{ "url": "https://www.nu.nl", "auditedAt": "2026-07-18T23:17:26.382Z", "mode": "report", "status": "completed", "statusDetail": "Coverage-complete remote audit of four representative public-news templates plus a failure route. The privacy gate was included as part of the fresh-session journey.", "page": { "appType": "hybrid", "framework": "Vue-like client-rendered application (framework not conclusively fingerprinted)", "notes": "Dutch national news publication. Public content is rendered client-side after a privacy-gate redirect; core reading paths are homepage, section listing, search results, and article." }, "evidenceUsed": [ "screenshot", "dom", "evaluate-probe", "layout-metrics", "trace", "har", "discoverability", "headers", "cookies", "trackers", "secrets", "images", "heap-summary", "lighthouse" ], "guidanceConsulted": [ "dark-mode", "component-specific-light-dark-theme", "accessibility", "adapt-scrollbar-to-contrast-preferences", "same-document-transitions", "cross-document-transitions", "group-element-transitions", "faster-spa-view-transitions", "scrollytelling", "parallax-scroll-effects", "scroll-entry-exit-effects", "carousel-slide-effects", "physics-based-easing", "individual-transform-properties", "animate-element-entry-exit", "animate-to-from-top-layer", "animate-to-intrinsic-sizes", "dynamic-sibling-animations", "interactive-content-reveal", "pull-to-reveal", "swipe-to-remove", "shrinking-header-on-scroll", "scroll-progress-indicator", "scroll-position-aware-elements", "scroll-snap-realtime-feedback", "scroll-snap-state-sync", "scroll-target-on-load", "soft-edge-content-fade", "scrollability-affordance-hints", "anchor-positioning-tab-underline", "position-aware-tooltips", "interest-triggered-tooltips", "interest-triggered-action-previews", "directional-navigation-transitions", "carousel-snap-highlights", "navigation-drawer", "stack-drill-down", "persistent-app-tours", "persistent-toast-notifications", "light-dismiss-a-dialog", "platform-controls-dismiss-dialog", "declarative-dialog-popover-control", "animated-select-picker", "branded-select-styling", "brand-consistent-forms", "custom-select-picker-layouts", "rich-media-picker", "complex-shapes", "shaped-cutouts", "overflow-clipping-control", "visually-texture-content", "apply-webgl-shaders", "interactive-content-in-3d-scenes", "highlight-text-ranges", "prevent-text-wrapping", "customize-scrollbar-color-and-thickness", "export-html-media-from-canvas", "fluid-scaling", "calculate-with-intrinsic-sizes", "css-layout", "size-aware-styling", "content-based-styling", "child-state-based-styling", "design-token-reactivity", "dynamic-sibling-styling", "form-fields-automatically-fit-contents", "improve-text-layout-and-legibility", "forms", "accessible-error-announcement", "required-field-feedback", "validate-input-after-interaction", "identify-inp-causes", "schedule-tasks-by-priority", "optimize-preload-priority", "improve-next-page-load-performance", "interactions-in-complex-layouts", "performance", "visually-stable-font-fallbacks", "break-up-long-tasks", "identify-heavy-scripts", "optimize-script-priority", "defer-rendering-heavy-content", "defer-work-until-scroll-ends", "optimize-image-priority", "conditional-async-dependencies", "expose-canvas-content-to-browser-features", "move-dom-element-without-losing-state", "precise-text-alignment", "visually-stable-mixed-fonts", "css", "html", "reduce-style-repetition", "security", "privacy", "batch-analytics-events", "full-session-analytics", "calculate-total-foreground-time", "passkeys", "passkey-registration", "passkey-authentication", "passkey-reauthentication", "passkey-conditional-create", "passkey-management", "flicker-free-client-side-ab-testing", "consistent-cross-document-transitions", "stabilize-reactive-state", "resilient-context-menus-and-nested-dropdowns", "persistent-top-layer-ui", "detect-initial-visibility-state", "sequence-distributed-events", "translator", "language-detection", "support-global-calendar-systems", "capture-location-agnostic-data", "format-human-readable-durations", "manage-recurring-intervals", "calculate-event-differentials", "coordinate-global-events", "model-partial-time-concepts", "search-hidden-content", "select-menu-interaction", "style-parent-with-has", "autofill-address-form", "autofill-payment-form", "autofill-sign-in-form", "autofill-sign-up-form", "autofill-highlight-inputs", "deliver-optimized-decorative-images", "resolution-optimized-pseudo-elements", "deprioritize-background-fetches", "efficient-background-processing", "webmcp", "agentic-forms", "agentic-javascript-tools", "language-model", "summarizer" ], "artifacts": [ { "type": "other", "path": "evidence/404-state.json", "caption": "404 state", "findingIds": [ "F07", "F18" ] }, { "type": "screenshot", "path": "evidence/404.png", "caption": "404", "findingIds": [ "F07", "F18" ] }, { "type": "other", "path": "evidence/a11y-structure.json", "caption": "a11y structure", "findingIds": [ "F05" ] }, { "type": "other", "path": "evidence/api-key-context.json", "caption": "api key context", "findingIds": [] }, { "type": "screenshot", "path": "evidence/article-desktop.png", "caption": "article desktop", "findingIds": [ "F02", "F23" ] }, { "type": "screenshot", "path": "evidence/article-discoverability-crawler.png", "caption": "article discoverability crawler", "findingIds": [] }, { "type": "screenshot", "path": "evidence/article-discoverability-rendered.png", "caption": "article discoverability rendered", "findingIds": [] }, { "type": "discoverability", "path": "evidence/article-discoverability.json", "caption": "article discoverability", "findingIds": [ "F13", "F17" ] }, { "type": "dom", "path": "evidence/article-dom.json", "caption": "article dom", "findingIds": [] }, { "type": "other", "path": "evidence/article-metadata.json", "caption": "article metadata", "findingIds": [] }, { "type": "screenshot", "path": "evidence/category-desktop.png", "caption": "category desktop", "findingIds": [] }, { "type": "dom", "path": "evidence/category-dom.json", "caption": "category dom", "findingIds": [ "F24" ] }, { "type": "other", "path": "evidence/focus-targets.json", "caption": "focus targets", "findingIds": [ "F06", "F24" ] }, { "type": "heap", "path": "evidence/heap-baseline.json", "caption": "heap baseline", "findingIds": [ "F21", "F22" ] }, { "type": "heap", "path": "evidence/heap-post.json", "caption": "heap post", "findingIds": [ "F21" ] }, { "type": "other", "path": "evidence/home-cookies.json", "caption": "home cookies", "findingIds": [ "F14", "F15" ] }, { "type": "screenshot", "path": "evidence/home-dark.png", "caption": "home dark", "condition": "prefers-color-scheme: dark", "findingIds": [ "F01" ] }, { "type": "screenshot", "path": "evidence/home-desktop.png", "caption": "home desktop", "findingIds": [ "F02", "F23" ] }, { "type": "screenshot", "path": "evidence/home-discoverability-crawler.png", "caption": "home discoverability crawler", "findingIds": [] }, { "type": "screenshot", "path": "evidence/home-discoverability-rendered.png", "caption": "home discoverability rendered", "findingIds": [] }, { "type": "discoverability", "path": "evidence/home-discoverability.json", "caption": "home discoverability", "findingIds": [ "F13", "F17" ] }, { "type": "dom", "path": "evidence/home-dom.json", "caption": "home dom", "findingIds": [] }, { "type": "other", "path": "evidence/home-headers.json", "caption": "home headers", "findingIds": [ "F14", "F16" ] }, { "type": "other", "path": "evidence/home-images.json", "caption": "home images", "findingIds": [ "F05", "F10", "F19" ] }, { "type": "lighthouse", "path": "evidence/home-lighthouse.json", "caption": "home lighthouse", "findingIds": [ "F08", "F11", "F12", "F24" ] }, { "type": "layout", "path": "evidence/home-mobile-layout.json", "caption": "home mobile layout", "condition": "viewport 360x800", "findingIds": [ "F10" ] }, { "type": "screenshot", "path": "evidence/home-mobile.png", "caption": "home mobile", "condition": "viewport 360x800", "findingIds": [ "F02", "F04" ] }, { "type": "other", "path": "evidence/home-preferences.json", "caption": "home preferences", "findingIds": [ "F01", "F04" ] }, { "type": "other", "path": "evidence/home-recon.json", "caption": "home recon", "findingIds": [] }, { "type": "other", "path": "evidence/home-secrets.json", "caption": "home secrets", "findingIds": [] }, { "type": "har-summary", "path": "evidence/home-summary.json", "caption": "home summary", "findingIds": [ "F09", "F11", "F15", "F20" ] }, { "type": "trace-summary", "path": "evidence/home-trace-summary.json", "caption": "home trace summary", "findingIds": [ "F08" ] }, { "type": "trace", "path": "evidence/home-trace.json", "caption": "home trace", "findingIds": [] }, { "type": "other", "path": "evidence/home-trackers.json", "caption": "home trackers", "findingIds": [ "F15", "F20" ] }, { "type": "har", "path": "evidence/home.har", "caption": "home", "findingIds": [ "F09" ] }, { "type": "other", "path": "evidence/indexing.json", "caption": "indexing", "findingIds": [ "F13" ] }, { "type": "other", "path": "evidence/memory-metrics.json", "caption": "memory metrics", "findingIds": [ "F21" ] }, { "type": "other", "path": "evidence/overlay-semantics.json", "caption": "overlay semantics", "findingIds": [ "F03" ] }, { "type": "other", "path": "evidence/platform-hygiene.json", "caption": "platform hygiene", "findingIds": [ "F09" ] }, { "type": "screenshot", "path": "evidence/search-desktop.png", "caption": "search desktop", "findingIds": [] }, { "type": "other", "path": "evidence/search-recon.json", "caption": "search recon", "findingIds": [ "F24" ] } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 58, "blocked": 0, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": true }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "issues", "confidence": "high", "method": "Representative screenshots, rendered DOM, computed-style and interaction probes across homepage/listing/article/search", "evidence": "The dark-emulated screenshot is pixel-identical to the light capture; the preference probe reports color-scheme normal and body background rgb(255,255,255).", "pathIds": [ "home", "category", "article", "search" ], "findingIds": [ "F01" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "pass", "confidence": "high", "method": "Representative screenshots, rendered DOM, computed-style and interaction probes across homepage/listing/article/search", "evidence": "Reduced-motion emulation was active; getAnimations() returned no running page animations, so no non-essential motion persisted in the sampled load state.", "pathIds": [ "home", "category", "article", "search" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "pass", "confidence": "high", "method": "Representative screenshots, rendered DOM, computed-style and interaction probes across homepage/listing/article/search", "evidence": "High-contrast emulation was active and screenshots/probes retained dark text and clearly outlined controls; Lighthouse contrast audit scored 1.", "pathIds": [ "home", "category", "article", "search" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "pass", "confidence": "medium", "method": "Representative screenshots, rendered DOM, computed-style and interaction probes across homepage/listing/article/search", "evidence": "CSS inspection found view-transition rules, and tested navigational surfaces remained coherent rather than showing a broken intermediate state.", "pathIds": [ "home", "category", "article", "search" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "not-applicable", "confidence": "medium", "method": "Representative screenshots, rendered DOM, computed-style and interaction probes across homepage/listing/article/search", "evidence": "No parallax, scrollytelling, or scroll-linked reveal was observed on the four representative templates, so there is no scroll-linked motion implementation to judge.", "pathIds": [ "home", "category", "article", "search" ], "reason": "No parallax, scrollytelling, or scroll-linked reveal was observed on the four representative templates, so there is no scroll-linked motion implementation to judge." }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "not-applicable", "confidence": "medium", "method": "Representative screenshots, rendered DOM, computed-style and interaction probes across homepage/listing/article/search", "evidence": "No custom swipe, pull-to-reveal, carousel drag, or other gesture-driven primary interaction was present on the exercised news reading paths.", "pathIds": [ "home", "category", "article", "search" ], "reason": "No custom swipe, pull-to-reveal, carousel drag, or other gesture-driven primary interaction was present on the exercised news reading paths." }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "pass", "confidence": "high", "method": "Representative screenshots, rendered DOM, computed-style and interaction probes across homepage/listing/article/search", "evidence": "Screenshots and DOM show a persistent, compact fixed header and clear current-section state across homepage, listing and article.", "pathIds": [ "home", "category", "article", "search" ] }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "not-applicable", "confidence": "medium", "method": "Representative screenshots, rendered DOM, computed-style and interaction probes across homepage/listing/article/search", "evidence": "No tooltip, anchored popover, or edge-positioned menu requiring anchor positioning was present in the exercised paths; the load-time interruption is a modal and judged separately.", "pathIds": [ "home", "category", "article", "search" ], "reason": "No tooltip, anchored popover, or edge-positioned menu requiring anchor positioning was present in the exercised paths; the load-time interruption is a modal and judged separately." }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "pass", "confidence": "high", "method": "Representative screenshots, rendered DOM, computed-style and interaction probes across homepage/listing/article/search", "evidence": "Representative navigation uses descriptive links, active-section colour, a skip link, and a prominent article hero to preserve orientation.", "pathIds": [ "home", "category", "article", "search" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "issues", "confidence": "high", "method": "Representative screenshots, rendered DOM, computed-style and interaction probes across homepage/listing/article/search", "evidence": "Desktop, mobile, homepage, and article screenshots show a centered notification modal covering the lead story before interaction.", "pathIds": [ "home", "category", "article", "search" ], "findingIds": [ "F02" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "issues", "confidence": "high", "method": "Representative screenshots, rendered DOM, computed-style and interaction probes across homepage/listing/article/search", "evidence": "The overlay probe finds a DIV role=button with aria-modal=true; there is no dialog element and no role=dialog.", "pathIds": [ "home", "category", "article", "search" ], "findingIds": [ "F03" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "issues", "confidence": "high", "method": "Representative screenshots, rendered DOM, computed-style and interaction probes across homepage/listing/article/search", "evidence": "Desktop screenshots devote roughly the first 150px below navigation to empty reserved space before the lead story, while the notification overlay further obscures content.", "pathIds": [ "home", "category", "article", "search" ], "findingIds": [ "F23" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "pass", "confidence": "high", "method": "Mobile layout/screenshots, Lighthouse accessibility audits, DOM structure and active-focus probes", "evidence": "At 360x800 the layout primitive measured scrollWidth=clientWidth=360 and zero horizontal overflow; viewport meta is present.", "pathIds": [ "home", "category", "article", "search" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "issues", "confidence": "high", "method": "Mobile layout/screenshots, Lighthouse accessibility audits, DOM structure and active-focus probes", "evidence": "The preference/CSS probe found no @container rules, despite cards and navigation being reused across wide and narrow columns.", "pathIds": [ "home", "category", "article", "search" ], "findingIds": [ "F04" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "issues", "confidence": "high", "method": "Mobile layout/screenshots, Lighthouse accessibility audits, DOM structure and active-focus probes", "evidence": "The active-focus probe found no outline or box-shadow on most sampled links/buttons, including logo, top navigation, menu, and article links; several top-nav targets are only 14-16px high.", "pathIds": [ "home", "category", "article", "search" ], "findingIds": [ "F06" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "pass", "confidence": "high", "method": "Representative screenshots, rendered DOM, computed-style and interaction probes across homepage/listing/article/search", "evidence": "Homepage, category, search, and article screenshots make news reading and article selection immediately understandable with descriptive headings/links.", "pathIds": [ "home", "category", "article", "search" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "pass", "confidence": "high", "method": "Representative screenshots, rendered DOM, computed-style and interaction probes across homepage/listing/article/search", "evidence": "The representative flow from homepage headline to a complete article loaded successfully without an account wall.", "pathIds": [ "home", "category", "article", "search" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "issues", "confidence": "high", "method": "Representative screenshots, rendered DOM, computed-style and interaction probes across homepage/listing/article/search", "evidence": "The exercised unknown URL says the page could not load but exposes no retry, home, search, or relevant-content links in main.", "pathIds": [ "home", "category", "article", "search" ], "findingIds": [ "F07" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "high", "method": "Trace, HAR summary, image audit, layout observation, Lighthouse, and screenshots", "evidence": "Trace recorded FCP 2.78s, LCP 5.58s, four long tasks, longest 452ms, and 808ms total blocking time. Lighthouse on the mandatory privacy-gate journey corroborated 3.9s LCP.", "pathIds": [ "home", "category", "article", "search" ], "findingIds": [ "F08" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "issues", "confidence": "high", "method": "Trace, HAR summary, image audit, layout observation, Lighthouse, and screenshots", "evidence": "The image primitive reports all 100 inspected images lack width and height attributes; Lighthouse also flags unsized images, even though the short layout observation saw CLS 0.", "pathIds": [ "home", "category", "article", "search" ], "findingIds": [ "F10" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "issues", "confidence": "high", "method": "Trace, HAR summary, image audit, layout observation, Lighthouse, and screenshots", "evidence": "Trace recorded FCP 2.78s, LCP 5.58s, four long tasks, longest 452ms, and 808ms total blocking time. Lighthouse on the mandatory privacy-gate journey corroborated 3.9s LCP.", "pathIds": [ "home", "category", "article", "search" ], "findingIds": [ "F08" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "Trace, HAR summary, image audit, layout observation, Lighthouse, and screenshots", "evidence": "HAR captured 191 requests and 2.57MB transferred, including 1.57MB script and 1.80MB from third-party origins; two classic head scripts are parser-blocking.", "pathIds": [ "home", "category", "article", "search" ], "findingIds": [ "F09" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "high", "method": "Trace, HAR summary, image audit, layout observation, Lighthouse, and screenshots", "evidence": "HAR recorded 61 scripts and 1.57MB script transfer; Lighthouse estimates 58KiB unused JavaScript, while advertising and experimentation bundles are among the largest resources.", "pathIds": [ "home", "category", "article", "search" ], "findingIds": [ "F11" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "issues", "confidence": "high", "method": "Mobile layout/screenshots, Lighthouse accessibility audits, DOM structure and active-focus probes", "evidence": "The DOM probe found four unnamed controls, including search/settings and carousel arrows; the image audit found three missing alt values in its loaded sample.", "pathIds": [ "home", "category", "article", "search" ], "findingIds": [ "F05" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "pass", "confidence": "high", "method": "Mobile layout/screenshots, Lighthouse accessibility audits, DOM structure and active-focus probes", "evidence": "Lighthouse color-contrast audit scored 1 and visual screenshots show legible text/control contrast on the sampled surfaces.", "pathIds": [ "home", "category", "article", "search" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "issues", "confidence": "high", "method": "Mobile layout/screenshots, Lighthouse accessibility audits, DOM structure and active-focus probes", "evidence": "The category and search templates expose no h1; the focus probe shows most controls without a visible focus style. Lighthouse also found invalid heading order on the consent journey.", "pathIds": [ "home", "category", "article", "search" ], "findingIds": [ "F24" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "pass", "confidence": "high", "method": "Mobile layout/screenshots, Lighthouse accessibility audits, DOM structure and active-focus probes", "evidence": "Article screenshot shows readable line length, spacing, and hierarchy without clipping at the tested viewport.", "pathIds": [ "home", "category", "article", "search" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "issues", "confidence": "high", "method": "Mobile layout/screenshots, Lighthouse accessibility audits, DOM structure and active-focus probes", "evidence": "The active-focus probe found no outline or box-shadow on most sampled links/buttons, including logo, top navigation, menu, and article links; several top-nav targets are only 14-16px high.", "pathIds": [ "home", "category", "article", "search" ], "findingIds": [ "F06" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "pass", "confidence": "high", "method": "Representative screenshots, rendered DOM, computed-style and interaction probes across homepage/listing/article/search", "evidence": "Lighthouse errors-in-console audit scored 1 with an empty details list.", "pathIds": [ "home", "category", "article", "search" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "issues", "confidence": "high", "method": "Representative screenshots, rendered DOM, computed-style and interaction probes across homepage/listing/article/search", "evidence": "The image primitive reports all 100 inspected images lack width and height attributes; Lighthouse also flags unsized images, even though the short layout observation saw CLS 0.", "pathIds": [ "home", "category", "article", "search" ], "findingIds": [ "F10" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "issues", "confidence": "high", "method": "Representative screenshots, rendered DOM, computed-style and interaction probes across homepage/listing/article/search", "evidence": "Lighthouse reports a cookie issue and three BFCache blockers on the privacy-gate journey; a third-party source map also returns 404.", "pathIds": [ "home", "category", "article", "search" ], "findingIds": [ "F12" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "pass", "confidence": "high", "method": "Raw-HTML discoverability, rendered DOM, robots/sitemap fetch, metadata and failure-route probes", "evidence": "Homepage and article probes found unique descriptive titles and meta descriptions.", "pathIds": [ "home", "category", "article", "search" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "issues", "confidence": "high", "method": "Raw-HTML discoverability, rendered DOM, robots/sitemap fetch, metadata and failure-route probes", "evidence": "Discoverability reports 0% homepage and 1% article raw-content coverage, no raw title/h1/description, and isJsShell=true. robots.txt disallows GPTBot, ClaudeBot, OAI-SearchBot and other AI agents.", "pathIds": [ "home", "category", "article", "search" ], "findingIds": [ "F13" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "pass", "confidence": "high", "method": "Raw-HTML discoverability, rendered DOM, robots/sitemap fetch, metadata and failure-route probes", "evidence": "Homepage/article expose canonical URLs and index/follow; robots.txt returns 200 and names four working sitemap endpoints.", "pathIds": [ "home", "category", "article", "search" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "pass", "confidence": "high", "method": "Raw-HTML discoverability, rendered DOM, robots/sitemap fetch, metadata and failure-route probes", "evidence": "Article probe found NewsArticle/WebSite JSON-LD plus accurate Open Graph title, description, URL, type and image.", "pathIds": [ "home", "category", "article", "search" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "issues", "confidence": "high", "method": "Headers, cookies, HAR, tracker, secrets, Lighthouse, and permission probes", "evidence": "Headers show CSP allows unsafe-inline and unsafe-eval; 22 of 26 observed first-party-domain cookies lack Secure and many use SameSite=None. HTTPS, HSTS, and nosniff are present.", "pathIds": [ "home", "category", "article", "search" ], "findingIds": [ "F14" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "issues", "confidence": "high", "method": "Headers, cookies, HAR, tracker, secrets, Lighthouse, and permission probes", "evidence": "Tracker capture found 52 third-party origins and nine known tracker domains; HAR attributes 157 requests and 1.80MB to third parties, while fresh-load cookies include long-lived advertising/experiment identifiers.", "pathIds": [ "home", "category", "article", "search" ], "findingIds": [ "F15" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "pass", "confidence": "high", "method": "Headers, cookies, HAR, tracker, secrets, Lighthouse, and permission probes", "evidence": "Notification permission remained default on load and Lighthouse notification/geolocation-on-start audits scored 1; no browser permission prompt fired before user action.", "pathIds": [ "home", "category", "article", "search" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "high", "method": "Headers, cookies, HAR, tracker, secrets, Lighthouse, and permission probes", "evidence": "CSP has no frame-ancestors directive, X-Frame-Options and Referrer-Policy are absent, and Permissions-Policy grants only a client-hint rule rather than explicitly restricting sensitive features.", "pathIds": [ "home", "category", "article", "search" ], "findingIds": [ "F16" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "issues", "confidence": "high", "method": "Raw-HTML discoverability, rendered DOM, robots/sitemap fetch, metadata and failure-route probes", "evidence": "Raw fetches contain only 22 text characters and no title, h1, or description while rendered pages contain thousands of characters; both tested templates are classified as JS shells.", "pathIds": [ "home", "category", "article", "search" ], "findingIds": [ "F17" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "pass", "confidence": "high", "method": "Raw-HTML discoverability, rendered DOM, robots/sitemap fetch, metadata and failure-route probes", "evidence": "Menu, fixed header, article, and search states rendered without clipped overlays or broken async shells in the exercised JS-enabled paths.", "pathIds": [ "home", "category", "article", "search" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "not-applicable", "confidence": "medium", "method": "Raw-HTML discoverability, rendered DOM, robots/sitemap fetch, metadata and failure-route probes", "evidence": "NU.nl is a public news publication rather than an installed app journey; a service worker is registered, but offline installability was judged contextual and out of scope.", "pathIds": [ "home", "category", "article", "search" ], "reason": "NU.nl is a public news publication rather than an installed app journey; a service worker is registered, but offline installability was judged contextual and out of scope." }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "issues", "confidence": "high", "method": "Raw-HTML discoverability, rendered DOM, robots/sitemap fetch, metadata and failure-route probes", "evidence": "The tested 404 route shows only an error message and no links or retry/search action.", "pathIds": [ "home", "category", "article", "search" ], "findingIds": [ "F18" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "pass", "confidence": "medium", "method": "Representative screenshots, rendered DOM, computed-style and interaction probes across homepage/listing/article/search", "evidence": "The document declares lang=nl, reading order is LTR as expected, and Dutch content/navigation rendered coherently.", "pathIds": [ "home", "category", "article", "search" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "pass", "confidence": "medium", "method": "Representative screenshots, rendered DOM, computed-style and interaction probes across homepage/listing/article/search", "evidence": "Article metadata uses ISO 8601 with +02:00 and the UI renders Dutch date/time labels appropriate to nl-NL.", "pathIds": [ "home", "category", "article", "search" ] }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "pass", "confidence": "medium", "method": "Representative screenshots, rendered DOM, computed-style and interaction probes across homepage/listing/article/search", "evidence": "Article JSON-LD stores an explicit +02:00 offset and visible copy clarifies Nederlandse tijd for the international match.", "pathIds": [ "home", "category", "article", "search" ] }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "pass", "confidence": "high", "method": "Representative screenshots, rendered DOM, computed-style and interaction probes across homepage/listing/article/search", "evidence": "The sampled public reading flow has descriptive actions and the notification solicitation offers a clearly labelled close control; no forced purchase or disguised ad action was observed.", "pathIds": [ "home", "category", "article", "search" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "pass", "confidence": "high", "method": "Representative screenshots, rendered DOM, computed-style and interaction probes across homepage/listing/article/search", "evidence": "No editable user form was present; the exercised 404 explains the failure plainly, while missing recovery is recorded under core task/resilience.", "pathIds": [ "home", "category", "article", "search" ] }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "not-applicable", "confidence": "medium", "method": "Representative screenshots, rendered DOM, computed-style and interaction probes across homepage/listing/article/search", "evidence": "The representative public homepage, listing, article, and search-result URL exposed no editable form fields.", "pathIds": [ "home", "category", "article", "search" ], "reason": "The representative public homepage, listing, article, and search-result URL exposed no editable form fields." }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "not-applicable", "confidence": "medium", "method": "Representative screenshots, rendered DOM, computed-style and interaction probes across homepage/listing/article/search", "evidence": "Checkout, subscription management, and authenticated account management were not part of the representative public-news journey and no such flow was exercised.", "pathIds": [ "home", "category", "article", "search" ], "reason": "Checkout, subscription management, and authenticated account management were not part of the representative public-news journey and no such flow was exercised." }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "issues", "confidence": "high", "method": "Trace, HAR summary, image audit, layout observation, Lighthouse, and screenshots", "evidence": "All 100 inspected images use legacy JPEG URLs, 24 lack srcset, 25 are over twice displayed width, and 10 below-fold images are not lazy loaded.", "pathIds": [ "home", "category", "article", "search" ], "findingIds": [ "F19" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "issues", "confidence": "high", "method": "Trace, HAR summary, image audit, layout observation, Lighthouse, and screenshots", "evidence": "HAR records 1.80MB third-party transfer versus 0.77MB first-party, with 157 of 191 requests third-party; tag management, ads, and experimentation are leading costs.", "pathIds": [ "home", "category", "article", "search" ], "findingIds": [ "F20" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "issues", "confidence": "high", "method": "Trace, HAR summary, image audit, layout observation, Lighthouse, and screenshots", "evidence": "HAR records 1.80MB third-party transfer versus 0.77MB first-party, with 157 of 191 requests third-party; tag management, ads, and experimentation are leading costs.", "pathIds": [ "home", "category", "article", "search" ], "findingIds": [ "F20" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "not-applicable", "confidence": "medium", "method": "Raw-HTML discoverability, rendered DOM, robots/sitemap fetch, metadata and failure-route probes", "evidence": "robots.txt explicitly blocks major AI agents and the site exposes no intended agent-facing task surface; this emerging capability is therefore judged not applicable by site intent.", "pathIds": [ "home", "category", "article", "search" ], "reason": "robots.txt explicitly blocks major AI agents and the site exposes no intended agent-facing task surface; this emerging capability is therefore judged not applicable by site intent." }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "medium", "method": "Raw-HTML discoverability, rendered DOM, robots/sitemap fetch, metadata and failure-route probes", "evidence": "No summarisation or language-model user feature is offered, and the site explicitly blocks AI agents; on-device inference is not required for the core news-reading experience.", "pathIds": [ "home", "category", "article", "search" ], "reason": "No summarisation or language-model user feature is offered, and the site explicitly blocks AI agents; on-device inference is not required for the core news-reading experience." }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "issues", "confidence": "high", "method": "Baseline/post heap summaries plus repeated-interaction JS heap and DOM-node probe", "evidence": "After ten menu open/close cycles, same-session JS heap rose from 47.6MB to 58.4MB while DOM nodes stayed at 2,857; independent post heap was 53.2MB versus 48.1MB baseline. This is medium-confidence retained-growth evidence, not a proven leak trace.", "pathIds": [ "home", "category", "article", "search" ], "findingIds": [ "F21" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "issues", "confidence": "high", "method": "Baseline/post heap summaries plus repeated-interaction JS heap and DOM-node probe", "evidence": "The baseline heap contains 906,269 nodes, 4.52M edges, 48.1MB self-size, 83,032 closures, and 221,969 objects before extended interaction.", "pathIds": [ "home", "category", "article", "search" ], "findingIds": [ "F22" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "issues", "confidence": "high", "method": "Baseline/post heap summaries plus repeated-interaction JS heap and DOM-node probe", "evidence": "After ten menu open/close cycles, same-session JS heap rose from 47.6MB to 58.4MB while DOM nodes stayed at 2,857; independent post heap was 53.2MB versus 48.1MB baseline. This is medium-confidence retained-growth evidence, not a proven leak trace.", "pathIds": [ "home", "category", "article", "search" ], "findingIds": [ "F21" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F01" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "pass" }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "pass" }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "issues", "findingIds": [ "F02", "F03", "F23" ] }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "issues", "findingIds": [ "F04", "F06" ] }, { "principleId": "support-core-task-success", "expectation": "default", "status": "issues", "findingIds": [ "F07" ] }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F08", "F10", "F09", "F11" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F05", "F24", "F06" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "issues", "findingIds": [ "F10", "F12" ] }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F13" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F14", "F15", "F16" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "issues", "findingIds": [ "F17", "F18" ] }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "pass" }, { "principleId": "be-trustworthy", "expectation": "default", "status": "pass" }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F19", "F20" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "not-applicable", "reason": "robots.txt explicitly blocks major AI agents and the site exposes no intended agent-facing task surface; this emerging capability is therefore judged not applicable by site intent. No summarisation or language-model user feature is offered, and the site explicitly blocks AI agents; on-device inference is not required for the core news-reading experience." }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "issues", "findingIds": [ "F21", "F22" ] } ], "paths": [ { "id": "home", "description": "Homepage/news front page: primary discovery surface, first-load interruption, preferences, responsive layout, performance, security and privacy.", "url": "https://www.nu.nl", "conditions": [ "desktop", "viewport 360x800", "prefers-color-scheme: dark", "prefers-reduced-motion: reduce", "prefers-contrast: more", "keyboard-only", "fresh session" ], "result": "issues" }, { "id": "category", "description": "Algemeen section listing: representative category/listing template.", "url": "https://www.nu.nl/algemeen", "conditions": [ "desktop", "rendered DOM" ], "result": "issues" }, { "id": "article", "description": "Lead football story: representative article/detail template and homepage-to-article core flow.", "url": "https://www.nu.nl/wk-voetbal/6403622/engeland-klopt-frankrijk-in-spectaculaire-wk-troostfinale-met-tien-doelpunten.html", "conditions": [ "desktop", "raw HTML/no-JS comparison", "fresh session" ], "result": "issues" }, { "id": "search", "description": "Search results for klimaat: representative findability/results template. Search form interaction itself was not exposed on the direct result route.", "url": "https://www.nu.nl/zoeken?q=klimaat", "conditions": [ "desktop", "rendered DOM" ], "result": "issues" }, { "id": "error-404", "description": "Unknown URL: representative 404/failure recovery state.", "url": "https://www.nu.nl/dit-bestaat-niet-web-uplift", "conditions": [ "desktop", "fresh session" ], "result": "issues" } ], "findings": [ { "id": "F01", "severity": "medium", "principleId": "respect-user-preferences", "principleCheckId": "respects-color-scheme", "guidanceId": "dark-mode", "guidanceCategory": "user-experience", "confidence": "high", "summary": "Dark preference is ignored", "evidence": "The dark-emulated screenshot is pixel-identical to the light capture; the preference probe reports color-scheme normal and body background rgb(255,255,255).", "suggestedFix": "Declare color-scheme: light dark and retint surfaces/text with prefers-color-scheme or light-dark().", "effort": "small", "artifacts": [ "evidence/home-dark.png", "evidence/home-preferences.json" ], "pathId": "home", "url": "https://www.nu.nl" }, { "id": "F02", "severity": "high", "principleId": "maximize-content-reduce-noise", "principleCheckId": "no-intrusive-interruptions", "guidanceId": "light-dismiss-a-dialog", "guidanceCategory": "user-experience", "confidence": "high", "summary": "Notification solicitation obscures core news on every fresh load", "evidence": "Desktop, mobile, homepage, and article screenshots show a centered notification modal covering the lead story before interaction.", "suggestedFix": "Do not open the notification solicitation on initial load; offer it after a relevant user action and preserve dismissal.", "effort": "small", "artifacts": [ "evidence/home-desktop.png", "evidence/home-mobile.png", "evidence/article-desktop.png" ], "pathId": "home", "url": "https://www.nu.nl" }, { "id": "F03", "severity": "medium", "principleId": "maximize-content-reduce-noise", "principleCheckId": "semantic-dismissible-primitives", "guidanceId": "declarative-dialog-popover-control", "guidanceCategory": "user-experience", "confidence": "high", "summary": "Modal uses an invalid ad-hoc role instead of dialog", "evidence": "The overlay probe finds a DIV role=button with aria-modal=true; there is no dialog element and no role=dialog.", "suggestedFix": "Use a native dialog with showModal(), labelled heading, focus containment, Escape, and an explicit close button.", "effort": "medium", "artifacts": [ "evidence/overlay-semantics.json" ], "pathId": "home", "url": "https://www.nu.nl" }, { "id": "F04", "severity": "low", "principleId": "adapt-to-the-form-factor", "principleCheckId": "component-level-responsiveness", "guidanceId": "size-aware-styling", "guidanceCategory": "user-experience", "confidence": "high", "summary": "Components rely on viewport layout rather than container responsiveness", "evidence": "The preference/CSS probe found no @container rules, despite cards and navigation being reused across wide and narrow columns.", "suggestedFix": "Add container-type to reusable card/nav regions and use @container for local layout changes, with existing viewport rules as fallback.", "effort": "medium", "artifacts": [ "evidence/home-preferences.json", "evidence/home-mobile.png" ], "pathId": "home", "url": "https://www.nu.nl" }, { "id": "F05", "severity": "high", "principleId": "be-inclusive", "principleCheckId": "names-roles-labels", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "confidence": "high", "summary": "Several controls and images lack accessible names", "evidence": "The DOM probe found four unnamed controls, including search/settings and carousel arrows; the image audit found three missing alt values in its loaded sample.", "suggestedFix": "Give every icon button a stable accessible name and provide meaningful alt text or alt=\"\" for decorative images.", "effort": "small", "artifacts": [ "evidence/a11y-structure.json", "evidence/home-images.json" ], "pathId": "home", "url": "https://www.nu.nl" }, { "id": "F06", "severity": "high", "principleId": "adapt-to-the-form-factor", "principleCheckId": "input-modality-aware", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "confidence": "high", "summary": "Keyboard focus is not visibly exposed on primary controls", "evidence": "The active-focus probe found no outline or box-shadow on most sampled links/buttons, including logo, top navigation, menu, and article links; several top-nav targets are only 14-16px high.", "suggestedFix": "Add a high-contrast :focus-visible indicator and ensure compact controls have at least a 24px minimum target, preferably 44px for touch.", "effort": "small", "artifacts": [ "evidence/focus-targets.json" ], "pathId": "home", "url": "https://www.nu.nl" }, { "id": "F07", "severity": "medium", "principleId": "support-core-task-success", "principleCheckId": "clear-system-state-and-recovery", "guidanceId": "persistent-toast-notifications", "guidanceCategory": "user-experience", "confidence": "high", "summary": "404 state is a dead end", "evidence": "The exercised unknown URL says the page could not load but exposes no retry, home, search, or relevant-content links in main.", "suggestedFix": "Provide a real 404 response with Home, search, and current-news recovery actions; avoid the internal “Error detected” copy.", "effort": "small", "artifacts": [ "evidence/404.png", "evidence/404-state.json" ], "pathId": "error-404", "url": "https://www.nu.nl/dit-bestaat-niet-web-uplift" }, { "id": "F08", "severity": "high", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "guidanceId": "performance", "guidanceCategory": "performance", "confidence": "high", "summary": "Initial rendering is slow and main-thread work is heavy", "evidence": "Trace recorded FCP 2.78s, LCP 5.58s, four long tasks, longest 452ms, and 808ms total blocking time. Lighthouse on the mandatory privacy-gate journey corroborated 3.9s LCP.", "suggestedFix": "Prioritise the LCP asset, remove redirect/gate latency where possible, and defer/chunk advertising, experimentation, and analytics work.", "effort": "large", "artifacts": [ "evidence/home-trace-summary.json", "evidence/home-lighthouse.json" ], "pathId": "home", "url": "https://www.nu.nl" }, { "id": "F09", "severity": "high", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "guidanceId": "optimize-script-priority", "guidanceCategory": "performance", "confidence": "high", "summary": "Network delivery is dominated by scripts and third parties", "evidence": "HAR captured 191 requests and 2.57MB transferred, including 1.57MB script and 1.80MB from third-party origins; two classic head scripts are parser-blocking.", "suggestedFix": "Defer non-critical classic scripts, conditionally load ad/experiment stacks, trim dependency chains, and set durable cache headers.", "effort": "large", "artifacts": [ "evidence/home-summary.json", "evidence/home.har", "evidence/platform-hygiene.json" ], "pathId": "home", "url": "https://www.nu.nl" }, { "id": "F10", "severity": "medium", "principleId": "be-fast-and-stable", "principleCheckId": "visual-stability", "guidanceId": "optimize-image-priority", "guidanceCategory": "performance", "confidence": "high", "summary": "Images do not reserve intrinsic space", "evidence": "The image primitive reports all 100 inspected images lack width and height attributes; Lighthouse also flags unsized images, even though the short layout observation saw CLS 0.", "suggestedFix": "Emit width/height or aspect-ratio for every image so space is reserved before image decoding.", "effort": "small", "artifacts": [ "evidence/home-images.json", "evidence/home-mobile-layout.json" ], "pathId": "home", "url": "https://www.nu.nl" }, { "id": "F11", "severity": "medium", "principleId": "be-fast-and-stable", "principleCheckId": "trim-unused-and-duplicate-code", "guidanceId": "identify-heavy-scripts", "guidanceCategory": "performance", "confidence": "high", "summary": "Large script payload includes avoidable unused and duplicate work", "evidence": "HAR recorded 61 scripts and 1.57MB script transfer; Lighthouse estimates 58KiB unused JavaScript, while advertising and experimentation bundles are among the largest resources.", "suggestedFix": "Use coverage to remove unused modules, deduplicate tag-manager loads, and load third-party features only when their UI is reached.", "effort": "large", "artifacts": [ "evidence/home-summary.json", "evidence/home-lighthouse.json" ], "pathId": "home", "url": "https://www.nu.nl" }, { "id": "F12", "severity": "medium", "principleId": "follow-best-practices", "principleCheckId": "browser-platform-hygiene", "guidanceId": "html", "guidanceCategory": "html", "confidence": "high", "summary": "Browser hygiene is weakened by inspector and BFCache issues", "evidence": "Lighthouse reports a cookie issue and three BFCache blockers on the privacy-gate journey; a third-party source map also returns 404.", "suggestedFix": "Resolve cookie inspector issues, avoid unnecessary no-store responses on navigable pages, and ship valid source maps for maintained scripts.", "effort": "medium", "artifacts": [ "evidence/home-lighthouse.json" ], "pathId": "home", "url": "https://www.nu.nl" }, { "id": "F13", "severity": "high", "principleId": "be-discoverable", "principleCheckId": "crawlable-and-mobile-friendly", "guidanceId": "html", "guidanceCategory": "html", "confidence": "high", "summary": "Core content is absent from raw HTML and AI crawlers are explicitly blocked", "evidence": "Discoverability reports 0% homepage and 1% article raw-content coverage, no raw title/h1/description, and isJsShell=true. robots.txt disallows GPTBot, ClaudeBot, OAI-SearchBot and other AI agents.", "suggestedFix": "Server-render article/listing content and metadata. If broad AI exclusion is intentional, document it; otherwise allow desired agents while retaining explicit content-use policy.", "effort": "large", "artifacts": [ "evidence/home-discoverability.json", "evidence/article-discoverability.json", "evidence/indexing.json" ], "pathId": "article", "url": "https://www.nu.nl/wk-voetbal/6403622/engeland-klopt-frankrijk-in-spectaculaire-wk-troostfinale-met-tien-doelpunten.html" }, { "id": "F14", "severity": "high", "principleId": "be-private-and-secure", "principleCheckId": "secure-transport-and-headers", "guidanceId": "security", "guidanceCategory": "security", "confidence": "high", "summary": "Cookie and CSP posture is too permissive", "evidence": "Headers show CSP allows unsafe-inline and unsafe-eval; 22 of 26 observed first-party-domain cookies lack Secure and many use SameSite=None. HTTPS, HSTS, and nosniff are present.", "suggestedFix": "Harden CSP with nonces/hashes and strict-dynamic where appropriate; mark every HTTPS cookie Secure and use Lax/Strict unless cross-site delivery is required.", "effort": "medium", "artifacts": [ "evidence/home-headers.json", "evidence/home-cookies.json" ], "pathId": "home", "url": "https://www.nu.nl" }, { "id": "F15", "severity": "high", "principleId": "be-private-and-secure", "principleCheckId": "data-minimisation-and-third-parties", "guidanceId": "privacy", "guidanceCategory": "privacy", "confidence": "high", "summary": "Tracking footprint is disproportionate", "evidence": "Tracker capture found 52 third-party origins and nine known tracker domains; HAR attributes 157 requests and 1.80MB to third parties, while fresh-load cookies include long-lived advertising/experiment identifiers.", "suggestedFix": "Minimise vendors, delay non-essential tracking until valid consent, shorten identifier lifetimes, and batch essential analytics.", "effort": "large", "artifacts": [ "evidence/home-trackers.json", "evidence/home-summary.json", "evidence/home-cookies.json" ], "pathId": "home", "url": "https://www.nu.nl" }, { "id": "F16", "severity": "medium", "principleId": "be-private-and-secure", "principleCheckId": "defensive-browser-policies", "guidanceId": "security", "guidanceCategory": "security", "confidence": "high", "summary": "Defensive header policy is incomplete", "evidence": "CSP has no frame-ancestors directive, X-Frame-Options and Referrer-Policy are absent, and Permissions-Policy grants only a client-hint rule rather than explicitly restricting sensitive features.", "suggestedFix": "Add frame-ancestors, strict-origin-when-cross-origin (or stricter) Referrer-Policy, and an allowlist-based Permissions-Policy; remove unsafe CSP sources.", "effort": "small", "artifacts": [ "evidence/home-headers.json" ], "pathId": "home", "url": "https://www.nu.nl" }, { "id": "F17", "severity": "high", "principleId": "be-resilient", "principleCheckId": "progressive-enhancement", "guidanceId": "stabilize-reactive-state", "guidanceCategory": "user-experience", "confidence": "high", "summary": "News content depends on JavaScript", "evidence": "Raw fetches contain only 22 text characters and no title, h1, or description while rendered pages contain thousands of characters; both tested templates are classified as JS shells.", "suggestedFix": "Serve headline, article/listing content, and navigation in the initial HTML, then hydrate enhancements.", "effort": "large", "artifacts": [ "evidence/home-discoverability.json", "evidence/article-discoverability.json" ], "pathId": "article", "url": "https://www.nu.nl/wk-voetbal/6403622/engeland-klopt-frankrijk-in-spectaculaire-wk-troostfinale-met-tien-doelpunten.html" }, { "id": "F18", "severity": "medium", "principleId": "be-resilient", "principleCheckId": "network-and-http-failure-states", "guidanceId": "persistent-toast-notifications", "guidanceCategory": "user-experience", "confidence": "high", "summary": "Failure recovery lacks useful actions", "evidence": "The tested 404 route shows only an error message and no links or retry/search action.", "suggestedFix": "Provide purposeful network/404 states with retry, search, home navigation, and preserved context.", "effort": "small", "artifacts": [ "evidence/404.png", "evidence/404-state.json" ], "pathId": "error-404", "url": "https://www.nu.nl/dit-bestaat-niet-web-uplift" }, { "id": "F19", "severity": "high", "principleId": "be-sustainable", "principleCheckId": "optimised-assets", "guidanceId": "deliver-optimized-decorative-images", "guidanceCategory": "user-experience", "confidence": "high", "summary": "Image delivery wastes bandwidth", "evidence": "All 100 inspected images use legacy JPEG URLs, 24 lack srcset, 25 are over twice displayed width, and 10 below-fold images are not lazy loaded.", "suggestedFix": "Serve AVIF/WebP variants through picture/srcset, size candidates to display density, and lazy-load non-critical images.", "effort": "medium", "artifacts": [ "evidence/home-images.json" ], "pathId": "home", "url": "https://www.nu.nl" }, { "id": "F20", "severity": "high", "principleId": "be-sustainable", "principleCheckId": "third-party-and-media-budget", "guidanceId": "deprioritize-background-fetches", "guidanceCategory": "performance", "confidence": "high", "summary": "Third-party budget outweighs first-party delivery", "evidence": "HAR records 1.80MB third-party transfer versus 0.77MB first-party, with 157 of 191 requests third-party; tag management, ads, and experimentation are leading costs.", "suggestedFix": "Set a strict third-party request/byte budget, remove low-value vendors, and load remaining integrations after interaction or consent.", "effort": "large", "artifacts": [ "evidence/home-summary.json", "evidence/home-trackers.json" ], "pathId": "home", "url": "https://www.nu.nl" }, { "id": "F21", "severity": "medium", "principleId": "be-memory-efficient", "principleCheckId": "no-leak-under-repeated-interaction", "guidanceId": "manage-recurring-intervals", "guidanceCategory": "user-experience", "confidence": "medium", "summary": "Repeated menu use retains substantial additional heap", "evidence": "After ten menu open/close cycles, same-session JS heap rose from 47.6MB to 58.4MB while DOM nodes stayed at 2,857; independent post heap was 53.2MB versus 48.1MB baseline. This is medium-confidence retained-growth evidence, not a proven leak trace.", "suggestedFix": "Profile the repeated interaction with forced-GC baseline/target/final snapshots and remove retained listeners, arrays, ad objects, or timers identified by retaining paths.", "effort": "medium", "artifacts": [ "evidence/memory-metrics.json", "evidence/heap-baseline.json", "evidence/heap-post.json" ], "pathId": "home", "url": "https://www.nu.nl" }, { "id": "F22", "severity": "medium", "principleId": "be-memory-efficient", "principleCheckId": "bounded-footprint", "guidanceId": "performance", "guidanceCategory": "performance", "confidence": "high", "summary": "Baseline heap is heavy for a news listing", "evidence": "The baseline heap contains 906,269 nodes, 4.52M edges, 48.1MB self-size, 83,032 closures, and 221,969 objects before extended interaction.", "suggestedFix": "Reduce initial vendor execution and object churn; lazy-initialise advertising, experiments, and widgets only when needed.", "effort": "large", "artifacts": [ "evidence/heap-baseline.json" ], "pathId": "home", "url": "https://www.nu.nl" }, { "id": "F23", "severity": "low", "principleId": "maximize-content-reduce-noise", "principleCheckId": "reduced-chrome", "guidanceId": "defer-rendering-heavy-content", "guidanceCategory": "performance", "confidence": "high", "summary": "Large reserved advertising area delays the news visually", "evidence": "Desktop screenshots devote roughly the first 150px below navigation to empty reserved space before the lead story, while the notification overlay further obscures content.", "suggestedFix": "Collapse or cap empty ad slots and avoid reserving a large first-viewport gap when no ad is rendered.", "effort": "small", "artifacts": [ "evidence/home-desktop.png", "evidence/article-desktop.png" ], "pathId": "home", "url": "https://www.nu.nl" }, { "id": "F24", "severity": "medium", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "confidence": "high", "summary": "Heading and focus structure is inconsistent across templates", "evidence": "The category and search templates expose no h1; the focus probe shows most controls without a visible focus style. Lighthouse also found invalid heading order on the consent journey.", "suggestedFix": "Give every template one descriptive h1, keep heading levels sequential, and implement a consistent :focus-visible treatment.", "effort": "small", "artifacts": [ "evidence/category-dom.json", "evidence/search-recon.json", "evidence/focus-targets.json", "evidence/home-lighthouse.json" ], "pathId": "search", "url": "https://www.nu.nl/zoeken?q=klimaat" } ], "taskList": [ { "id": "T01", "title": "Server-render public news content and metadata", "priority": 1, "findingIds": [ "F13", "F17" ], "guidanceId": "stabilize-reactive-state", "status": "open" }, { "id": "T02", "title": "Remove or defer the load-time notification interruption", "priority": 2, "findingIds": [ "F02", "F03", "F23" ], "guidanceId": "light-dismiss-a-dialog", "status": "open" }, { "id": "T03", "title": "Cut third-party scripts, trackers, and transfer cost", "priority": 3, "findingIds": [ "F08", "F09", "F11", "F15", "F20", "F22" ], "guidanceId": "conditional-async-dependencies", "status": "open" }, { "id": "T04", "title": "Harden cookies, CSP, and browser policies", "priority": 4, "findingIds": [ "F14", "F16" ], "guidanceId": "security", "status": "open" }, { "id": "T05", "title": "Fix keyboard focus, control names, heading structure, and targets", "priority": 5, "findingIds": [ "F05", "F06", "F24" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T06", "title": "Modernise responsive image delivery and reserve image space", "priority": 6, "findingIds": [ "F10", "F19" ], "guidanceId": "optimize-image-priority", "status": "open" }, { "id": "T07", "title": "Add useful recovery actions to 404/network failures", "priority": 7, "findingIds": [ "F07", "F18" ], "guidanceId": "persistent-toast-notifications", "status": "open" }, { "id": "T08", "title": "Add system-driven dark mode", "priority": 8, "findingIds": [ "F01" ], "guidanceId": "dark-mode", "status": "open" }, { "id": "T09", "title": "Investigate and bound retained heap growth", "priority": 9, "findingIds": [ "F21", "F22" ], "guidanceId": "manage-recurring-intervals", "status": "open" }, { "id": "T10", "title": "Adopt container queries for reusable cards/navigation", "priority": 10, "findingIds": [ "F04" ], "guidanceId": "size-aware-styling", "status": "open" } ], "budget": { "pathCount": 5, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-18T23-17-26-382Z" }