{ "url": "https://duckduckgo.com", "auditedAt": "2026-07-27T16:45:31.267Z", "mode": "report", "status": "partial", "statusDetail": "56 of 58 checks were judged. Two journey checks were blocked by DuckDuckGo anti-bot challenges; there are no missing, unknown, duplicate, or not-run rows.", "page": { "appType": "hybrid", "framework": "Next.js plus server-rendered/static templates", "notes": "Public search/privacy site. Homepage is partially hydrated; privacy is fully server-rendered. Search result requests were intercepted by an anti-bot challenge." }, "evidenceUsed": [ "screenshot", "dom", "layout-metrics", "evaluate-probe", "trace", "har", "discoverability", "headers", "cookies", "trackers", "images", "secrets", "heap-summary", "lighthouse", "Modern Web Guidance 0.0.172" ], "guidanceConsulted": [ "dark-mode", "component-specific-light-dark-theme", "accessibility", "adapt-scrollbar-to-contrast-preferences", "same-document-transitions", "cross-document-transitions", "group-element-transitions", "faster-spa-view-transitions", "scrollytelling", "parallax-scroll-effects", "scroll-entry-exit-effects", "carousel-slide-effects", "physics-based-easing", "individual-transform-properties", "animate-element-entry-exit", "animate-to-from-top-layer", "animate-to-intrinsic-sizes", "dynamic-sibling-animations", "interactive-content-reveal", "pull-to-reveal", "swipe-to-remove", "shrinking-header-on-scroll", "scroll-progress-indicator", "scroll-position-aware-elements", "scroll-snap-realtime-feedback", "scroll-snap-state-sync", "scroll-target-on-load", "soft-edge-content-fade", "scrollability-affordance-hints", "anchor-positioning-tab-underline", "position-aware-tooltips", "interest-triggered-tooltips", "interest-triggered-action-previews", "directional-navigation-transitions", "carousel-snap-highlights", "navigation-drawer", "stack-drill-down", "persistent-app-tours", "persistent-toast-notifications", "light-dismiss-a-dialog", "platform-controls-dismiss-dialog", "declarative-dialog-popover-control", "animated-select-picker", "branded-select-styling", "brand-consistent-forms", "custom-select-picker-layouts", "rich-media-picker", "complex-shapes", "shaped-cutouts", "overflow-clipping-control", "visually-texture-content", "apply-webgl-shaders", "interactive-content-in-3d-scenes", "highlight-text-ranges", "prevent-text-wrapping", "customize-scrollbar-color-and-thickness", "export-html-media-from-canvas", "fluid-scaling", "calculate-with-intrinsic-sizes", "css-layout", "size-aware-styling", "content-based-styling", "child-state-based-styling", "design-token-reactivity", "dynamic-sibling-styling", "form-fields-automatically-fit-contents", "improve-text-layout-and-legibility", "forms", "accessible-error-announcement", "required-field-feedback", "validate-input-after-interaction", "identify-inp-causes", "schedule-tasks-by-priority", "optimize-preload-priority", "improve-next-page-load-performance", "interactions-in-complex-layouts", "performance", "visually-stable-font-fallbacks", "break-up-long-tasks", "identify-heavy-scripts", "optimize-script-priority", "defer-rendering-heavy-content", "defer-work-until-scroll-ends", "optimize-image-priority", "conditional-async-dependencies", "expose-canvas-content-to-browser-features", "move-dom-element-without-losing-state", "precise-text-alignment", "visually-stable-mixed-fonts", "css", "html", "reduce-style-repetition", "security", "privacy", "batch-analytics-events", "full-session-analytics", "calculate-total-foreground-time", "passkeys", "passkey-registration", "passkey-authentication", "passkey-reauthentication", "passkey-conditional-create", "passkey-management", "flicker-free-client-side-ab-testing", "consistent-cross-document-transitions", "stabilize-reactive-state", "resilient-context-menus-and-nested-dropdowns", "persistent-top-layer-ui", "detect-initial-visibility-state", "sequence-distributed-events", "translator", "language-detection", "support-global-calendar-systems", "capture-location-agnostic-data", "format-human-readable-durations", "manage-recurring-intervals", "calculate-event-differentials", "coordinate-global-events", "model-partial-time-concepts", "search-hidden-content", "select-menu-interaction", "style-parent-with-has", "autofill-address-form", "autofill-payment-form", "autofill-sign-in-form", "autofill-sign-up-form", "autofill-highlight-inputs", "deliver-optimized-decorative-images", "resolution-optimized-pseudo-elements", "deprioritize-background-fetches", "efficient-background-processing", "webmcp", "agentic-forms", "agentic-javascript-tools", "language-model", "summarizer" ], "artifacts": [ { "type": "other", "path": "evidence/challenge-controls.json", "caption": "challenge controls" }, { "type": "dom", "path": "evidence/challenge-dom.json", "caption": "challenge dom" }, { "type": "other", "path": "evidence/home-cookies.json", "caption": "home cookies" }, { "type": "screenshot", "path": "evidence/home-dark-reduced.png", "caption": "home dark reduced" }, { "type": "screenshot", "path": "evidence/home-desktop.png", "caption": "home desktop" }, { "type": "screenshot", "path": "evidence/home-discoverability-crawler.png", "caption": "home discoverability crawler" }, { "type": "screenshot", "path": "evidence/home-discoverability-rendered.png", "caption": "home discoverability rendered" }, { "type": "discoverability", "path": "evidence/home-discoverability.json", "caption": "home discoverability" }, { "type": "dom", "path": "evidence/home-dom.json", "caption": "home dom" }, { "type": "screenshot", "path": "evidence/home-forced-colors.png", "caption": "home forced colors" }, { "type": "other", "path": "evidence/home-headers.json", "caption": "home headers" }, { "type": "heap", "path": "evidence/home-heap-baseline.json", "caption": "home heap baseline" }, { "type": "heap", "path": "evidence/home-heap-post.json", "caption": "home heap post" }, { "type": "other", "path": "evidence/home-images.json", "caption": "home images" }, { "type": "screenshot", "path": "evidence/home-light.png", "caption": "home light" }, { "type": "lighthouse", "path": "evidence/home-lighthouse.json", "caption": "home lighthouse" }, { "type": "screenshot", "path": "evidence/home-menu-open.png", "caption": "home menu open" }, { "type": "layout", "path": "evidence/home-mobile-layout.json", "caption": "home mobile layout" }, { "type": "screenshot", "path": "evidence/home-mobile.png", "caption": "home mobile" }, { "type": "other", "path": "evidence/home-quality-probe.json", "caption": "home quality probe" }, { "type": "other", "path": "evidence/home-secrets.json", "caption": "home secrets" }, { "type": "har-summary", "path": "evidence/home-summary.json", "caption": "home summary" }, { "type": "screenshot", "path": "evidence/home-system-light.png", "caption": "home system light" }, { "type": "trace-summary", "path": "evidence/home-trace-summary.json", "caption": "home trace summary" }, { "type": "trace", "path": "evidence/home-trace.json", "caption": "home trace" }, { "type": "other", "path": "evidence/home-trackers.json", "caption": "home trackers" }, { "type": "har", "path": "evidence/home.har", "caption": "home" }, { "type": "other", "path": "evidence/motion-modern-css-probe.json", "caption": "motion modern css probe" }, { "type": "screenshot", "path": "evidence/not-found-mobile.png", "caption": "not found mobile" }, { "type": "other", "path": "evidence/not-found-probe.json", "caption": "not found probe" }, { "type": "screenshot", "path": "evidence/privacy-discoverability-crawler.png", "caption": "privacy discoverability crawler" }, { "type": "screenshot", "path": "evidence/privacy-discoverability-rendered.png", "caption": "privacy discoverability rendered" }, { "type": "discoverability", "path": "evidence/privacy-discoverability.json", "caption": "privacy discoverability" }, { "type": "dom", "path": "evidence/privacy-dom.json", "caption": "privacy dom" }, { "type": "lighthouse", "path": "evidence/privacy-lighthouse.json", "caption": "privacy lighthouse" }, { "type": "layout", "path": "evidence/privacy-mobile-layout.json", "caption": "privacy mobile layout" }, { "type": "screenshot", "path": "evidence/privacy-mobile.png", "caption": "privacy mobile" }, { "type": "other", "path": "evidence/resource-css-probe.json", "caption": "resource css probe" }, { "type": "other", "path": "evidence/routes-probe.json", "caption": "routes probe" }, { "type": "screenshot", "path": "evidence/search-after-challenge.png", "caption": "search after challenge" }, { "type": "dom", "path": "evidence/search-dom.json", "caption": "search dom" }, { "type": "dom", "path": "evidence/search-html-dom.json", "caption": "search html dom" }, { "type": "screenshot", "path": "evidence/search-html-mobile.png", "caption": "search html mobile" }, { "type": "layout", "path": "evidence/search-mobile-layout.json", "caption": "search mobile layout" }, { "type": "screenshot", "path": "evidence/search-mobile.png", "caption": "search mobile" }, { "type": "dom", "path": "evidence/settings-dom.json", "caption": "settings dom" }, { "type": "other", "path": "evidence/settings-quality-probe.json", "caption": "settings quality probe" }, { "type": "screenshot", "path": "evidence/settings.png", "caption": "settings" } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 56, "blocked": 2, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": false }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "pass", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "System light and dark screenshots show usable retinting; the root declares color-scheme and the explicit theme settings are also available.", "pathIds": [ "home", "settings", "privacy" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "pass", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "Under prefers-reduced-motion: reduce, getAnimations() returned none and CSS contains global and component-specific reduction rules.", "pathIds": [ "home", "settings", "privacy" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "pass", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "Forced-colors/prefers-contrast screenshot retained readable text and visible controls; Lighthouse found no contrast failure.", "pathIds": [ "home", "settings", "privacy" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "issues", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "The CSSOM probe found no view-transition rules and route changes use conventional navigation; no transition was visible in sampled states.", "pathIds": [ "home", "settings", "privacy" ], "findingIds": [ "F-13" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative route and interaction recon", "evidence": "No parallax, scrollytelling, entry reveal, or other scroll-linked animation was present on the sampled templates.", "reason": "No parallax, scrollytelling, entry reveal, or other scroll-linked animation was present on the sampled templates." }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "pass", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "Sampled scrolling and controls use native scrolling, touch-action, and overscroll containment; no custom pointer-drag implementation was observed.", "pathIds": [ "home", "settings", "privacy" ] }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative route and interaction recon", "evidence": "No sticky or affixed chrome requiring a scroll-state reaction was present in the sampled homepage/privacy states.", "reason": "No sticky or affixed chrome requiring a scroll-state reaction was present in the sampled homepage/privacy states." }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative route and interaction recon", "evidence": "No tooltip or edge-positioned transient overlay was exposed in the sampled states; the full-screen challenge is not an anchored overlay.", "reason": "No tooltip or edge-positioned transient overlay was exposed in the sampled states; the full-screen challenge is not an anchored overlay." }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "pass", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "The first viewport provides a labelled scroll-down control, clear Search/Duck.ai state, and settings tabs with visible selected state.", "pathIds": [ "home", "settings", "privacy" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "pass", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "Homepage, settings, and privacy initial screenshots show content directly with no promotional interstitial or consent wall.", "pathIds": [ "home", "settings", "privacy" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "issues", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "The challenge DOM is a .anomaly-modal__mask/.modal div tree without , role=dialog, aria-modal or an explicit accessible label.", "pathIds": [ "home", "settings", "privacy" ], "findingIds": [ "F-11" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "pass", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "First-viewport screenshots devote the composition to search/content with restrained navigation and no dense application frame.", "pathIds": [ "home", "settings", "privacy" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "pass", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "At 360px the homepage reported scrollWidth=clientWidth=360; /privacy likewise reported 390px with no overflow.", "pathIds": [ "home", "settings", "privacy" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "issues", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "A CSSOM probe found zero @container rules even though the homepage reuses search, cards, tabs and promotional modules at varied widths; viewport layouts themselves did reflow without overflow.", "pathIds": [ "home", "settings", "privacy" ], "findingIds": [ "F-12" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "issues", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "The focus/geometry probe measured the menu and search submit controls at 32×32 px, AI settings at 38×38 px, and toggle inner buttons at 18×18 px; focus indicators were generally present.", "pathIds": [ "home", "settings", "privacy" ], "findingIds": [ "F-16" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "pass", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "Homepage heading, privacy promise, and prominent labelled search field make purpose and primary action immediately clear.", "pathIds": [ "home", "settings", "privacy" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "blocked", "confidence": "high", "method": "Attempted primary search/failed-route journey in fresh CDP sessions", "evidence": "The submitted search loaded an external anti-bot image challenge. Selecting the visually identified duck tiles and submitting did not clear it, so end-to-end result completion could not be exercised.", "reason": "The submitted search loaded an external anti-bot image challenge. Selecting the visually identified duck tiles and submitting did not clear it, so end-to-end result completion could not be exercised.", "pathIds": [ "search" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "issues", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "Both JavaScript and HTML search paths stop at the visual duck puzzle. The JS state offers only Submit; the HTML fallback only offers an email code when images fail, not an immediate equivalent completion path.", "pathIds": [ "home", "settings", "privacy" ], "findingIds": [ "F-15" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "Lighthouse measured LCP at 6.2 s on the homepage and 7.9 s on the privacy page, both well outside the good threshold; performance scores were 69 and 73.", "pathIds": [ "home", "settings", "privacy" ], "findingIds": [ "F-02" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "pass", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "Observed homepage CLS was 0 and privacy CLS 0.0477, both in the good range; mobile screenshots show reserved stable layout.", "pathIds": [ "home", "settings", "privacy" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "pass", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "Trace found one 193.7ms long task and 143.7ms TBT; Lighthouse TBT was 160ms homepage/110ms privacy, within the good lab threshold though improvable.", "pathIds": [ "home", "settings", "privacy" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "HAR captured 108 requests and 2,028,477 transferred bytes, including 8 parser-inserted very-high-priority stylesheets and 585,909 font bytes; Lighthouse flags render blocking on the privacy template.", "pathIds": [ "home", "settings", "privacy" ], "findingIds": [ "F-03" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "Lighthouse estimates 117 KiB unused JavaScript and 21 KiB legacy JavaScript on the homepage, and 176 KiB unused plus 14 KiB legacy JavaScript on /privacy.", "pathIds": [ "home", "settings", "privacy" ], "findingIds": [ "F-04" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "issues", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "The search screenshot shows a required image-classification puzzle. The rendered DOM uses clickable div tiles with background images and no accessible names/roles; the HTML fallback uses images with alt=\" \". Search could not be completed.", "pathIds": [ "home", "settings", "privacy" ], "findingIds": [ "F-01" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "pass", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "Lighthouse accessibility was 98/100 homepage and 100/100 privacy with no contrast audit failure; visual checks remained legible in dark/light/forced colors.", "pathIds": [ "home", "settings", "privacy" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "issues", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "The DOM has two H1 elements and jumps from H3 to H6 (\"Get our free browser today\"); Lighthouse fails heading-order.", "pathIds": [ "home", "settings", "privacy" ], "findingIds": [ "F-06" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "pass", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "Homepage/settings/privacy screenshots show readable sizing, line length and spacing with no clipping at mobile width.", "pathIds": [ "home", "settings", "privacy" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "issues", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "Mobile layouts have no horizontal overflow and allow scaling, but the geometry probe finds multiple 18–38px controls on the primary homepage.", "pathIds": [ "home", "settings", "privacy" ], "findingIds": [ "F-17" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "pass", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "Lighthouse did not report console error or uncaught-exception failures on homepage or privacy.", "pathIds": [ "home", "settings", "privacy" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "issues", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "Lighthouse fails the image aspect-ratio audit. The image probe reports 51 of 67 images without both dimensions, although many are hidden/decorative and did not produce homepage CLS.", "pathIds": [ "home", "settings", "privacy" ], "findingIds": [ "F-05" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "pass", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "Lighthouse best-practices was 96/100 and 100/100; the only homepage failure was image aspect ratio, with no prompt-on-load, deprecation, or paste-prevention signal.", "pathIds": [ "home", "settings", "privacy" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "pass", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "Homepage, settings and privacy DOM captures each contain descriptive titles and meta descriptions.", "pathIds": [ "home", "settings", "privacy" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "issues", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "Lighthouse SEO reports 8 links with non-descriptive text.", "pathIds": [ "home", "settings", "privacy" ], "findingIds": [ "F-07" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "issues", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "The fetched sitemap includes lastmod 2025-03-282 for /about and an extra closing around /pro, making indexing signals unreliable.", "pathIds": [ "home", "settings", "privacy" ], "findingIds": [ "F-10" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "pass", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "Homepage, settings and privacy DOM include matching Open Graph title, description, URL and image metadata.", "pathIds": [ "home", "settings", "privacy" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "issues", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "The headers primitive confirms HTTPS, HSTS, nosniff and frame protections, but script-src includes unsafe-inline and unsafe-eval, weakening XSS mitigation.", "pathIds": [ "home", "settings", "privacy" ], "findingIds": [ "F-08" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "pass", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "Tracker probe found no known trackers, zero cookies, and HAR attributed only 4,951 bytes to third-party origin improving.duckduckgo.com.", "pathIds": [ "home", "settings", "privacy" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "pass", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "Permissions remained in prompt state and no geolocation/notification prompt appeared on load; no password authentication was present in sampled scope.", "pathIds": [ "home", "settings", "privacy" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "HSTS, X-Frame-Options, nosniff, Referrer-Policy and Permissions-Policy are present, but CSP allows unsafe-inline/unsafe-eval and no Trusted Types requirement was observed.", "pathIds": [ "home", "settings", "privacy" ], "findingIds": [ "F-18" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "issues", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "Discoverability measured only 2% raw-to-rendered content coverage and classified the homepage as a JS shell; /privacy reaches 100%, showing the content template can server-render.", "pathIds": [ "home", "settings", "privacy" ], "findingIds": [ "F-09" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "pass", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "The settings UI and anti-bot modal remained within mobile/desktop viewports, native controls retained state, and no runtime console failure was reported.", "pathIds": [ "home", "settings", "privacy" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative route and interaction recon", "evidence": "DuckDuckGo search is intrinsically network-dependent; an installable/offline search application is not a reasonable expectation for this public web surface.", "reason": "DuckDuckGo search is intrinsically network-dependent; an installable/offline search application is not a reasonable expectation for this public web surface." }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "blocked", "confidence": "high", "method": "Attempted primary search/failed-route journey in fresh CDP sessions", "evidence": "Attempts to reach search/result and unknown-route states were intercepted by the same anti-bot challenge, preventing observation of genuine result-network failure recovery.", "reason": "Attempts to reach search/result and unknown-route states were intercepted by the same anti-bot challenge, preventing observation of genuine result-network failure recovery.", "pathIds": [ "search" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "pass", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "Pages declare specific language values (en-US/en-GB), settings expose region and display-language controls, and sampled LTR layouts/read order remained coherent.", "pathIds": [ "home", "settings", "privacy" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative route and interaction recon", "evidence": "No user-facing dates, currencies, durations, or other locale-formatted data appeared on the sampled homepage, settings, privacy, or blocked search states.", "reason": "No user-facing dates, currencies, durations, or other locale-formatted data appeared on the sampled homepage, settings, privacy, or blocked search states." }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative route and interaction recon", "evidence": "No events, timestamps, scheduling, or time-zone-sensitive data appeared on the sampled templates.", "reason": "No events, timestamps, scheduling, or time-zone-sensitive data appeared on the sampled templates." }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "pass", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "No consent wall, forced continuity, disguised ad, preselected purchase, or confirmshaming appeared in homepage/settings/privacy states.", "pathIds": [ "home", "settings", "privacy" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "pass", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "The primary search input is a labelled required native input, so empty submission uses browser validation after interaction rather than premature custom blame.", "pathIds": [ "home", "settings", "privacy" ] }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "pass", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "The search field has an accessible label and appropriate text semantics; autocomplete=off is proportionate for a privacy search query rather than personal-data entry.", "pathIds": [ "home", "settings", "privacy" ] }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative route and interaction recon", "evidence": "No checkout, subscription purchase, authentication, or account-management journey was entered in the representative public search/settings/privacy scope.", "reason": "No checkout, subscription purchase, authentication, or account-management journey was entered in the representative public search/settings/privacy scope." }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "issues", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "The homepage transfers 2.03 MB: 512 KB images, 586 KB fonts and 781 KB scripts. The image probe reports 63 below-fold images without lazy loading and 23 legacy-format images.", "pathIds": [ "home", "settings", "privacy" ], "findingIds": [ "F-14" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "pass", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "HAR shows a very small third-party footprint, no known trackers, no autoplay media, and only two XHR/fetch requests in the capture.", "pathIds": [ "home", "settings", "privacy" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "issues", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "Fonts, images and scripts account for about 1.88 MB of 2.03 MB transferred; 63 below-fold images were present without lazy loading. Third-party transfer was low at 4,951 bytes.", "pathIds": [ "home", "settings", "privacy" ], "findingIds": [ "F-19" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative route and interaction recon", "evidence": "Agent-facing capabilities are emerging and optional; this public search/content scope does not declare an agent-tool integration intent.", "reason": "Agent-facing capabilities are emerging and optional; this public search/content scope does not declare an agent-tool integration intent." }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative route and interaction recon", "evidence": "No page feature in the sampled scope calls for on-device inference; absence is not a failure for this emerging contextual check.", "reason": "No page feature in the sampled scope calls for on-device inference; absence is not a failure for this emerging contextual check." }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "pass", "confidence": "medium", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "Baseline/post heap summaries around 10 repeated search-field input/focus cycles grew from 23.77MB to 24.42MB (2.7%); no unbounded growth is demonstrated in this bounded exercise.", "pathIds": [ "home", "settings", "privacy" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "pass", "confidence": "high", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "Baseline heap was 23.77MB across 394,468 nodes, proportionate to the rich homepage though not minimal.", "pathIds": [ "home", "settings", "privacy" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "pass", "confidence": "medium", "method": "Representative screenshots/DOM plus targeted runtime, Lighthouse, network, or layout evidence as applicable", "evidence": "Heap summaries did not surface a top Detached* constructor and the repeated bounded interaction produced only modest aggregate growth; no accumulating listener/timer symptom was observed.", "pathIds": [ "home", "settings", "privacy" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "pass" }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "issues", "findingIds": [ "F-13" ] }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "pass" }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "issues", "findingIds": [ "F-11" ] }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "issues", "findingIds": [ "F-12", "F-16" ] }, { "principleId": "support-core-task-success", "expectation": "default", "status": "issues", "findingIds": [ "F-15" ] }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F-02", "F-03", "F-04" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F-01", "F-06", "F-17" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "issues", "findingIds": [ "F-05" ] }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F-07", "F-10" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F-08", "F-18" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "issues", "findingIds": [ "F-09" ] }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "pass" }, { "principleId": "be-trustworthy", "expectation": "default", "status": "pass" }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F-14", "F-19" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "not-applicable", "reason": "Agent-facing capabilities are emerging and optional; this public search/content scope does not declare an agent-tool integration intent. No page feature in the sampled scope calls for on-device inference; absence is not a failure for this emerging contextual check." }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "pass" } ], "paths": [ { "id": "home", "description": "Homepage and primary search entry, representing landing, theming, responsive layout, network/performance and primary action.", "url": "https://duckduckgo.com/", "conditions": [ "desktop", "360x800 mobile", "prefers-color-scheme light/dark", "prefers-reduced-motion reduce", "forced-colors/prefers-contrast" ], "result": "issues" }, { "id": "search", "description": "Primary search-results journey using a representative query; bot challenge persisted after a manual visual solve attempt.", "url": "https://duckduckgo.com/?q=modern+web+guidance", "conditions": [ "390x844 mobile", "JavaScript client", "HTML fallback" ], "result": "failed" }, { "id": "settings", "description": "Interactive settings/form template covering localization, native controls, preferences and accountless cloud-save affordance.", "url": "https://duckduckgo.com/settings", "conditions": [ "desktop" ], "result": "pass" }, { "id": "privacy", "description": "Long-form public content template covering responsive reading, metadata, no-JS rendering and performance.", "url": "https://duckduckgo.com/privacy", "conditions": [ "390x844 mobile", "no JavaScript crawler view" ], "result": "issues" }, { "id": "failure", "description": "Unknown-route/network-recovery probe; server converted it into a search and the anti-bot gate blocked further recovery-state inspection.", "url": "https://duckduckgo.com/this-route-should-not-exist-web-uplift", "conditions": [ "390x844 mobile" ], "result": "failed" } ], "findings": [ { "id": "F-01", "severity": "high", "confidence": "high", "principleId": "be-inclusive", "principleCheckId": "names-roles-labels", "guidanceId": "accessibility", "summary": "The anti-bot challenge has no accessible non-visual completion path.", "evidence": "The search screenshot shows a required image-classification puzzle. The rendered DOM uses clickable div tiles with background images and no accessible names/roles; the HTML fallback uses images with alt=\" \". Search could not be completed.", "artifacts": [ "evidence/search-mobile.png", "evidence/challenge-dom.json", "evidence/search-html-dom.json" ], "suggestedFix": "Offer an equivalent non-visual verification method, give the challenge a labelled dialog structure, and expose each selectable option with an accessible name and state.", "effort": "large", "pathId": "search", "url": "https://duckduckgo.com/?q=modern+web+guidance" }, { "id": "F-02", "severity": "high", "confidence": "high", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "guidanceId": "performance", "summary": "Largest Contentful Paint is slow on both primary templates.", "evidence": "Lighthouse measured LCP at 6.2 s on the homepage and 7.9 s on the privacy page, both well outside the good threshold; performance scores were 69 and 73.", "artifacts": [ "evidence/home-lighthouse.json", "evidence/privacy-lighthouse.json", "evidence/home-trace-summary.json" ], "suggestedFix": "Prioritise the LCP resource, reduce render-blocking styles and font work, and defer below-fold application payloads.", "effort": "large", "pathId": "home", "url": "https://duckduckgo.com/" }, { "id": "F-03", "severity": "medium", "confidence": "high", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "guidanceId": "optimize-preload-priority", "summary": "The homepage has a heavy critical delivery path.", "evidence": "HAR captured 108 requests and 2,028,477 transferred bytes, including 8 parser-inserted very-high-priority stylesheets and 585,909 font bytes; Lighthouse flags render blocking on the privacy template.", "artifacts": [ "evidence/home.har", "evidence/home-summary.json", "evidence/privacy-lighthouse.json" ], "suggestedFix": "Consolidate and inline only critical CSS, reduce font families/weights, preload only the actual LCP dependencies, and defer non-critical styles.", "effort": "large", "pathId": "home", "url": "https://duckduckgo.com/" }, { "id": "F-04", "severity": "medium", "confidence": "high", "principleId": "be-fast-and-stable", "principleCheckId": "trim-unused-and-duplicate-code", "guidanceId": "identify-heavy-scripts", "summary": "Substantial unused and legacy JavaScript ships on initial load.", "evidence": "Lighthouse estimates 117 KiB unused JavaScript and 21 KiB legacy JavaScript on the homepage, and 176 KiB unused plus 14 KiB legacy JavaScript on /privacy.", "artifacts": [ "evidence/home-lighthouse.json", "evidence/privacy-lighthouse.json" ], "suggestedFix": "Route-split page code, remove unnecessary polyfills for the supported Baseline, and load below-fold/interactive modules on demand.", "effort": "large", "pathId": "home", "url": "https://duckduckgo.com/" }, { "id": "F-05", "severity": "medium", "confidence": "high", "principleId": "follow-best-practices", "principleCheckId": "sound-document-and-assets", "guidanceId": "html", "summary": "Some images are rendered with incorrect aspect ratios and weak sizing metadata.", "evidence": "Lighthouse fails the image aspect-ratio audit. The image probe reports 51 of 67 images without both dimensions, although many are hidden/decorative and did not produce homepage CLS.", "artifacts": [ "evidence/home-lighthouse.json", "evidence/home-images.json" ], "suggestedFix": "Give rendered images intrinsic width/height or aspect-ratio matching the source and remove hidden duplicate image markup from the initial DOM.", "effort": "medium", "pathId": "home", "url": "https://duckduckgo.com/" }, { "id": "F-06", "severity": "medium", "confidence": "high", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "guidanceId": "accessibility", "summary": "Homepage heading levels do not form a coherent hierarchy.", "evidence": "The DOM has two H1 elements and jumps from H3 to H6 (\"Get our free browser today\"); Lighthouse fails heading-order.", "artifacts": [ "evidence/home-quality-probe.json", "evidence/home-lighthouse.json" ], "suggestedFix": "Use one page H1 and assign section headings by document hierarchy rather than visual size.", "effort": "small", "pathId": "home", "url": "https://duckduckgo.com/" }, { "id": "F-07", "severity": "low", "confidence": "high", "principleId": "be-discoverable", "principleCheckId": "crawlable-and-mobile-friendly", "guidanceId": "html", "summary": "Several homepage links do not provide descriptive link text.", "evidence": "Lighthouse SEO reports 8 links with non-descriptive text.", "artifacts": [ "evidence/home-lighthouse.json" ], "suggestedFix": "Give each link concise visible or accessible text that describes its destination without surrounding context.", "effort": "small", "pathId": "home", "url": "https://duckduckgo.com/" }, { "id": "F-08", "severity": "medium", "confidence": "high", "principleId": "be-private-and-secure", "principleCheckId": "secure-transport-and-headers", "guidanceId": "security", "summary": "The CSP permits both unsafe-inline and unsafe-eval for scripts.", "evidence": "The headers primitive confirms HTTPS, HSTS, nosniff and frame protections, but script-src includes unsafe-inline and unsafe-eval, weakening XSS mitigation.", "artifacts": [ "evidence/home-headers.json" ], "suggestedFix": "Move inline code to nonce/hash-authorised scripts, remove eval-dependent code, and adopt a strict nonce-based CSP with Trusted Types where applicable.", "effort": "large", "pathId": "home", "url": "https://duckduckgo.com/" }, { "id": "F-09", "severity": "high", "confidence": "high", "principleId": "be-resilient", "principleCheckId": "progressive-enhancement", "guidanceId": "stabilize-reactive-state", "summary": "The homepage’s substantive content is largely unavailable without JavaScript.", "evidence": "Discoverability measured only 2% raw-to-rendered content coverage and classified the homepage as a JS shell; /privacy reaches 100%, showing the content template can server-render.", "artifacts": [ "evidence/home-discoverability.json", "evidence/home-discoverability-rendered.png", "evidence/home-discoverability-crawler.png", "evidence/privacy-discoverability.json" ], "suggestedFix": "Server-render the homepage’s meaningful headings, copy, navigation and primary search form, then hydrate optional interactions progressively.", "effort": "large", "pathId": "home", "url": "https://duckduckgo.com/" }, { "id": "F-10", "severity": "low", "confidence": "high", "principleId": "be-discoverable", "principleCheckId": "canonical-and-indexing-signals", "guidanceId": "html", "summary": "The published sitemap contains malformed and mistyped entries.", "evidence": "The fetched sitemap includes lastmod 2025-03-282 for /about and an extra closing around /pro, making indexing signals unreliable.", "artifacts": [ "evidence/routes-probe.json" ], "suggestedFix": "Generate sitemap.xml from validated route data, emit valid ISO dates, and validate the XML in CI.", "effort": "trivial", "pathId": "home", "url": "https://duckduckgo.com/sitemap.xml" }, { "id": "F-11", "severity": "medium", "confidence": "high", "principleId": "maximize-content-reduce-noise", "principleCheckId": "semantic-dismissible-primitives", "guidanceId": "declarative-dialog-popover-control", "summary": "The blocking anti-bot overlay is custom div markup rather than a semantic modal primitive.", "evidence": "The challenge DOM is a .anomaly-modal__mask/.modal div tree without , role=dialog, aria-modal or an explicit accessible label.", "artifacts": [ "evidence/search-mobile.png", "evidence/challenge-dom.json" ], "suggestedFix": "Implement the challenge with (or an equivalent correctly labelled modal pattern), trap and restore focus, and provide a clear escape/recovery path.", "effort": "medium", "pathId": "search", "url": "https://duckduckgo.com/?q=modern+web+guidance" }, { "id": "F-12", "severity": "low", "confidence": "medium", "principleId": "adapt-to-the-form-factor", "principleCheckId": "component-level-responsiveness", "guidanceId": "size-aware-styling", "summary": "No container-query adaptation was found in the homepage component styles.", "evidence": "A CSSOM probe found zero @container rules even though the homepage reuses search, cards, tabs and promotional modules at varied widths; viewport layouts themselves did reflow without overflow.", "artifacts": [ "evidence/resource-css-probe.json", "evidence/home-mobile-layout.json" ], "suggestedFix": "Use container-type and targeted @container rules for reusable modules whose composition depends on available component width.", "effort": "medium", "pathId": "home", "url": "https://duckduckgo.com/" }, { "id": "F-13", "severity": "low", "confidence": "medium", "principleId": "implement-natural-interactions", "principleCheckId": "view-transitions", "guidanceId": "same-document-transitions", "summary": "No View Transition integration was found for state or route changes.", "evidence": "The CSSOM probe found no view-transition rules and route changes use conventional navigation; no transition was visible in sampled states.", "artifacts": [ "evidence/motion-modern-css-probe.json", "evidence/resource-css-probe.json" ], "suggestedFix": "Add same-document transitions for major state changes and cross-document view transitions for compatible first-party routes, while preserving reduced-motion handling.", "effort": "medium", "pathId": "home", "url": "https://duckduckgo.com/" }, { "id": "F-14", "severity": "medium", "confidence": "high", "principleId": "be-sustainable", "principleCheckId": "optimised-assets", "guidanceId": "deliver-optimized-decorative-images", "summary": "Initial resource weight is disproportionate for a search landing page.", "evidence": "The homepage transfers 2.03 MB: 512 KB images, 586 KB fonts and 781 KB scripts. The image probe reports 63 below-fold images without lazy loading and 23 legacy-format images.", "artifacts": [ "evidence/home-summary.json", "evidence/home-images.json" ], "suggestedFix": "Do not load below-fold promotional media until near viewport, use responsive AVIF/WebP sources, subset fonts, and set a landing-page transfer budget.", "effort": "large", "pathId": "home", "url": "https://duckduckgo.com/" }, { "id": "F-15", "severity": "high", "confidence": "high", "principleId": "support-core-task-success", "principleCheckId": "clear-system-state-and-recovery", "guidanceId": "accessible-error-announcement", "summary": "The bot-block state gives no accessible way to recover and complete search.", "evidence": "Both JavaScript and HTML search paths stop at the visual duck puzzle. The JS state offers only Submit; the HTML fallback only offers an email code when images fail, not an immediate equivalent completion path.", "artifacts": [ "evidence/search-mobile.png", "evidence/search-html-dom.json" ], "suggestedFix": "Provide a keyboard and screen-reader operable alternative, a retry/support path, and preserve the submitted query through recovery.", "effort": "large", "pathId": "search", "url": "https://duckduckgo.com/?q=modern+web+guidance" }, { "id": "F-16", "severity": "medium", "confidence": "high", "principleId": "adapt-to-the-form-factor", "principleCheckId": "input-modality-aware", "guidanceId": "accessibility", "summary": "Several primary controls have sub-44px touch targets.", "evidence": "The focus/geometry probe measured the menu and search submit controls at 32×32 px, AI settings at 38×38 px, and toggle inner buttons at 18×18 px; focus indicators were generally present.", "artifacts": [ "evidence/home-quality-probe.json", "evidence/home-mobile.png" ], "suggestedFix": "Expand interactive hit areas to at least 44×44 CSS px without enlarging icons, and retain the visible focus treatment.", "effort": "small", "pathId": "home", "url": "https://duckduckgo.com/" }, { "id": "F-17", "severity": "medium", "confidence": "high", "principleId": "be-inclusive", "principleCheckId": "zoom-reflow-targets-and-media", "guidanceId": "accessibility", "summary": "Touch target sizing falls short despite otherwise good mobile reflow.", "evidence": "Mobile layouts have no horizontal overflow and allow scaling, but the geometry probe finds multiple 18–38px controls on the primary homepage.", "artifacts": [ "evidence/home-quality-probe.json", "evidence/home-mobile-layout.json" ], "suggestedFix": "Increase the clickable area around icon controls to 44×44 CSS px and verify spacing at 200% zoom.", "effort": "small", "pathId": "home", "url": "https://duckduckgo.com/" }, { "id": "F-18", "severity": "medium", "confidence": "high", "principleId": "be-private-and-secure", "principleCheckId": "defensive-browser-policies", "guidanceId": "security", "summary": "Strong baseline headers are undermined by permissive script execution policy.", "evidence": "HSTS, X-Frame-Options, nosniff, Referrer-Policy and Permissions-Policy are present, but CSP allows unsafe-inline/unsafe-eval and no Trusted Types requirement was observed.", "artifacts": [ "evidence/home-headers.json" ], "suggestedFix": "Tighten script-src with nonces/hashes, remove unsafe-eval, and add require-trusted-types-for script after compatibility testing.", "effort": "large", "pathId": "home", "url": "https://duckduckgo.com/" }, { "id": "F-19", "severity": "medium", "confidence": "high", "principleId": "be-sustainable", "principleCheckId": "third-party-and-media-budget", "guidanceId": "deprioritize-background-fetches", "summary": "Below-fold media and fonts consume most of the landing-page transfer budget up front.", "evidence": "Fonts, images and scripts account for about 1.88 MB of 2.03 MB transferred; 63 below-fold images were present without lazy loading. Third-party transfer was low at 4,951 bytes.", "artifacts": [ "evidence/home-summary.json", "evidence/home-images.json" ], "suggestedFix": "Lazy-load or conditionally import below-fold promotional modules and media; retain the current low third-party footprint.", "effort": "large", "pathId": "home", "url": "https://duckduckgo.com/" } ], "taskList": [ { "id": "T-01", "title": "Make anti-bot verification accessible and recoverable", "priority": 1, "findingIds": [ "F-01", "F-11", "F-15" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T-02", "title": "Fix LCP and reduce the critical request/font/style path", "priority": 2, "findingIds": [ "F-02", "F-03" ], "guidanceId": "optimize-preload-priority", "status": "open" }, { "id": "T-03", "title": "Server-render meaningful homepage content and the core search form", "priority": 3, "findingIds": [ "F-09" ], "guidanceId": "stabilize-reactive-state", "status": "open" }, { "id": "T-04", "title": "Lazy-load below-fold media and trim initial JavaScript/font weight", "priority": 4, "findingIds": [ "F-04", "F-14", "F-19" ], "guidanceId": "identify-heavy-scripts", "status": "open" }, { "id": "T-05", "title": "Replace unsafe CSP script allowances with nonces/hashes", "priority": 5, "findingIds": [ "F-08", "F-18" ], "guidanceId": "security", "status": "open" }, { "id": "T-06", "title": "Correct heading hierarchy, image sizing and link names", "priority": 6, "findingIds": [ "F-05", "F-06", "F-07" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T-07", "title": "Increase icon-control touch targets", "priority": 7, "findingIds": [ "F-16", "F-17" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T-08", "title": "Validate sitemap generation", "priority": 8, "findingIds": [ "F-10" ], "guidanceId": "html", "status": "open" }, { "id": "T-09", "title": "Adopt component queries and View Transitions where they improve reused UI", "priority": 9, "findingIds": [ "F-12", "F-13" ], "guidanceId": "size-aware-styling", "status": "open" } ], "budget": { "pathCount": 5, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-27T16-45-31-267Z" }