{ "url": "https://www.fuq.com", "auditedAt": "2026-07-19T07:48:43.482Z", "mode": "report", "status": "completed", "statusDetail": "Coverage-complete audit of the publicly reachable age-verification surface. Listing, support, and unknown routes all redirected to that gate; identity submission to third-party providers was intentionally not performed.", "page": { "appType": "mpa", "framework": "server-rendered HTML with first-party JavaScript", "notes": "Regional age-verification gate is mandatory. Representative content/support routes redirect to it before their templates render." }, "evidenceUsed": [ "screenshot", "DOM/CSS/evaluate probes", "layout metrics", "performance trace", "HAR/network summary", "discoverability/no-JS comparison", "headers", "cookies", "trackers", "images", "secrets scan", "paired heap summaries", "robots/sitemap inspection", "Lighthouse attempted (HTTP 429; not used for judgments)" ], "guidanceConsulted": [ "dark-mode", "component-specific-light-dark-theme", "accessibility", "adapt-scrollbar-to-contrast-preferences", "same-document-transitions", "cross-document-transitions", "group-element-transitions", "faster-spa-view-transitions", "scrollytelling", "parallax-scroll-effects", "scroll-entry-exit-effects", "carousel-slide-effects", "physics-based-easing", "individual-transform-properties", "animate-element-entry-exit", "animate-to-from-top-layer", "animate-to-intrinsic-sizes", "dynamic-sibling-animations", "interactive-content-reveal", "pull-to-reveal", "swipe-to-remove", "shrinking-header-on-scroll", "scroll-progress-indicator", "scroll-position-aware-elements", "scroll-snap-realtime-feedback", "scroll-snap-state-sync", "scroll-target-on-load", "soft-edge-content-fade", "scrollability-affordance-hints", "anchor-positioning-tab-underline", "position-aware-tooltips", "interest-triggered-tooltips", "interest-triggered-action-previews", "directional-navigation-transitions", "carousel-snap-highlights", "navigation-drawer", "stack-drill-down", "persistent-app-tours", "persistent-toast-notifications", "light-dismiss-a-dialog", "platform-controls-dismiss-dialog", "declarative-dialog-popover-control", "animated-select-picker", "branded-select-styling", "brand-consistent-forms", "custom-select-picker-layouts", "rich-media-picker", "complex-shapes", "shaped-cutouts", "overflow-clipping-control", "visually-texture-content", "apply-webgl-shaders", "interactive-content-in-3d-scenes", "highlight-text-ranges", "prevent-text-wrapping", "customize-scrollbar-color-and-thickness", "export-html-media-from-canvas", "fluid-scaling", "calculate-with-intrinsic-sizes", "css-layout", "size-aware-styling", "content-based-styling", "child-state-based-styling", "design-token-reactivity", "dynamic-sibling-styling", "form-fields-automatically-fit-contents", "improve-text-layout-and-legibility", "forms", "accessible-error-announcement", "required-field-feedback", "validate-input-after-interaction", "identify-inp-causes", "schedule-tasks-by-priority", "optimize-preload-priority", "improve-next-page-load-performance", "interactions-in-complex-layouts", "performance", "visually-stable-font-fallbacks", "break-up-long-tasks", "identify-heavy-scripts", "optimize-script-priority", "defer-rendering-heavy-content", "defer-work-until-scroll-ends", "optimize-image-priority", "conditional-async-dependencies", "expose-canvas-content-to-browser-features", "move-dom-element-without-losing-state", "precise-text-alignment", "visually-stable-mixed-fonts", "css", "html", "reduce-style-repetition", "security", "privacy", "batch-analytics-events", "full-session-analytics", "calculate-total-foreground-time", "passkeys", "passkey-registration", "passkey-authentication", "passkey-reauthentication", "passkey-conditional-create", "passkey-management", "flicker-free-client-side-ab-testing", "consistent-cross-document-transitions", "stabilize-reactive-state", "resilient-context-menus-and-nested-dropdowns", "persistent-top-layer-ui", "detect-initial-visibility-state", "sequence-distributed-events", "translator", "language-detection", "support-global-calendar-systems", "capture-location-agnostic-data", "format-human-readable-durations", "manage-recurring-intervals", "calculate-event-differentials", "coordinate-global-events", "model-partial-time-concepts", "search-hidden-content", "select-menu-interaction", "style-parent-with-has", "autofill-address-form", "autofill-payment-form", "autofill-sign-in-form", "autofill-sign-up-form", "autofill-highlight-inputs", "deliver-optimized-decorative-images", "resolution-optimized-pseudo-elements", "deprioritize-background-fetches", "efficient-background-processing", "webmcp", "agentic-forms", "agentic-javascript-tools", "language-model", "summarizer" ], "artifacts": [ { "type": "screenshot", "path": "evidence/home-desktop.png", "caption": "Desktop entry state: age-verification dialog over the content and cookie banner.", "condition": "viewport 800x600", "findingIds": [ "F01", "F16", "F20" ] }, { "type": "screenshot", "path": "evidence/home-mobile.png", "caption": "Mobile entry state: age-verification dialog fills most of the viewport and cookie controls remain behind it.", "condition": "viewport 360x800", "findingIds": [ "F06", "F12" ] }, { "type": "layout", "path": "evidence/home-mobile-layout.json", "caption": "Mobile layout metrics: 360px content width, no horizontal overflow, CLS 0.", "condition": "viewport 360x800", "findingIds": [ "F05" ] }, { "type": "screenshot", "path": "evidence/home-dark.png", "caption": "Entry state under prefers-color-scheme: dark; visually identical to default dark surface.", "condition": "prefers-color-scheme: dark", "findingIds": [ "F01" ] }, { "type": "screenshot", "path": "evidence/home-forced-colors.png", "caption": "Age gate under forced-colors; controls and focus treatment remain visible.", "condition": "forced-colors: active", "findingIds": [] }, { "type": "other", "path": "evidence/preferences-motion-css.json", "caption": "Reduced-motion probe found about 80 running pulse animations despite reduce.", "condition": "prefers-reduced-motion: reduce", "findingIds": [ "F02" ] }, { "type": "trace", "path": "evidence/home-trace", "caption": "Raw DevTools performance trace for the entry load.", "condition": "desktop cold load", "findingIds": [] }, { "type": "trace-summary", "path": "evidence/home-trace-summary.json", "caption": "Trace summary: LCP 3133.7ms, FCP 1951.28ms, TBT 0ms.", "condition": "desktop cold load", "findingIds": [ "F07" ] }, { "type": "har", "path": "evidence/home.har", "caption": "HAR for entry load: 26 requests and 434,348 transferred bytes.", "condition": "desktop cold load", "findingIds": [] }, { "type": "har-summary", "path": "evidence/home-summary.json", "caption": "HAR summary: 347,415 third-party bytes and parser-inserted CookiePro script.", "condition": "desktop cold load", "findingIds": [ "F07", "F08", "F09", "F16", "F20", "F22", "F23" ] }, { "type": "discoverability", "path": "evidence/discoverability.json", "caption": "Raw HTML comparison: 88% rendered-token coverage and no JS shell.", "condition": "JavaScript enabled vs raw HTML", "findingIds": [] }, { "type": "screenshot", "path": "evidence/discoverability-rendered.png", "caption": "Rendered browser view used in discoverability comparison.", "condition": "JavaScript enabled", "findingIds": [] }, { "type": "screenshot", "path": "evidence/discoverability-crawler.png", "caption": "Crawler/no-JavaScript view used in discoverability comparison.", "condition": "JavaScript disabled", "findingIds": [] }, { "type": "other", "path": "evidence/headers.json", "caption": "Security-header probe: CSP has unsafe-inline and Permissions-Policy is absent.", "condition": "main document", "findingIds": [ "F15", "F17" ] }, { "type": "other", "path": "evidence/cookies.json", "caption": "Cookie probe: insecure OptanonConsent and 400-day SameSite=None analytics cookies.", "condition": "initial load", "findingIds": [ "F15", "F17" ] }, { "type": "other", "path": "evidence/trackers.json", "caption": "Tracker probe: Google Tag Manager and Google Analytics active on initial load.", "condition": "initial load", "findingIds": [ "F16", "F22" ] }, { "type": "other", "path": "evidence/images.json", "caption": "Image probe: six oversized images, five missing dimensions, seven legacy formats.", "condition": "entry DOM", "findingIds": [ "F13", "F21" ] }, { "type": "other", "path": "evidence/secrets.json", "caption": "Secrets probe found no exposed sensitive credentials.", "condition": "entry DOM and scripts", "findingIds": [] }, { "type": "dom", "path": "evidence/platform-a11y-probe.json", "caption": "DOM/platform probe: no h1, no container queries, no View Transitions, clickable provider divs, metadata and forms.", "condition": "entry DOM", "findingIds": [ "F03", "F04", "F05", "F08", "F11", "F14" ] }, { "type": "other", "path": "evidence/focus-targets.json", "caption": "General focus/target probe; background controls are trapped by the modal.", "condition": "keyboard focus", "findingIds": [] }, { "type": "other", "path": "evidence/modal-focus.json", "caption": "Dialog-specific focus probe: dialog is labelled and visible links receive focus; several targets are only 14px high.", "condition": "keyboard focus", "findingIds": [ "F06", "F11", "F12" ] }, { "type": "dom", "path": "evidence/age-provider-elements.json", "caption": "Provider selectors AgeVerif and Yoti are clickable divs without role or tabindex.", "condition": "entry dialog", "findingIds": [ "F06", "F10", "F18" ] }, { "type": "screenshot", "path": "evidence/ageverif-expanded.png", "caption": "Provider chooser showing the active AgeGO panel and inactive provider rows.", "condition": "provider chooser", "findingIds": [ "F03" ] }, { "type": "screenshot", "path": "evidence/popular-route.png", "caption": "Popular listing URL redirects to the same age-verification gate.", "condition": "representative listing route", "findingIds": [] }, { "type": "screenshot", "path": "evidence/contact-route.png", "caption": "Contact URL redirects to the same age-verification gate.", "condition": "representative support route", "findingIds": [] }, { "type": "other", "path": "evidence/robots-sitemap.txt", "caption": "robots.txt and sitemap.xml response evidence.", "condition": "crawler signals", "findingIds": [] }, { "type": "other", "path": "evidence/error-route.json", "caption": "Unknown URL redirects to the age gate rather than exposing a recoverable not-found state.", "condition": "unknown route", "findingIds": [ "F19" ] }, { "type": "heap", "path": "evidence/heap-baseline-2", "caption": "Baseline heap summary before provider-row interaction.", "condition": "baseline", "findingIds": [] }, { "type": "heap", "path": "evidence/heap-post-accordion", "caption": "Heap summary after switching provider rows ten times.", "condition": "10 provider-row switches", "findingIds": [] }, { "type": "lighthouse", "path": "evidence/lighthouse.json", "caption": "Lighthouse attempt retained for transparency; target returned HTTP 429, so Lighthouse was not used for judgments.", "condition": "automated Lighthouse attempt", "findingIds": [] }, { "type": "other", "path": "evidence/coverage-manifest.json", "caption": "Pre-audit atomic coverage manifest for all 58 catalog checks.", "condition": "catalog planning", "findingIds": [] } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 58, "blocked": 0, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": true }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "issues", "confidence": "high", "method": "Direct artifact review against the mapped Modern Web Guidance", "evidence": "Default and prefers-color-scheme: dark screenshots are effectively identical; the DOM probe detects theme CSS but no usable light presentation on the audited entry state.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/home-desktop.png", "evidence/home-dark.png" ], "findingIds": [ "F01" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "issues", "confidence": "high", "method": "Direct artifact review against the mapped Modern Web Guidance", "evidence": "The reduced-motion probe reported roughly 80 running pulse animations at 2000ms each under prefers-reduced-motion: reduce.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/preferences-motion-css.json" ], "findingIds": [ "F02" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "pass", "confidence": "high", "method": "screenshot and computed visual review", "evidence": "Forced-colors screenshot keeps text, provider outlines, and focused action visible.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/home-forced-colors.png" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "issues", "confidence": "high", "method": "Direct artifact review against the mapped Modern Web Guidance", "evidence": "The CSS/DOM probe found no view-transition rules while the age-provider chooser changes active state abruptly.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/platform-a11y-probe.json", "evidence/ageverif-expanded.png" ], "findingIds": [ "F03" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "pass", "confidence": "high", "method": "DOM/CSS probe", "evidence": "No scroll-linked visual effects or scroll event animation behavior appears on the gate, and CSS has no animation-timeline; the anti-pattern is absent.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/platform-a11y-probe.json" ] }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "pass", "confidence": "high", "method": "DOM interaction review", "evidence": "The covered gate uses ordinary click/focus interaction and does not replace scrolling or gestures with custom pointer handling.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/age-provider-elements.json" ] }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "issues", "confidence": "high", "method": "Direct artifact review against the mapped Modern Web Guidance", "evidence": "The CSS probe found no scroll-state/container-query rules or scroll progress treatment on a content catalogue with long underlying pages.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/platform-a11y-probe.json" ], "findingIds": [ "F04" ] }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "pass", "confidence": "high", "method": "DOM and mobile screenshot", "evidence": "The covered overlay is a centered native dialog, not a manually anchored tooltip/menu, and remains within the mobile viewport.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/home-mobile.png", "evidence/platform-a11y-probe.json" ] }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "pass", "confidence": "high", "method": "focus probe and screenshot", "evidence": "Modal focus is trapped in a labelled dialog and the active AgeGO option is visibly expanded with its primary action.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/modal-focus.json", "evidence/ageverif-expanded.png" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "pass", "confidence": "high", "method": "desktop/mobile visual review", "evidence": "The unavoidable regional age gate is the primary task, is concise, and keeps its required choices in one labelled dialog rather than stacking promotional interstitials.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/home-desktop.png", "evidence/home-mobile.png" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "pass", "confidence": "high", "method": "DOM probe", "evidence": "The mandatory modal uses a native open dialog labelled by #age-verification-title; no ad-hoc full-screen overlay was used for the gate.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/modal-focus.json" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "pass", "confidence": "high", "method": "visual review", "evidence": "The gate devotes its surface to verification choices, privacy explanation, and required legal links with little decorative chrome.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/home-desktop.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "pass", "confidence": "high", "method": "layout primitive", "evidence": "At 360x800 the layout reports scrollWidth 360, clientWidth 360, horizontalOverflowPx 0, and includes a viewport meta tag.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/home-mobile-layout.json" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "issues", "confidence": "high", "method": "Direct artifact review against the mapped Modern Web Guidance", "evidence": "The mobile layout fits at 360px, but the CSS probe found no @container/container-type support for reused catalogue, menu, or dialog components.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/home-mobile-layout.json", "evidence/platform-a11y-probe.json" ], "findingIds": [ "F05" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "issues", "confidence": "high", "method": "Direct artifact review against the mapped Modern Web Guidance", "evidence": "DOM evidence shows .provider-option divs with cursor-pointer but no role or tabindex; the modal probe also measured multiple links at 14px high and controls at 36px.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/age-provider-elements.json", "evidence/modal-focus.json", "evidence/home-mobile.png" ], "findingIds": [ "F06" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "pass", "confidence": "high", "method": "visual task walkthrough", "evidence": "The first viewport says “Please verify your age,” explains why, recommends AgeGO, and exposes “Continue with AgeGO.”", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/home-desktop.png" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "pass", "confidence": "high", "method": "DOM form and task-path inspection", "evidence": "The audited gate exposes three POST-backed provider routes, a recommended default, provider-specific continue actions, and required terms before handoff; no hidden required field appears in the site-controlled step.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/platform-a11y-probe.json", "evidence/ageverif-expanded.png" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "pass", "confidence": "high", "method": "state-change and DOM review", "evidence": "The selected provider is visibly expanded, alternatives remain available, and support/legal contact links remain in the dialog.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/ageverif-expanded.png", "evidence/modal-focus.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "high", "method": "Direct artifact review against the mapped Modern Web Guidance", "evidence": "The trace summary measured LCP at 3133.7ms (FCP 1951.28ms), above the 2500ms good threshold, while TBT remained 0ms.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/home-trace-summary.json", "evidence/home-summary.json" ], "findingIds": [ "F07" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "pass", "confidence": "high", "method": "layout primitive", "evidence": "The layout observer recorded CLS 0 with no shifts at mobile size; image risks did not shift the measured gate.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/home-mobile-layout.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "pass", "confidence": "high", "method": "trace summary", "evidence": "The trace found zero long tasks and 0ms total blocking time over a 7.25s capture.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/home-trace-summary.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "Direct artifact review against the mapped Modern Web Guidance", "evidence": "HAR initiator data flags otSDKStub.js as a parser-inserted High-priority script; DOM confirms it is in head without async, defer, or module.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/home-summary.json", "evidence/platform-a11y-probe.json" ], "findingIds": [ "F08" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "high", "method": "Direct artifact review against the mapped Modern Web Guidance", "evidence": "Scripts transfer 303,149 bytes; GTM alone is 154,526 bytes and CookiePro’s banner SDK is 126,321 bytes, far larger than the 11,351-byte first-party app script.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/home-summary.json" ], "findingIds": [ "F09" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "issues", "confidence": "high", "method": "Direct artifact review against the mapped Modern Web Guidance", "evidence": "AgeVerif and Yoti are clickable div.provider-option elements with no role, tabindex, aria-expanded, or button semantics.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/age-provider-elements.json" ], "findingIds": [ "F10" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "pass", "confidence": "high", "method": "forced-colors screenshot", "evidence": "Text, outlines, and the active control remain distinguishable in forced-colors mode.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/home-forced-colors.png" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "issues", "confidence": "high", "method": "Direct artifact review against the mapped Modern Web Guidance", "evidence": "The DOM probe starts at h2 and contains no h1; dialog focus outlines are 1px and legal links have 14px-high boxes.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/platform-a11y-probe.json", "evidence/modal-focus.json" ], "findingIds": [ "F11" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "pass", "confidence": "high", "method": "desktop/mobile visual review", "evidence": "Gate copy uses readable line lengths, clear labels, and no clipping at desktop or 360px mobile widths.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/home-desktop.png", "evidence/home-mobile.png" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "issues", "confidence": "high", "method": "Direct artifact review against the mapped Modern Web Guidance", "evidence": "The dialog focus probe measured the language and primary action controls at 36px high and legal links at 14px high, below the recommended 44px target area.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/modal-focus.json", "evidence/home-mobile.png" ], "findingIds": [ "F12" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "pass", "confidence": "medium", "method": "HAR plus active DOM interaction", "evidence": "The page completed its first-party render and provider-state interaction; required first-party assets returned successfully and no uncaught failure surfaced during active probes.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/home-summary.json", "evidence/ageverif-expanded.png" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "issues", "confidence": "high", "method": "Direct artifact review against the mapped Modern Web Guidance", "evidence": "The image probe found six oversized images, five without width/height, seven legacy-format assets, and a 500px logo displayed at 64px.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/images.json" ], "findingIds": [ "F13" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "pass", "confidence": "medium", "method": "platform probe and visual load review", "evidence": "No notification/geolocation prompt appeared on load; Notification.permission remained default and the page uses HTTPS, native dialog, manifest, and standard forms.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/platform-a11y-probe.json", "evidence/home-desktop.png" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "pass", "confidence": "high", "method": "DOM and discoverability probe", "evidence": "The rendered and raw HTML include “Porn Videos @ Fuq.com” and a descriptive meta description.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/platform-a11y-probe.json", "evidence/discoverability.json" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "pass", "confidence": "high", "method": "DOM plus robots probe", "evidence": "The page has viewport metadata, real href links, robots allows normal crawling, and sitemap.xml is declared.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/platform-a11y-probe.json", "evidence/robots-sitemap.txt" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "pass", "confidence": "high", "method": "metadata and HTTP crawler inspection", "evidence": "The final public gate returns 200, canonicals to /age-verification, robots permits it, and sitemap.xml is valid and current.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/platform-a11y-probe.json", "evidence/robots-sitemap.txt" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "issues", "confidence": "high", "method": "Direct artifact review against the mapped Modern Web Guidance", "evidence": "The metadata probe found valid Organization JSON-LD but no Open Graph properties on the canonical age-verification page.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/platform-a11y-probe.json" ], "findingIds": [ "F14" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "issues", "confidence": "high", "method": "Direct artifact review against the mapped Modern Web Guidance", "evidence": "HTTPS, HSTS, nosniff, and X-Frame-Options are present, but CSP permits unsafe-inline styles; OptanonConsent is not Secure and analytics cookies use SameSite=None for 400 days.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ], "findingIds": [ "F15" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "issues", "confidence": "high", "method": "Direct artifact review against the mapped Modern Web Guidance", "evidence": "The initial HAR contains a Google Analytics page_view and GTM load while the cookie controls are behind the mandatory age dialog; 347,415 of 434,348 transferred bytes are third-party.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/home-desktop.png", "evidence/home-summary.json", "evidence/trackers.json" ], "findingIds": [ "F16" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "pass", "confidence": "high", "method": "platform probe and visual review", "evidence": "No permission prompt appeared on load and Notification.permission remained default; the covered public gate has no site account/authentication surface requiring passkeys.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/platform-a11y-probe.json", "evidence/home-desktop.png" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "high", "method": "Direct artifact review against the mapped Modern Web Guidance", "evidence": "The headers probe reports no Permissions-Policy; two analytics cookies are SameSite=None and live for 400 days.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ], "findingIds": [ "F17" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "pass", "confidence": "high", "method": "discoverability primitive", "evidence": "Raw HTML contains 88% of rendered content tokens, title and description, and is not a JS shell.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/discoverability.json", "evidence/discoverability-crawler.png" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "issues", "confidence": "high", "method": "Direct artifact review against the mapped Modern Web Guidance", "evidence": "The two inactive provider rows are custom clickable divs with no keyboard semantics, making the runtime behavior fragile for keyboard and assistive-technology users.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/age-provider-elements.json" ], "findingIds": [ "F18" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "not-applicable", "confidence": "high", "method": "Applicability judgment from representative-path recon", "evidence": "", "reason": "The audited public media catalogue gate is intrinsically online and no offline core task was declared; offline/installable behavior is contextual here." }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "issues", "confidence": "high", "method": "Direct artifact review against the mapped Modern Web Guidance", "evidence": "A request to a deliberately nonexistent path ended at /age-verification with the normal gate and no not-found message or recovery context.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/error-route.json" ], "findingIds": [ "F19" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "pass", "confidence": "high", "method": "DOM/CSS probe", "evidence": "The document declares lang=en, offers a multi-locale form, and the CSS probe found logical inline/block properties.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/platform-a11y-probe.json" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "not-applicable", "confidence": "high", "method": "Applicability judgment from representative-path recon", "evidence": "", "reason": "The covered gate renders no dates, numbers, currency, duration, or calendar data requiring locale formatting." }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "not-applicable", "confidence": "high", "method": "Applicability judgment from representative-path recon", "evidence": "", "reason": "The covered gate has no time or event concepts, so time-zone/DST handling does not apply." }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "issues", "confidence": "high", "method": "Direct artifact review against the mapped Modern Web Guidance", "evidence": "Visible copy says data is used only for age verification and identity stays unlinked, yet the initial network capture sends a GA page_view before the cookie banner can be acted on.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/home-desktop.png", "evidence/home-summary.json" ], "findingIds": [ "F20" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "pass", "confidence": "high", "method": "DOM and interaction review", "evidence": "The site-controlled gate contains no user-entered validation form; provider selection changes state without premature validation or blame.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/platform-a11y-probe.json", "evidence/ageverif-expanded.png" ] }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "not-applicable", "confidence": "high", "method": "Applicability judgment from representative-path recon", "evidence": "", "reason": "The site-controlled gate has no user-entry address, payment, sign-in, or sign-up field requiring autofill assistance." }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "not-applicable", "confidence": "high", "method": "Applicability judgment from representative-path recon", "evidence": "", "reason": "No checkout, subscription, authentication, or account-management flow is present on the covered public gate." }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "issues", "confidence": "high", "method": "Direct artifact review against the mapped Modern Web Guidance", "evidence": "The image probe found the 500px PNG logo displayed at 64px and provider images up to 400px displayed at 20px; seven images use legacy formats.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/images.json" ], "findingIds": [ "F21" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "issues", "confidence": "high", "method": "Direct artifact review against the mapped Modern Web Guidance", "evidence": "Fourteen third-party requests transfer 347,415 bytes, including GTM and eleven CookiePro requests, on a page whose core task is three provider choices.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/home-summary.json", "evidence/trackers.json" ], "findingIds": [ "F22" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "issues", "confidence": "high", "method": "Direct artifact review against the mapped Modern Web Guidance", "evidence": "Third parties account for about 80% of transferred bytes (347,415 of 434,348), despite no media playing on the gate.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/home-summary.json" ], "findingIds": [ "F23" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "not-applicable", "confidence": "high", "method": "Applicability judgment from representative-path recon", "evidence": "", "reason": "No agent-facing transaction or productivity capability is intended on the mandatory age-verification gate; the emerging WebMCP check is contextual." }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "high", "method": "Applicability judgment from representative-path recon", "evidence": "", "reason": "The gate has no summarisation or language-model task where on-device inference would improve the experience." }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "pass", "confidence": "high", "method": "paired heap-summary comparison", "evidence": "Baseline vs ten provider-row switches changed node count only 172,342→172,830 while total self size fell 10,167,518→10,134,800 bytes, with no unbounded retained growth signal.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/heap-baseline-2", "evidence/heap-post-accordion" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "pass", "confidence": "high", "method": "heap summary", "evidence": "The loaded gate retained about 10.2MB self size and 172k heap nodes, proportionate to the DOM plus consent tooling.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/heap-baseline-2" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "pass", "confidence": "high", "method": "paired heap-summary comparison", "evidence": "Ten real provider-row state switches did not produce material retained-heap growth; constructor summaries expose no growing Detached* population among dominant constructors.", "pathIds": [ "age-gate" ], "artifacts": [ "evidence/heap-baseline-2", "evidence/heap-post-accordion" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F01", "F02" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "issues", "findingIds": [ "F03" ] }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "issues", "findingIds": [ "F04" ] }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "pass" }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "issues", "findingIds": [ "F05", "F06" ] }, { "principleId": "support-core-task-success", "expectation": "default", "status": "pass" }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F07", "F08", "F09" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F10", "F11", "F12" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "issues", "findingIds": [ "F13" ] }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F14" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F15", "F16", "F17" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "issues", "findingIds": [ "F18", "F19" ] }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "pass" }, { "principleId": "be-trustworthy", "expectation": "default", "status": "issues", "findingIds": [ "F20" ] }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F21", "F22", "F23" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "not-applicable", "reason": "All checks are contextual and not applicable to the audited age-verification surface." }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "pass" } ], "paths": [ { "id": "age-gate", "description": "Homepage redirect and mandatory age-verification gate; covers the only publicly reachable primary task, preferences, accessibility, security, performance, and responsive behavior.", "url": "https://www.fuq.com/age-verification", "conditions": [ "desktop 800x600", "mobile 360x800", "prefers-color-scheme: dark", "prefers-reduced-motion: reduce", "forced-colors: active", "keyboard focus", "JavaScript disabled/raw HTML" ], "result": "issues" }, { "id": "popular-listing", "description": "Representative listing archetype. /popular was requested, but the server redirected to the same age-verification gate, so the post-verification listing template was not separately exposed.", "url": "https://www.fuq.com/popular", "conditions": [ "desktop" ], "result": "issues" }, { "id": "support-contact", "description": "Representative support/form archetype. /contact/ was requested and redirected to the gate; legal/support links within the gate were inspected.", "url": "https://www.fuq.com/contact/", "conditions": [ "desktop" ], "result": "issues" }, { "id": "unknown-route", "description": "Failure/recovery path using a deliberately nonexistent URL; it redirected to the gate without retaining not-found context.", "url": "https://www.fuq.com/this-route-does-not-exist-atomic-audit", "conditions": [ "desktop" ], "result": "issues" } ], "findings": [ { "id": "F01", "severity": "medium", "confidence": "high", "summary": "The interface is dark in both default and dark-preference conditions rather than adapting to the user’s requested scheme.", "evidence": "Default and prefers-color-scheme: dark screenshots are effectively identical; the DOM probe detects theme CSS but no usable light presentation on the audited entry state.", "suggestedFix": "Expose both light and dark tokens with color-scheme and prefers-color-scheme/light-dark(), retaining the current dark palette for users who request it.", "effort": "small", "pathId": "age-gate", "url": "https://www.fuq.com/age-verification", "principleId": "respect-user-preferences", "principleCheckId": "respects-color-scheme", "guidanceId": "dark-mode", "artifacts": [ "evidence/home-desktop.png", "evidence/home-dark.png" ] }, { "id": "F02", "severity": "medium", "confidence": "high", "summary": "Loading placeholders continue pulsing when reduced motion is requested.", "evidence": "The reduced-motion probe reported roughly 80 running pulse animations at 2000ms each under prefers-reduced-motion: reduce.", "suggestedFix": "In the reduced-motion media query, disable the pulse keyframes and replace motion with a static loading treatment.", "effort": "small", "pathId": "age-gate", "url": "https://www.fuq.com/age-verification", "principleId": "respect-user-preferences", "principleCheckId": "respects-reduced-motion", "guidanceId": "accessibility", "artifacts": [ "evidence/preferences-motion-css.json" ] }, { "id": "F03", "severity": "low", "confidence": "high", "summary": "Provider-state changes and route changes do not use View Transitions.", "evidence": "The CSS/DOM probe found no view-transition rules while the age-provider chooser changes active state abruptly.", "suggestedFix": "Use document.startViewTransition() for provider-state changes and opt eligible same-origin navigations into cross-document transitions, with reduced-motion handling.", "effort": "small", "pathId": "age-gate", "url": "https://www.fuq.com/age-verification", "principleId": "implement-natural-interactions", "principleCheckId": "view-transitions", "guidanceId": "same-document-transitions", "artifacts": [ "evidence/platform-a11y-probe.json", "evidence/ageverif-expanded.png" ] }, { "id": "F04", "severity": "low", "confidence": "high", "summary": "The site chrome has no scroll-state-aware behavior.", "evidence": "The CSS probe found no scroll-state/container-query rules or scroll progress treatment on a content catalogue with long underlying pages.", "suggestedFix": "Use scroll-state queries or a lightweight sticky-header/progress treatment so long listing pages expose position without scroll listeners.", "effort": "small", "pathId": "age-gate", "url": "https://www.fuq.com/age-verification", "principleId": "provide-guided-navigation", "principleCheckId": "scroll-state-aware-chrome", "guidanceId": "shrinking-header-on-scroll", "artifacts": [ "evidence/platform-a11y-probe.json" ] }, { "id": "F05", "severity": "medium", "confidence": "high", "summary": "Responsive behavior is viewport-only rather than component-aware.", "evidence": "The mobile layout fits at 360px, but the CSS probe found no @container/container-type support for reused catalogue, menu, or dialog components.", "suggestedFix": "Define containment on reusable components and move size-specific component changes to @container rules while retaining viewport-level page layout.", "effort": "small", "pathId": "age-gate", "url": "https://www.fuq.com/age-verification", "principleId": "adapt-to-the-form-factor", "principleCheckId": "component-level-responsiveness", "guidanceId": "size-aware-styling", "artifacts": [ "evidence/home-mobile-layout.json", "evidence/platform-a11y-probe.json" ] }, { "id": "F06", "severity": "high", "confidence": "high", "summary": "AgeVerif and Yoti are mouse-only clickable divs, and many interactive targets are below 44px.", "evidence": "DOM evidence shows .provider-option divs with cursor-pointer but no role or tabindex; the modal probe also measured multiple links at 14px high and controls at 36px.", "suggestedFix": "Use button elements for provider choices with aria-expanded/aria-controls, visible :focus-visible styles, and at least 44x44px target areas.", "effort": "small", "pathId": "age-gate", "url": "https://www.fuq.com/age-verification", "principleId": "adapt-to-the-form-factor", "principleCheckId": "input-modality-aware", "guidanceId": "accessibility", "artifacts": [ "evidence/age-provider-elements.json", "evidence/modal-focus.json", "evidence/home-mobile.png" ] }, { "id": "F07", "severity": "medium", "confidence": "high", "summary": "The age gate misses the good LCP threshold on the measured cold load.", "evidence": "The trace summary measured LCP at 3133.7ms (FCP 1951.28ms), above the 2500ms good threshold, while TBT remained 0ms.", "suggestedFix": "Prioritize the gate’s critical HTML/CSS and defer consent/analytics work until after the essential age-choice UI is painted.", "effort": "small", "pathId": "age-gate", "url": "https://www.fuq.com/age-verification", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "guidanceId": "performance", "artifacts": [ "evidence/home-trace-summary.json", "evidence/home-summary.json" ] }, { "id": "F08", "severity": "medium", "confidence": "high", "summary": "A synchronous third-party consent script is parser-inserted before the gate is usable.", "evidence": "HAR initiator data flags otSDKStub.js as a parser-inserted High-priority script; DOM confirms it is in head without async, defer, or module.", "suggestedFix": "Defer CookiePro initialization or load a minimal first-party consent shell first, then fetch the full preference center on demand.", "effort": "small", "pathId": "age-gate", "url": "https://www.fuq.com/age-verification", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "guidanceId": "optimize-script-priority", "artifacts": [ "evidence/home-summary.json", "evidence/platform-a11y-probe.json" ] }, { "id": "F09", "severity": "medium", "confidence": "high", "summary": "Third-party JavaScript dominates a simple gate load.", "evidence": "Scripts transfer 303,149 bytes; GTM alone is 154,526 bytes and CookiePro’s banner SDK is 126,321 bytes, far larger than the 11,351-byte first-party app script.", "suggestedFix": "Remove nonessential tags, delay analytics until consent, and lazy-load the full consent preference-center bundle only when opened.", "effort": "small", "pathId": "age-gate", "url": "https://www.fuq.com/age-verification", "principleId": "be-fast-and-stable", "principleCheckId": "trim-unused-and-duplicate-code", "guidanceId": "identify-heavy-scripts", "artifacts": [ "evidence/home-summary.json" ] }, { "id": "F10", "severity": "high", "confidence": "high", "summary": "Two age-verification choices are not exposed as controls to assistive technology.", "evidence": "AgeVerif and Yoti are clickable div.provider-option elements with no role, tabindex, aria-expanded, or button semantics.", "suggestedFix": "Replace each provider row with a real button and connect it to its panel using aria-expanded and aria-controls.", "effort": "small", "pathId": "age-gate", "url": "https://www.fuq.com/age-verification", "principleId": "be-inclusive", "principleCheckId": "names-roles-labels", "guidanceId": "accessibility", "artifacts": [ "evidence/age-provider-elements.json" ] }, { "id": "F11", "severity": "high", "confidence": "high", "summary": "The document has no h1 and relies on weak, very small focus indicators for several dialog links.", "evidence": "The DOM probe starts at h2 and contains no h1; dialog focus outlines are 1px and legal links have 14px-high boxes.", "suggestedFix": "Add one page h1 for the gate, preserve logical heading order, and provide a clearly visible 2px-or-stronger :focus-visible indicator.", "effort": "small", "pathId": "age-gate", "url": "https://www.fuq.com/age-verification", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "guidanceId": "accessibility", "artifacts": [ "evidence/platform-a11y-probe.json", "evidence/modal-focus.json" ] }, { "id": "F12", "severity": "medium", "confidence": "high", "summary": "Touch targets in the primary dialog are undersized.", "evidence": "The dialog focus probe measured the language and primary action controls at 36px high and legal links at 14px high, below the recommended 44px target area.", "suggestedFix": "Increase control min-block-size to 44px and add padding/spacing around inline legal links so targets remain distinct at zoom and on touch.", "effort": "small", "pathId": "age-gate", "url": "https://www.fuq.com/age-verification", "principleId": "be-inclusive", "principleCheckId": "zoom-reflow-targets-and-media", "guidanceId": "fluid-scaling", "artifacts": [ "evidence/modal-focus.json", "evidence/home-mobile.png" ] }, { "id": "F13", "severity": "medium", "confidence": "high", "summary": "Image delivery is wasteful and several images lack intrinsic dimensions.", "evidence": "The image probe found six oversized images, five without width/height, seven legacy-format assets, and a 500px logo displayed at 64px.", "suggestedFix": "Emit width/height for every image and provide appropriately sized AVIF/WebP variants or SVG for logos/provider marks.", "effort": "small", "pathId": "age-gate", "url": "https://www.fuq.com/age-verification", "principleId": "follow-best-practices", "principleCheckId": "sound-document-and-assets", "guidanceId": "html", "artifacts": [ "evidence/images.json" ] }, { "id": "F14", "severity": "low", "confidence": "high", "summary": "The public gate lacks social-share metadata.", "evidence": "The metadata probe found valid Organization JSON-LD but no Open Graph properties on the canonical age-verification page.", "suggestedFix": "Add accurate og:title, og:description, og:url, and an appropriate non-explicit preview image that matches the visible gate.", "effort": "small", "pathId": "age-gate", "url": "https://www.fuq.com/age-verification", "principleId": "be-discoverable", "principleCheckId": "structured-and-shareable-metadata", "guidanceId": "html", "artifacts": [ "evidence/platform-a11y-probe.json" ] }, { "id": "F15", "severity": "high", "confidence": "high", "summary": "Cookie and CSP settings weaken otherwise solid transport security.", "evidence": "HTTPS, HSTS, nosniff, and X-Frame-Options are present, but CSP permits unsafe-inline styles; OptanonConsent is not Secure and analytics cookies use SameSite=None for 400 days.", "suggestedFix": "Remove unsafe-inline with hashes/nonces or external styles, mark consent cookies Secure, and shorten/restrict analytics cookie scope and lifetime.", "effort": "small", "pathId": "age-gate", "url": "https://www.fuq.com/age-verification", "principleId": "be-private-and-secure", "principleCheckId": "secure-transport-and-headers", "guidanceId": "security", "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ] }, { "id": "F16", "severity": "high", "confidence": "high", "summary": "Analytics runs before the user can act on the obscured cookie banner.", "evidence": "The initial HAR contains a Google Analytics page_view and GTM load while the cookie controls are behind the mandatory age dialog; 347,415 of 434,348 transferred bytes are third-party.", "suggestedFix": "Default analytics consent to denied and do not load GTM/GA until the user has made an accessible, informed consent choice.", "effort": "small", "pathId": "age-gate", "url": "https://www.fuq.com/age-verification", "principleId": "be-private-and-secure", "principleCheckId": "data-minimisation-and-third-parties", "guidanceId": "privacy", "artifacts": [ "evidence/home-desktop.png", "evidence/home-summary.json", "evidence/trackers.json" ] }, { "id": "F17", "severity": "medium", "confidence": "high", "summary": "Permissions-Policy is missing and privacy cookie posture is permissive.", "evidence": "The headers probe reports no Permissions-Policy; two analytics cookies are SameSite=None and live for 400 days.", "suggestedFix": "Add a least-privilege Permissions-Policy and tighten analytics cookies to the minimum scope, SameSite mode, and lifetime required.", "effort": "small", "pathId": "age-gate", "url": "https://www.fuq.com/age-verification", "principleId": "be-private-and-secure", "principleCheckId": "defensive-browser-policies", "guidanceId": "security", "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ] }, { "id": "F18", "severity": "medium", "confidence": "high", "summary": "Provider chooser behavior depends on non-semantic div click handlers.", "evidence": "The two inactive provider rows are custom clickable divs with no keyboard semantics, making the runtime behavior fragile for keyboard and assistive-technology users.", "suggestedFix": "Use native buttons and declarative expanded-state attributes so interaction survives input mode changes and script failures more predictably.", "effort": "small", "pathId": "age-gate", "url": "https://www.fuq.com/age-verification", "principleId": "be-resilient", "principleCheckId": "resilient-runtime-behaviour", "guidanceId": "html", "artifacts": [ "evidence/age-provider-elements.json" ] }, { "id": "F19", "severity": "medium", "confidence": "high", "summary": "Unknown routes are silently replaced by the age gate rather than preserving an error/recovery state.", "evidence": "A request to a deliberately nonexistent path ended at /age-verification with the normal gate and no not-found message or recovery context.", "suggestedFix": "Preserve the requested path through verification, then return a real 404 state with useful links and retry/navigation options.", "effort": "small", "pathId": "age-gate", "url": "https://www.fuq.com/age-verification", "principleId": "be-resilient", "principleCheckId": "network-and-http-failure-states", "guidanceId": "persistent-toast-notifications", "artifacts": [ "evidence/error-route.json" ] }, { "id": "F20", "severity": "high", "confidence": "high", "summary": "The gate promises verification-only data use while analytics collection starts before consent is reachable.", "evidence": "Visible copy says data is used only for age verification and identity stays unlinked, yet the initial network capture sends a GA page_view before the cookie banner can be acted on.", "suggestedFix": "Align the claim with actual behavior: block analytics until explicit consent and state separately what each verification provider and site analytics process.", "effort": "small", "pathId": "age-gate", "url": "https://www.fuq.com/age-verification", "principleId": "be-trustworthy", "principleCheckId": "no-dark-patterns", "guidanceId": "privacy", "artifacts": [ "evidence/home-desktop.png", "evidence/home-summary.json" ] }, { "id": "F21", "severity": "medium", "confidence": "high", "summary": "Small logos and provider marks are served at far larger intrinsic sizes in legacy formats.", "evidence": "The image probe found the 500px PNG logo displayed at 64px and provider images up to 400px displayed at 20px; seven images use legacy formats.", "suggestedFix": "Serve right-sized responsive AVIF/WebP or vector assets and include intrinsic dimensions.", "effort": "small", "pathId": "age-gate", "url": "https://www.fuq.com/age-verification", "principleId": "be-sustainable", "principleCheckId": "optimised-assets", "guidanceId": "deliver-optimized-decorative-images", "artifacts": [ "evidence/images.json" ] }, { "id": "F22", "severity": "medium", "confidence": "high", "summary": "Consent and analytics work consumes most of the entry-load transfer before user interaction.", "evidence": "Fourteen third-party requests transfer 347,415 bytes, including GTM and eleven CookiePro requests, on a page whose core task is three provider choices.", "suggestedFix": "Defer analytics and the full preference-center payload until consent or explicit opening, and keep only the minimal gate code on the critical path.", "effort": "small", "pathId": "age-gate", "url": "https://www.fuq.com/age-verification", "principleId": "be-sustainable", "principleCheckId": "no-wasteful-work", "guidanceId": "deprioritize-background-fetches", "artifacts": [ "evidence/home-summary.json", "evidence/trackers.json" ] }, { "id": "F23", "severity": "medium", "confidence": "high", "summary": "Third-party payload is disproportionate to the age gate’s user value.", "evidence": "Third parties account for about 80% of transferred bytes (347,415 of 434,348), despite no media playing on the gate.", "suggestedFix": "Set a third-party byte/request budget, remove redundant consent payloads, and load analytics only after consent.", "effort": "small", "pathId": "age-gate", "url": "https://www.fuq.com/age-verification", "principleId": "be-sustainable", "principleCheckId": "third-party-and-media-budget", "guidanceId": "efficient-background-processing", "artifacts": [ "evidence/home-summary.json" ] } ], "taskList": [ { "id": "T01", "title": "Block analytics until accessible explicit consent and align the gate’s privacy claims", "priority": 1, "findingIds": [ "F16", "F20", "F22", "F23" ], "guidanceId": "privacy", "status": "open" }, { "id": "T02", "title": "Replace provider divs with accessible buttons and enlarge all primary targets", "priority": 2, "findingIds": [ "F06", "F10", "F11", "F12", "F18" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T03", "title": "Defer third-party consent/analytics code to improve LCP and reduce transfer", "priority": 3, "findingIds": [ "F07", "F08", "F09" ], "guidanceId": "optimize-script-priority", "status": "open" }, { "id": "T04", "title": "Tighten CSP, Permissions-Policy, and cookie attributes/lifetimes", "priority": 4, "findingIds": [ "F15", "F17" ], "guidanceId": "security", "status": "open" }, { "id": "T05", "title": "Respect color-scheme and reduced-motion preferences", "priority": 5, "findingIds": [ "F01", "F02" ], "guidanceId": "dark-mode", "status": "open" }, { "id": "T06", "title": "Right-size images and move legacy raster assets to efficient formats", "priority": 6, "findingIds": [ "F13", "F21" ], "guidanceId": "deliver-optimized-decorative-images", "status": "open" }, { "id": "T07", "title": "Add component queries, navigation transitions, scroll-state cues, and share metadata", "priority": 7, "findingIds": [ "F03", "F04", "F05", "F14" ], "guidanceId": "size-aware-styling", "status": "open" }, { "id": "T08", "title": "Preserve requested URLs through verification and expose a recoverable 404 state", "priority": 8, "findingIds": [ "F19" ], "guidanceId": "persistent-toast-notifications", "status": "open" } ], "budget": { "pathCount": 4, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-19T07-38-22-092Z" }