId": "crawlable-and-mobile-friendly", "guidanceId": "html", "pathId": "home", "url": "https://www.choiceadvantage.com/", "artifacts": [ "evidence/discoverability", "evidence/home-mobile-layout.json" ] }, { "id": "F20", "severity": "medium", "confidence": "high", "summary": "Indexing signals are incomplete.", "evidence": "Recon found /robots.txt and /sitemap.xml return 404, and the DOM has no canonical or robots metadata.", "suggestedFix": "Publish robots.txt and sitemap.xml, add self-referential canonicals, and keep HTTP/indexing policy consistent.", "effort": "small", "principleId": "be-discoverable", "principleCheckId": "canonical-and-indexing-signals", "guidanceId": "html", "pathId": "home", "url": "https://www.choiceadvantage.com/", "artifacts": [ "evidence/home-probe.json", "evidence/home-dom.json" ] }, { "id": "F21", "severity": "low", "confidence": "high", "summary": "The organization pages lack structured and social metadata.", "evidence": "The probe found zero JSON-LD blocks and no Open Graph metadata despite visible Choice Hotels product/organization content.", "suggestedFix": "Add accurate Organization/SoftwareApplication JSON-LD and Open Graph/Twitter preview metadata.", "effort": "small", "principleId": "be-discoverable", "principleCheckId": "structured-and-shareable-metadata", "guidanceId": "html", "pathId": "home", "url": "https://www.choiceadvantage.com/", "artifacts": [ "evidence/home-probe.json" ] }, { "id": "F22", "severity": "high", "confidence": "high", "summary": "Security headers and cookie flags are incomplete.", "evidence": "HTTPS and HSTS are present, but CSP is absent; the public route lacks nosniff and RT/ROUTEID cookies are not Secure with SameSite=None.", "suggestedFix": "Deploy a tested CSP, nosniff, and secure/Lax-or-Strict cookie attributes unless cross-site behavior is essential.", "effort": "medium", "principleId": "be-private-and-secure", "principleCheckId": "secure-transport-and-headers", "guidanceId": "security", "pathId": "home", "url": "https://www.choiceadvantage.com/", "artifacts": [ "evidence/headers.json", "evidence/login-headers.json", "evidence/login-cookies.json" ] }, { "id": "F23", "severity": "low", "confidence": "high", "summary": "Telemetry loads before any demonstrated user need or consent context.", "evidence": "Trackers evidence records two mPulse origins; HAR attributes 59,280 bytes and two requests to third parties, with Boomerang mostly unused.", "suggestedFix": "Document the telemetry purpose, minimise fields, defer/batch it, and load it only where proportionate.", "effort": "medium", "principleId": "be-private-and-secure", "principleCheckId": "data-minimisation-and-third-parties", "guidanceId": "privacy", "pathId": "home", "url": "https://www.choiceadvantage.com/", "artifacts": [ "evidence/trackers.json", "evidence/home-summary.json", "evidence/lighthouse-home.json" ] }, { "id": "F24", "severity": "high", "confidence": "high", "summary": "The account entry offers password-only authentication.", "evidence": "Login DOM contains only username/password fields, disables autocomplete, and the probe found no WebAuthn or navigator.credentials integration.", "suggestedFix": "Add passkey sign-in/registration and retain a secure fallback; request any permissions only after a user action.", "effort": "large", "principleId": "be-private-and-secure", "principleCheckId": "in-context-permissions-and-modern-auth", "guidanceId": "passkeys", "pathId": "login", "url": "https://www.choiceadvantage.com/choicehotels/", "artifacts": [ "evidence/login.png", "evidence/login-probe.json" ] }, { "id": "F25", "severity": "high", "confidence": "high", "summary": "Browser-enforced defensive policies are missing.", "evidence": "Both routes omit CSP, Referrer-Policy and Permissions-Policy; clickjacking and HSTS are present, and the public route omits nosniff.", "suggestedFix": "Add a nonce/hash-based CSP with frame-ancestors, strict referrer policy, least-privilege Permissions-Policy, and nosniff.", "effort": "medium", "principleId": "be-private-and-secure", "principleCheckId": "defensive-browser-policies", "guidanceId": "security", "pathId": "home", "url": "https://www.choiceadvantage.com/", "artifacts": [ "evidence/headers.json", "evidence/login-headers.json" ] }, { "id": "F26", "severity": "low", "confidence": "high", "summary": "The app-like account surface has no installable/offline experience.", "evidence": "The probe found no web app manifest; the only registration is Akamai’s telemetry/service worker and no user-facing offline fallback was evidenced.", "suggestedFix": "For the operational account app, add a manifest and a minimal offline/reconnect shell; keep auth operations online-only.", "effort": "large", "principleId": "be-resilient", "principleCheckId": "offline-and-installable", "guidanceId": "stabilize-reactive-state", "pathId": "home", "url": "https://www.choiceadvantage.com/", "artifacts": [ "evidence/home-probe.json", "evidence/runtime-metrics.json" ] }, { "id": "F27", "severity": "medium", "confidence": "high", "summary": "HTTP failures fall through to server-default output.", "evidence": "The tested unknown route shows a raw Apache 2.4.58 404 with no branded navigation or recovery action.", "suggestedFix": "Serve an accessible 404/error template with home, status, support, and retry options.", "effort": "small", "principleId": "be-resilient", "principleCheckId": "network-and-http-failure-states", "guidanceId": "accessible-error-announcement", "pathId": "not-found", "url": "https://www.choiceadvantage.com/definitely-not-a-real-page-web-uplift", "artifacts": [ "evidence/not-found.png", "evidence/not-found-dom.json" ] }, { "id": "F28", "severity": "medium", "confidence": "high", "summary": "Language and bidirectional foundations are absent on key routes.", "evidence": "Public and login DOM report no html lang; CSS inspection found no logical properties and relies on left/right positioning.", "suggestedFix": "Set lang and dir, replace physical spacing/positioning with logical properties, and test translated/RTL expansion.", "effort": "medium", "principleId": "be-internationalised", "principleCheckId": "lang-dir-and-logical-properties", "guidanceId": "translator", "pathId": "home", "url": "https://www.choiceadvantage.com/", "artifacts": [ "evidence/home-dom.json", "evidence/login-probe.json", "evidence/home-probe.json" ] }, { "id": "F29", "severity": "high", "confidence": "high", "summary": "The login form neither prevents nor explains blank submission.", "evidence": "Inputs are not required, lack associated labels, and clicking Login with empty values left the same screen with no visible or announced error.", "suggestedFix": "Use required semantics, validate after interaction, focus the error summary, and associate clear inline messages with each field.", "effort": "small", "principleId": "be-trustworthy", "principleCheckId": "humane-error-handling", "guidanceId": "validate-input-after-interaction", "pathId": "login", "url": "https://www.choiceadvantage.com/choicehotels/", "artifacts": [ "evidence/login-empty-submit.png", "evidence/login-probe.json" ] }, { "id": "F30", "severity": "high", "confidence": "high", "summary": "Sign-in deliberately disables password-manager and autofill assistance.", "evidence": "Both username and password inputs use autocomplete=\"off\"; the username field is not identified as username and the password as current-password.", "suggestedFix": "Use autocomplete=\"username\" and \"current-password\", stable ids/names, and do not block paste or password managers.", "effort": "trivial", "principleId": "be-trustworthy", "principleCheckId": "trustworthy-input-assistance", "guidanceId": "autofill-sign-in-form", "pathId": "login", "url": "https://www.choiceadvantage.com/choicehotels/", "artifacts": [ "evidence/login-dom.json", "evidence/login-probe.json" ] }, { "id": "F31", "severity": "medium", "confidence": "high", "summary": "Account recovery and stronger authentication are not self-service.", "evidence": "The login says users who forgot a password must contact support and exposes no passkey or account-management entry point.", "suggestedFix": "Offer clear self-service recovery and passkeys, while keeping commitments and account actions reversible and reauthenticated.", "effort": "large", "principleId": "be-trustworthy", "principleCheckId": "safe-commercial-and-account-flows", "guidanceId": "passkeys", "pathId": "login", "url": "https://www.choiceadvantage.com/choicehotels/", "artifacts": [ "evidence/login.png", "evidence/login-probe.json" ] }, { "id": "F32", "severity": "medium", "confidence": "high", "summary": "Images are not delivered responsively or in modern formats.", "evidence": "All four public images are PNG/JPEG; three lack srcset, all lack dimensions, and Lighthouse flags low-resolution logos on high-density displays.", "suggestedFix": "Use SVG/AVIF/WebP as appropriate, responsive srcset/sizes, intrinsic dimensions, and a correctly cropped hero source.", "effort": "medium", "principleId": "be-sustainable", "principleCheckId": "optimised-assets", "guidanceId": "deliver-optimized-decorative-images", "pathId": "home", "url": "https://www.choiceadvantage.com/", "artifacts": [ "evidence/images.json", "evidence/lighthouse-home.json" ] }, { "id": "F33", "severity": "low", "confidence": "high", "summary": "Third-party telemetry consumes a disproportionate share of a small page.", "evidence": "HAR totals 293,468 transferred bytes; 59,280 bytes are third-party, and Lighthouse estimates 38 KiB of Boomerang is unused.", "suggestedFix": "Defer or remove nonessential telemetry and enforce a small third-party budget for this brochure surface.", "effort": "small", "principleId": "be-sustainable", "principleCheckId": "third-party-and-media-budget", "guidanceId": "efficient-background-processing", "pathId": "home", "url": "https://www.choiceadvantage.com/", "artifacts": [ "evidence/home-summary.json", "evidence/lighthouse-home.json" ] } ], "taskList": [ { "id": "T01", "title": "The public and login pages ship a desktop canvas to mobile.", "priority": 1, "findingIds": [ "F05" ], "guidanceId": "fluid-scaling", "status": "open" }, { "id": "T02", "title": "Images and login controls lack accessible names and associations.", "priority": 2, "findingIds": [ "F10" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T03", "title": "Security headers and cookie flags are incomplete.", "priority": 3, "findingIds": [ "F22" ], "guidanceId": "security", "status": "open" }, { "id": "T04", "title": "Text and navigation fail WCAG contrast minimums.", "priority": 4, "findingIds": [ "F11" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T05", "title": "The login form neither prevents nor explains blank submission.", "priority": 5, "findingIds": [ "F29" ], "guidanceId": "validate-input-after-interaction", "status": "open" }, { "id": "T06", "title": "Sign-in deliberately disables password-manager and autofill assistance.", "priority": 6, "findingIds": [ "F30" ], "guidanceId": "autofill-sign-in-form", "status": "open" }, { "id": "T07", "title": "The account entry offers password-only authentication.", "priority": 7, "findingIds": [ "F24" ], "guidanceId": "passkeys", "status": "open" }, { "id": "T08", "title": "Failure and invalid states offer no actionable recovery.", "priority": 8, "findingIds": [ "F07" ], "guidanceId": "accessible-error-announcement", "status": "open" }, { "id": "T09", "title": "The public document is in quirks mode and has malformed asset metadata.", "priority": 9, "findingIds": [ "F16" ], "guidanceId": "html", "status": "open" }, { "id": "T10", "title": "Mobile reflow is disabled by the missing viewport configuration.", "priority": 10, "findingIds": [ "F14" ], "guidanceId": "fluid-scaling", "status": "open" }, { "id": "T11", "title": "Public pages have generic duplicate titles and no descriptions.", "priority": 11, "findingIds": [ "F18" ], "guidanceId": "html", "status": "open" }, { "id": "T12", "title": "Browser-enforced defensive policies are missing.", "priority": 12, "findingIds": [ "F25" ], "guidanceId": "security", "status": "open" }, { "id": "T13", "title": "The page logs resource errors.", "priority": 13, "findingIds": [ "F15" ], "guidanceId": "html", "status": "open" }, { "id": "T14", "title": "The site ignores the user’s dark color-scheme preference.", "priority": 14, "findingIds": [ "F01" ], "guidanceId": "dark-mode", "status": "open" }, { "id": "T15", "title": "Section navigation does not indicate the current page.", "priority": 15, "findingIds": [ "F04" ], "guidanceId": "navigation-drawer", "status": "open" }, { "id": "T16", "title": "Resource delivery has avoidable broken and unprioritised dependencies.", "priority": 16, "findingIds": [ "F08" ], "guidanceId": "optimize-image-priority", "status": "open" }, { "id": "T17", "title": "Pages lack robust semantic structure.", "priority": 17, "findingIds": [ "F12" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T18", "title": "Core copy is too small and faint for comfortable reading.", "priority": 18, "findingIds": [ "F13" ], "guidanceId": "improve-text-layout-and-legibility", "status": "open" }, { "id": "T19", "title": "Crawler-visible pages are not mobile friendly.", "priority": 19, "findingIds": [ "F19" ], "guidanceId": "html", "status": "open" }, { "id": "T20", "title": "Indexing signals are incomplete.", "priority": 20, "findingIds": [ "F20" ], "guidanceId": "html", "status": "open" }, { "id": "T21", "title": "HTTP failures fall through to server-default output.", "priority": 21, "findingIds": [ "F27" ], "guidanceId": "accessible-error-announcement", "status": "open" }, { "id": "T22", "title": "Components do not adapt to their available container.", "priority": 22, "findingIds": [ "F06" ], "guidanceId": "size-aware-styling", "status": "open" }, { "id": "T23", "title": "Deprecated lifecycle code and cache policy block modern browser behavior.", "priority": 23, "findingIds": [ "F17" ], "guidanceId": "html", "status": "open" }, { "id": "T24", "title": "Language and bidirectional foundations are absent on key routes.", "priority": 24, "findingIds": [ "F28" ], "guidanceId": "translator", "status": "open" }, { "id": "T25", "title": "Images are not delivered responsively or in modern formats.", "priority": 25, "findingIds": [ "F32" ], "guidanceId": "deliver-optimized-decorative-images", "status": "open" }, { "id": "T26", "title": "Account recovery and stronger authentication are not self-service.", "priority": 26, "findingIds": [ "F31" ], "guidanceId": "passkeys", "status": "open" }, { "id": "T27", "title": "Transitions do not account for reduced-motion preference.", "priority": 27, "findingIds": [ "F02" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T28", "title": "The organization pages lack structured and social metadata.", "priority": 28, "findingIds": [ "F21" ], "guidanceId": "html", "status": "open" }, { "id": "T29", "title": "Third-party telemetry consumes a disproportionate share of a small page.", "priority": 29, "findingIds": [ "F33" ], "guidanceId": "efficient-background-processing", "status": "open" }, { "id": "T30", "title": "Cross-document navigation swaps abruptly.", "priority": 30, "findingIds": [ "F03" ], "guidanceId": "same-document-transitions", "status": "open" }, { "id": "T31", "title": "Third-party and login bundles ship substantial unused code.", "priority": 31, "findingIds": [ "F09" ], "guidanceId": "identify-heavy-scripts", "status": "open" }, { "id": "T32", "title": "Telemetry loads before any demonstrated user need or consent context.", "priority": 32, "findingIds": [ "F23" ], "guidanceId": "privacy", "status": "open" }, { "id": "T33", "title": "The app-like account surface has no installable/offline experience.", "priority": 33, "findingIds": [ "F26" ], "guidanceId": "stabilize-reactive-state", "status": "open" } ], "budget": { "pathCount": 5, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-18T07-31-37-854Z" }