{ "url": "https://my.xhsocial.com", "auditedAt": "2026-07-19T08:05:38.416Z", "mode": "report", "status": "completed", "statusDetail": "All 58 catalog checks received conclusive outcomes across five representative paths. No local source was provided; critique only.", "page": { "appType": "mpa", "framework": "server-rendered application with client-side enhancement", "notes": "Public Malay-language adult media catalog. Audited homepage, category index, video detail, signup, and failure state. Excluded authenticated account areas, checkout/premium purchase, creator upload, live third-party destinations, and exhaustive category/detail variants because they require credentials, external journeys, or share sampled templates." }, "evidenceUsed": [ "screenshot", "dom", "layout-metrics", "evaluate-probe", "trace", "har", "discoverability", "headers", "cookies", "trackers", "images", "secrets", "heap-summary", "lighthouse", "robots/sitemap fetch", "modern-web-guidance" ], "guidanceConsulted": [ "dark-mode", "component-specific-light-dark-theme", "accessibility", "adapt-scrollbar-to-contrast-preferences", "same-document-transitions", "cross-document-transitions", "group-element-transitions", "faster-spa-view-transitions", "scrollytelling", "parallax-scroll-effects", "scroll-entry-exit-effects", "carousel-slide-effects", "physics-based-easing", "individual-transform-properties", "animate-element-entry-exit", "animate-to-from-top-layer", "animate-to-intrinsic-sizes", "dynamic-sibling-animations", "interactive-content-reveal", "pull-to-reveal", "swipe-to-remove", "shrinking-header-on-scroll", "scroll-progress-indicator", "scroll-position-aware-elements", "scroll-snap-realtime-feedback", "scroll-snap-state-sync", "scroll-target-on-load", "soft-edge-content-fade", "scrollability-affordance-hints", "anchor-positioning-tab-underline", "position-aware-tooltips", "interest-triggered-tooltips", "interest-triggered-action-previews", "directional-navigation-transitions", "carousel-snap-highlights", "navigation-drawer", "stack-drill-down", "persistent-app-tours", "persistent-toast-notifications", "light-dismiss-a-dialog", "platform-controls-dismiss-dialog", "declarative-dialog-popover-control", "animated-select-picker", "branded-select-styling", "brand-consistent-forms", "custom-select-picker-layouts", "rich-media-picker", "complex-shapes", "shaped-cutouts", "overflow-clipping-control", "visually-texture-content", "apply-webgl-shaders", "interactive-content-in-3d-scenes", "highlight-text-ranges", "prevent-text-wrapping", "customize-scrollbar-color-and-thickness", "export-html-media-from-canvas", "fluid-scaling", "calculate-with-intrinsic-sizes", "css-layout", "size-aware-styling", "content-based-styling", "child-state-based-styling", "design-token-reactivity", "dynamic-sibling-styling", "form-fields-automatically-fit-contents", "improve-text-layout-and-legibility", "forms", "accessible-error-announcement", "required-field-feedback", "validate-input-after-interaction", "identify-inp-causes", "schedule-tasks-by-priority", "optimize-preload-priority", "improve-next-page-load-performance", "interactions-in-complex-layouts", "performance", "visually-stable-font-fallbacks", "break-up-long-tasks", "identify-heavy-scripts", "optimize-script-priority", "defer-rendering-heavy-content", "defer-work-until-scroll-ends", "optimize-image-priority", "conditional-async-dependencies", "expose-canvas-content-to-browser-features", "move-dom-element-without-losing-state", "precise-text-alignment", "visually-stable-mixed-fonts", "css", "html", "reduce-style-repetition", "security", "privacy", "batch-analytics-events", "full-session-analytics", "calculate-total-foreground-time", "passkeys", "passkey-registration", "passkey-authentication", "passkey-reauthentication", "passkey-conditional-create", "passkey-management", "flicker-free-client-side-ab-testing", "consistent-cross-document-transitions", "stabilize-reactive-state", "resilient-context-menus-and-nested-dropdowns", "persistent-top-layer-ui", "detect-initial-visibility-state", "sequence-distributed-events", "translator", "language-detection", "support-global-calendar-systems", "capture-location-agnostic-data", "format-human-readable-durations", "manage-recurring-intervals", "calculate-event-differentials", "coordinate-global-events", "model-partial-time-concepts", "search-hidden-content", "select-menu-interaction", "style-parent-with-has", "autofill-address-form", "autofill-payment-form", "autofill-sign-in-form", "autofill-sign-up-form", "autofill-highlight-inputs", "deliver-optimized-decorative-images", "resolution-optimized-pseudo-elements", "deprioritize-background-fetches", "efficient-background-processing", "webmcp", "agentic-forms", "agentic-javascript-tools", "language-model", "summarizer" ], "artifacts": [ { "type": "dom", "path": "evidence/home-dom.json", "caption": "home dom", "findingIds": [] }, { "type": "other", "path": "evidence/video-links.json", "caption": "video links", "findingIds": [] }, { "type": "screenshot", "path": "evidence/home-desktop.png", "caption": "home desktop", "findingIds": [ "F04", "F05", "F06", "F07", "F21", "F27" ] }, { "type": "screenshot", "path": "evidence/home-mobile.png", "caption": "home mobile", "findingIds": [ "F07", "F08", "F26" ] }, { "type": "screenshot", "path": "evidence/home-dark.png", "caption": "home dark", "findingIds": [] }, { "type": "screenshot", "path": "evidence/categories.png", "caption": "categories", "findingIds": [ "F05" ] }, { "type": "screenshot", "path": "evidence/video-detail.png", "caption": "video detail", "findingIds": [ "F05" ] }, { "type": "screenshot", "path": "evidence/signup.png", "caption": "signup", "findingIds": [ "F05", "F22" ] }, { "type": "screenshot", "path": "evidence/404.png", "caption": "404", "findingIds": [ "F11", "F25" ] }, { "type": "screenshot", "path": "evidence/discoverability-rendered.png", "caption": "discoverability rendered", "findingIds": [] }, { "type": "screenshot", "path": "evidence/discoverability-crawler.png", "caption": "discoverability crawler", "findingIds": [] }, { "type": "layout", "path": "evidence/home-mobile-layout.json", "caption": "home mobile layout", "findingIds": [ "F04", "F08", "F09", "F17" ] }, { "type": "layout", "path": "evidence/video-mobile-layout.json", "caption": "video mobile layout", "findingIds": [ "F08" ] }, { "type": "har", "path": "evidence/home.har", "caption": "home", "findingIds": [ "F13", "F31" ] }, { "type": "other", "path": "evidence/home-summary.json", "caption": "home summary", "findingIds": [ "F13", "F14", "F21", "F26", "F27", "F31" ] }, { "type": "trace", "path": "evidence/home-trace.json", "caption": "home trace", "findingIds": [] }, { "type": "trace-summary", "path": "evidence/home-trace-summary.json", "caption": "home trace summary", "findingIds": [ "F12" ] }, { "type": "lighthouse", "path": "evidence/lighthouse.json", "caption": "lighthouse", "findingIds": [ "F02", "F10", "F13", "F15", "F16", "F17" ] }, { "type": "lighthouse", "path": "evidence/lighthouse-summary.json", "caption": "lighthouse summary", "findingIds": [ "F12", "F14" ] }, { "type": "other", "path": "evidence/preferences-probe.json", "caption": "preferences probe", "findingIds": [ "F01", "F03" ] }, { "type": "other", "path": "evidence/platform-a11y-probe.json", "caption": "platform a11y probe", "findingIds": [ "F06", "F09", "F10", "F16", "F18", "F19", "F24" ] }, { "type": "other", "path": "evidence/recon.json", "caption": "recon", "findingIds": [ "F18" ] }, { "type": "other", "path": "evidence/categories-probe.json", "caption": "categories probe", "findingIds": [ "F26" ] }, { "type": "other", "path": "evidence/signup-email-probe.json", "caption": "signup email probe", "findingIds": [ "F22", "F26", "F28", "F29" ] }, { "type": "other", "path": "evidence/headers.json", "caption": "headers", "findingIds": [ "F20", "F23" ] }, { "type": "other", "path": "evidence/cookies.json", "caption": "cookies", "findingIds": [ "F20" ] }, { "type": "other", "path": "evidence/trackers.json", "caption": "trackers", "findingIds": [ "F21" ] }, { "type": "other", "path": "evidence/images.json", "caption": "images", "findingIds": [ "F30" ] }, { "type": "other", "path": "evidence/secrets.json", "caption": "secrets", "findingIds": [] }, { "type": "discoverability", "path": "evidence/discoverability.json", "caption": "discoverability", "findingIds": [] }, { "type": "heap", "path": "evidence/heap-baseline.heapsnapshot", "caption": "heap baseline", "findingIds": [] }, { "type": "heap", "path": "evidence/heap-post.heapsnapshot", "caption": "heap post", "findingIds": [] }, { "type": "other", "path": "evidence/pwa-probe.json", "caption": "pwa probe", "findingIds": [] }, { "type": "other", "path": "evidence/robots.txt", "caption": "robots", "findingIds": [] }, { "type": "other", "path": "evidence/sitemap-headers.txt", "caption": "sitemap headers", "findingIds": [ "F18" ] } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 58, "blocked": 0, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": true }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "pass", "confidence": "high", "method": "Direct evidence from the named artifact(s) and representative path inspection.", "evidence": "Dark-mode emulation activates a substantial prefers-color-scheme: dark token set and the captured surface remains usable.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dark.png", "evidence/preferences-probe.json" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "Under prefers-reduced-motion: reduce, getAnimations() still reported eight running animations, each with a 2000 ms duration and unbounded iterations.", "pathIds": [ "home" ], "artifacts": [ "evidence/preferences-probe.json" ], "findingIds": [ "F01" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "Lighthouse found 13 contrast failures, including the age-verification banner at 2.15:1 and supporting text at 1.75:1, both below 4.5:1.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json" ], "findingIds": [ "F02" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "CSS inspection found no view-transition rules or declarations, while navigation is through ordinary cross-document links across the primary listing, category, and detail journey.", "pathIds": [ "home" ], "artifacts": [ "evidence/preferences-probe.json" ], "findingIds": [ "F03" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-path recon.", "evidence": "No scroll-linked animation surface was present; ordinary scrolling is static, so there is no scroll-animation implementation to judge.", "reason": "No scroll-linked animation surface was present; ordinary scrolling is static, so there is no scroll-animation implementation to judge." }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-path recon.", "evidence": "No custom swipe, pull, carousel, or gesture-driven surface was observed on the representative paths.", "reason": "No custom swipe, pull, carousel, or gesture-driven surface was observed on the representative paths." }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "The homepage screenshot and 4,528 px content layout show a fixed, dense header/sidebar shell; CSS inspection found no scroll-state or scroll-progress treatment.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/home-mobile-layout.json" ], "findingIds": [ "F04" ] }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-path recon.", "evidence": "No tooltip or edge-sensitive anchored overlay was opened on the representative paths.", "reason": "No tooltip or edge-sensitive anchored overlay was opened on the representative paths." }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "pass", "confidence": "high", "method": "Direct evidence from the named artifact(s) and representative path inspection.", "evidence": "Screenshots show clear active navigation treatment, page headings, and category grouping that orient the user after navigation.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/categories.png" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "Desktop screenshots of the homepage, categories, detail, and signup routes show the same large modal covering most of the first viewport before interaction.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/categories.png", "evidence/video-detail.png", "evidence/signup.png" ], "findingIds": [ "F05" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "DOM probes found zero dialog elements and no role=dialog entry despite the visually modal, page-blocking consent surface.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-a11y-probe.json", "evidence/home-desktop.png" ], "findingIds": [ "F06" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "The first viewport contains a top navigation row, age banner, sale banner, persistent 190 px sidebar, promotional buttons, and the blocking consent modal, leaving limited room for the content grid.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/home-mobile.png" ], "findingIds": [ "F07" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "Layout evidence on both homepage and video detail reported scrollWidth/innerWidth 1,038 px against a 360 px visual viewport, producing 678 px horizontal overflow.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile-layout.json", "evidence/video-mobile-layout.json", "evidence/home-mobile.png" ], "findingIds": [ "F08" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "The CSS feature probe found zero container rules, and the global desktop shell remained 1,038 px wide at a 360 px visual viewport.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-a11y-probe.json", "evidence/home-mobile-layout.json" ], "findingIds": [ "F09" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "Programmatic focus showed outline-style none and zero-width outlines on search, login, and promotion buttons. Lighthouse also found target-size failures, and the probe found many 16–20 px interactive targets.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-a11y-probe.json", "evidence/lighthouse.json" ], "findingIds": [ "F10" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "pass", "confidence": "high", "method": "Direct evidence from the named artifact(s) and representative path inspection.", "evidence": "The homepage H1 identifies trending free videos and cards are immediately linked to detail pages.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/recon.json" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "pass", "confidence": "high", "method": "Direct evidence from the named artifact(s) and representative path inspection.", "evidence": "A homepage video link resolved to a populated video-detail page, demonstrating the representative discovery-to-detail path.", "pathIds": [ "home" ], "artifacts": [ "evidence/video-detail.png", "evidence/video-links.json" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "The unknown-route test displayed a bare “503 Service Temporarily Unavailable” nginx page with no site navigation, retry, search, or link home.", "pathIds": [ "error" ], "artifacts": [ "evidence/404.png" ], "findingIds": [ "F11" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "Lighthouse measured LCP 3.8 s, FCP 2.9 s, and Speed Index 4.8 s; the root document alone took 1.76 s in that run.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-trace-summary.json" ], "findingIds": [ "F12" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "pass", "confidence": "high", "method": "Direct evidence from the named artifact(s) and representative path inspection.", "evidence": "Both layout captures reported CLS 0 with no observed layout shifts.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile-layout.json", "evidence/video-mobile-layout.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "pass", "confidence": "high", "method": "Direct evidence from the named artifact(s) and representative path inspection.", "evidence": "Trace measured two long tasks, 124 ms TBT, and 1.65 s LCP; Lighthouse separately measured 0 ms TBT, indicating bounded main-thread blocking on load.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-trace-summary.json", "evidence/lighthouse-summary.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "The HAR recorded 143 requests and 1.86 MB transferred, with three VeryHigh parser-inserted stylesheet candidates; Lighthouse measured 1.76 s document response time.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/home.har", "evidence/lighthouse.json" ], "findingIds": [ "F13" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "Lighthouse estimated 57 KiB unused CSS, with 87–95% waste in two mobile stylesheets, plus 26 KiB unused JavaScript; HAR shows 61 script requests and about 1.0 MB script transfer.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-summary.json" ], "findingIds": [ "F14" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "Lighthouse found two unnamed buttons, two unnamed links, nine label/name mismatches, and a UL containing disallowed direct children; accessibility score was 0.72.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json" ], "findingIds": [ "F15" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "Lighthouse found 13 contrast failures, including the age-verification banner at 2.15:1 and supporting text at 1.75:1, both below 4.5:1.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json" ], "findingIds": [ "F02" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "Core buttons had no visible outline when focused, and Lighthouse found invalid list children and inappropriate role=button on a list item containing links.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-a11y-probe.json", "evidence/lighthouse.json" ], "findingIds": [ "F16" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "pass", "confidence": "high", "method": "Direct evidence from the named artifact(s) and representative path inspection.", "evidence": "Main headings and card text are readable at normal desktop scale with clear typographic hierarchy; specific contrast failures are recorded separately.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/categories.png" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "Lighthouse reports user-scalable=no in the effective viewport meta and target-size failures; direct 360 px layout evidence shows 678 px overflow.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/home-mobile-layout.json" ], "findingIds": [ "F17" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "pass", "confidence": "high", "method": "Direct evidence from the named artifact(s) and representative path inspection.", "evidence": "Lighthouse errors-in-console audit passed with zero recorded items.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "pass", "confidence": "high", "method": "Direct evidence from the named artifact(s) and representative path inspection.", "evidence": "DOM/Lighthouse confirm HTML5 doctype, UTF-8 charset, and no image aspect-ratio failures.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-a11y-probe.json", "evidence/lighthouse.json" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "pass", "confidence": "high", "method": "Direct evidence from the named artifact(s) and representative path inspection.", "evidence": "Lighthouse passed deprecations, BFCache, inspector-issues, and third-party-cookie compatibility audits.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "pass", "confidence": "high", "method": "Direct evidence from the named artifact(s) and representative path inspection.", "evidence": "Homepage and category probes found descriptive, localized titles and meta descriptions.", "pathIds": [ "home" ], "artifacts": [ "evidence/recon.json", "evidence/categories-probe.json" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "pass", "confidence": "high", "method": "Direct evidence from the named artifact(s) and representative path inspection.", "evidence": "Real href links are abundant, robots.txt returned 200 and is parseable, and Lighthouse crawlable-anchor/robots audits passed.", "pathIds": [ "home" ], "artifacts": [ "evidence/recon.json", "evidence/robots.txt", "evidence/lighthouse.json" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "The Malay page links to more than 40 language hosts, but the DOM had no hreflang links; /sitemap.xml returned 404. The canonical also points from xhsocial.com to xhamster.com, so explicit alternate signals are especially important.", "pathIds": [ "home" ], "artifacts": [ "evidence/recon.json", "evidence/platform-a11y-probe.json", "evidence/sitemap-headers.txt" ], "findingIds": [ "F18" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "The homepage probe found no JSON-LD and no Open Graph metadata despite representing a media catalog with shareable video-detail entities.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-a11y-probe.json" ], "findingIds": [ "F19" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "Cookie evidence found three cookies without Secure, including settings and x_csrf_token; settings also uses SameSite=None. Headers omit X-Content-Type-Options and Referrer-Policy.", "pathIds": [ "home" ], "artifacts": [ "evidence/cookies.json", "evidence/headers.json" ], "findingIds": [ "F20" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "The initial HAR, captured while the consent modal was still present, recorded 117 third-party-host requests and 1.67 MB transferred, including Google, ad/media hosts, and collector.xhsocial.com.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/trackers.json", "evidence/home-desktop.png" ], "findingIds": [ "F21" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "The signup surface exposed email/password, Google, and X choices; no passkey/WebAuthn action was present in the inspected public account flow.", "pathIds": [ "signup" ], "artifacts": [ "evidence/signup-email-probe.json", "evidence/signup.png" ], "findingIds": [ "F22" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "The CSP is only frame-ancestors self; headers also lack nosniff and Referrer-Policy, while Permissions-Policy allows high-entropy UA model/platform-version hints.", "pathIds": [ "home" ], "artifacts": [ "evidence/headers.json" ], "findingIds": [ "F23" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "pass", "confidence": "high", "method": "Direct evidence from the named artifact(s) and representative path inspection.", "evidence": "Discoverability evidence found 87% raw-HTML content coverage, title/H1/description present, and no empty JS shell.", "pathIds": [ "home" ], "artifacts": [ "evidence/discoverability.json", "evidence/discoverability-crawler.png" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "The blocking consent surface has no dialog/popover primitive, making focus, escape, and restoration behavior dependent on custom JavaScript.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-a11y-probe.json" ], "findingIds": [ "F24" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-path recon.", "evidence": "Streaming media is intrinsically online; offline playback was judged out of scope. A manifest exists but no service-worker registration was present.", "reason": "Streaming media is intrinsically online; offline playback was judged out of scope. A manifest exists but no service-worker registration was present." }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "The representative invalid route produced a raw 503 response with no retry, navigation, or preserved application context.", "pathIds": [ "error" ], "artifacts": [ "evidence/404.png" ], "findingIds": [ "F25" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "pass", "confidence": "high", "method": "Direct evidence from the named artifact(s) and representative path inspection.", "evidence": "The document declares lang=ms and exposes direct language alternatives; Malay correctly uses the default left-to-right direction.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json", "evidence/recon.json" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "The my.xhsocial.com Malay page displays “GB”, “Kategori Terkenal di UK”, and United Kingdom legal text; network recommendation parameters also use locationCountry=gb and clientLanguage=en.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile.png", "evidence/categories-probe.json", "evidence/signup-email-probe.json", "evidence/home-summary.json" ], "findingIds": [ "F26" ] }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-path recon.", "evidence": "The sampled public paths exposed no event scheduling or user-visible date/time calculation to test across time zones.", "reason": "The sampled public paths exposed no event scheduling or user-visible date/time calculation to test across time zones." }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "The modal says Reject prevents additional cookie purposes, yet the initial load before any choice contacted collector, identity, advertising, and recommendation hosts across 117 third-party-host requests.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/home-summary.json" ], "findingIds": [ "F27" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "After opening email signup, both email and password controls reported required=false; the visible email and password inputs had no associated label, and email used type=text.", "pathIds": [ "signup" ], "artifacts": [ "evidence/signup-email-probe.json" ], "findingIds": [ "F28" ] }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "The public email field is type=text with autocomplete=off; the password uses new-password correctly, but the email control does not expose email autocomplete.", "pathIds": [ "signup" ], "artifacts": [ "evidence/signup-email-probe.json" ], "findingIds": [ "F29" ] }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "pass", "confidence": "high", "method": "Direct evidence from the named artifact(s) and representative path inspection.", "evidence": "The sampled signup surface states that registration is free, exposes terms/privacy, and offers email and federated choices without a paid commitment.", "pathIds": [ "home" ], "artifacts": [ "evidence/signup-email-probe.json", "evidence/signup.png" ] }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "The image audit found 29 of 36 images without width/height, 14 oversized images, eight below-fold images not lazy-loaded, and 14 legacy-format assets.", "pathIds": [ "home" ], "artifacts": [ "evidence/images.json" ], "findingIds": [ "F30" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "pass", "confidence": "high", "method": "Direct evidence from the named artifact(s) and representative path inspection.", "evidence": "The load showed only four XHR/fetch requests and no autoplay video element on the homepage; larger third-party transfer is judged separately.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/platform-a11y-probe.json" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, layout, network, Lighthouse, or interaction evidence as planned in the coverage manifest.", "evidence": "HAR attribution assigns 1.67 MB of 1.86 MB and 117 of 143 requests to non-page origins; scripts account for about 1.0 MB.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/home.har" ], "findingIds": [ "F31" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-path recon.", "evidence": "No declared agent-facing intent or transactional agent surface was found; this emerging opportunity is not treated as a failure.", "reason": "No declared agent-facing intent or transactional agent surface was found; this emerging opportunity is not treated as a failure." }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-path recon.", "evidence": "No experience on the sampled paths required summarisation or language-model inference; this emerging capability is not applicable.", "reason": "No experience on the sampled paths required summarisation or language-model inference; this emerging capability is not applicable." }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "pass", "confidence": "high", "method": "Direct evidence from the named artifact(s) and representative path inspection.", "evidence": "After ten login-modal open/Escape cycles, snapshot totals decreased from 687,026 nodes/36.69 MB to 672,743 nodes/35.80 MB rather than growing.", "pathIds": [ "home" ], "artifacts": [ "evidence/heap-baseline.heapsnapshot", "evidence/heap-post.heapsnapshot" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "pass", "confidence": "high", "method": "Direct evidence from the named artifact(s) and representative path inspection.", "evidence": "The homepage snapshot self-size was about 36.7 MB for a media-heavy listing, a proportionate bounded footprint in this capture.", "pathIds": [ "home" ], "artifacts": [ "evidence/heap-baseline.heapsnapshot" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "pass", "confidence": "high", "method": "Direct evidence from the named artifact(s) and representative path inspection.", "evidence": "Repeated interaction did not increase total heap nodes or edges; totals declined by 14,283 nodes and 61,901 edges.", "pathIds": [ "home" ], "artifacts": [ "evidence/heap-baseline.heapsnapshot", "evidence/heap-post.heapsnapshot" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F01", "F02" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "issues", "findingIds": [ "F03" ] }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "issues", "findingIds": [ "F04" ] }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "issues", "findingIds": [ "F05", "F06", "F07" ] }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "issues", "findingIds": [ "F08", "F09", "F10" ] }, { "principleId": "support-core-task-success", "expectation": "default", "status": "issues", "findingIds": [ "F11" ] }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F12", "F13", "F14" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F15", "F02", "F16", "F17" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "pass" }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F18", "F19" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F20", "F21", "F22", "F23" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "issues", "findingIds": [ "F24", "F25" ] }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "issues", "findingIds": [ "F26" ] }, { "principleId": "be-trustworthy", "expectation": "default", "status": "issues", "findingIds": [ "F27", "F28", "F29" ] }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F30", "F31" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "not-applicable", "reason": "No declared agent-facing intent or transactional agent surface was found; this emerging opportunity is not treated as a failure. No experience on the sampled paths required summarisation or language-model inference; this emerging capability is not applicable." }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "pass" } ], "paths": [ { "id": "home", "description": "Homepage and primary video-discovery listing; represents the global shell, navigation, consent, and listing template.", "url": "https://my.xhsocial.com/", "conditions": [ "desktop", "mobile 360x800", "prefers-color-scheme: dark", "prefers-reduced-motion: reduce", "no JavaScript crawler" ], "result": "issues" }, { "id": "categories", "description": "Category index; represents the taxonomy/listing archetype and a high-volume navigation surface.", "url": "https://my.xhsocial.com/categories", "conditions": [ "desktop" ], "result": "issues" }, { "id": "video", "description": "Representative video detail reached from the homepage; represents the primary watch journey and media-detail template.", "url": "https://my.xhsocial.com/videos/i-accident-my-neighbor-and-inject-my-cock-xh9SOO8", "conditions": [ "desktop", "mobile 360x800" ], "result": "issues" }, { "id": "signup", "description": "Public sign-up surface; represents account creation, input assistance, consent, and authentication choices.", "url": "https://my.xhsocial.com/signup?source=menuSignup", "conditions": [ "desktop", "email sign-up state" ], "result": "issues" }, { "id": "error", "description": "Unknown-route request used to inspect HTTP failure and recovery behavior.", "url": "https://my.xhsocial.com/definitely-not-a-real-page-web-uplift", "conditions": [ "desktop" ], "result": "issues" } ], "findings": [ { "id": "F01", "severity": "medium", "confidence": "high", "principleId": "respect-user-preferences", "principleCheckId": "respects-reduced-motion", "guidanceId": "accessibility", "summary": "Reduced-motion preference does not suppress continuous animation", "evidence": "Under prefers-reduced-motion: reduce, getAnimations() still reported eight running animations, each with a 2000 ms duration and unbounded iterations.", "suggestedFix": "Add a prefers-reduced-motion: reduce rule that removes non-essential animation and auto-advance, retaining only necessary state feedback.", "effort": "small", "pathId": "home", "url": "https://my.xhsocial.com/", "artifacts": [ "evidence/preferences-probe.json" ] }, { "id": "F02", "severity": "high", "confidence": "high", "principleId": "respect-user-preferences", "principleCheckId": "respects-contrast", "guidanceId": "accessibility", "summary": "Important text has insufficient contrast", "evidence": "Lighthouse found 13 contrast failures, including the age-verification banner at 2.15:1 and supporting text at 1.75:1, both below 4.5:1.", "suggestedFix": "Use contrast-safe design tokens and test the consent and age-verification surfaces in normal, prefers-contrast, and forced-colors conditions.", "effort": "small", "pathId": "home", "url": "https://my.xhsocial.com/", "artifacts": [ "evidence/lighthouse.json" ] }, { "id": "F03", "severity": "low", "confidence": "high", "principleId": "implement-natural-interactions", "principleCheckId": "view-transitions", "guidanceId": "cross-document-transitions", "summary": "Route changes have no View Transition treatment", "evidence": "CSS inspection found no view-transition rules or declarations, while navigation is through ordinary cross-document links across the primary listing, category, and detail journey.", "suggestedFix": "Progressively enhance same-origin route changes with @view-transition and a reduced-motion fallback.", "effort": "medium", "pathId": "home", "url": "https://my.xhsocial.com/", "artifacts": [ "evidence/preferences-probe.json" ] }, { "id": "F04", "severity": "low", "confidence": "high", "principleId": "provide-guided-navigation", "principleCheckId": "scroll-state-aware-chrome", "guidanceId": "shrinking-header-on-scroll", "summary": "Long listing chrome does not respond to scroll position", "evidence": "The homepage screenshot and 4,528 px content layout show a fixed, dense header/sidebar shell; CSS inspection found no scroll-state or scroll-progress treatment.", "suggestedFix": "Reduce persistent chrome after scroll and provide a lightweight progress or return affordance on long listings.", "effort": "medium", "pathId": "home", "url": "https://my.xhsocial.com/", "artifacts": [ "evidence/home-desktop.png", "evidence/home-mobile-layout.json" ] }, { "id": "F05", "severity": "high", "confidence": "high", "principleId": "maximize-content-reduce-noise", "principleCheckId": "no-intrusive-interruptions", "guidanceId": "light-dismiss-a-dialog", "summary": "Consent modal obscures the primary content on every sampled entry path", "evidence": "Desktop screenshots of the homepage, categories, detail, and signup routes show the same large modal covering most of the first viewport before interaction.", "suggestedFix": "Use a compact, accessible consent surface that preserves equal accept/reject choices without covering the page purpose and primary action.", "effort": "medium", "pathId": "home", "url": "https://my.xhsocial.com/", "artifacts": [ "evidence/home-desktop.png", "evidence/categories.png", "evidence/video-detail.png", "evidence/signup.png" ] }, { "id": "F06", "severity": "high", "confidence": "high", "principleId": "maximize-content-reduce-noise", "principleCheckId": "semantic-dismissible-primitives", "guidanceId": "declarative-dialog-popover-control", "summary": "The blocking consent UI is not exposed as a semantic dialog", "evidence": "DOM probes found zero dialog elements and no role=dialog entry despite the visually modal, page-blocking consent surface.", "suggestedFix": "Implement the blocking flow with , an accessible name, focus containment/restoration, and an explicit close/decision model.", "effort": "medium", "pathId": "home", "url": "https://my.xhsocial.com/", "artifacts": [ "evidence/platform-a11y-probe.json", "evidence/home-desktop.png" ] }, { "id": "F07", "severity": "medium", "confidence": "high", "principleId": "maximize-content-reduce-noise", "principleCheckId": "reduced-chrome", "guidanceId": "css", "summary": "Promotional chrome competes heavily with content", "evidence": "The first viewport contains a top navigation row, age banner, sale banner, persistent 190 px sidebar, promotional buttons, and the blocking consent modal, leaving limited room for the content grid.", "suggestedFix": "Consolidate promotions, remove redundant bars, and prioritise the content title and grid in the first viewport.", "effort": "medium", "pathId": "home", "url": "https://my.xhsocial.com/", "artifacts": [ "evidence/home-desktop.png", "evidence/home-mobile.png" ] }, { "id": "F08", "severity": "critical", "confidence": "high", "principleId": "adapt-to-the-form-factor", "principleCheckId": "responsive-no-horizontal-scroll", "guidanceId": "css-layout", "summary": "The desktop layout is rendered at 1,038 px inside a 360 px viewport", "evidence": "Layout evidence on both homepage and video detail reported scrollWidth/innerWidth 1,038 px against a 360 px visual viewport, producing 678 px horizontal overflow.", "suggestedFix": "Serve the actual mobile layout at the visual viewport width; remove fixed desktop minimum widths and verify at 320–412 px without horizontal scrolling.", "effort": "medium", "pathId": "home", "url": "https://my.xhsocial.com/", "artifacts": [ "evidence/home-mobile-layout.json", "evidence/video-mobile-layout.json", "evidence/home-mobile.png" ] }, { "id": "F09", "severity": "medium", "confidence": "high", "principleId": "adapt-to-the-form-factor", "principleCheckId": "component-level-responsiveness", "guidanceId": "size-aware-styling", "summary": "Reusable components do not use container-level adaptation", "evidence": "The CSS feature probe found zero container rules, and the global desktop shell remained 1,038 px wide at a 360 px visual viewport.", "suggestedFix": "Give reused cards, navigation, and promo modules containment and adapt them with @container based on available inline size.", "effort": "medium", "pathId": "home", "url": "https://my.xhsocial.com/", "artifacts": [ "evidence/platform-a11y-probe.json", "evidence/home-mobile-layout.json" ] }, { "id": "F10", "severity": "high", "confidence": "high", "principleId": "adapt-to-the-form-factor", "principleCheckId": "input-modality-aware", "guidanceId": "accessibility", "summary": "Keyboard focus is invisible on core controls and some targets are too small", "evidence": "Programmatic focus showed outline-style none and zero-width outlines on search, login, and promotion buttons. Lighthouse also found target-size failures, and the probe found many 16–20 px interactive targets.", "suggestedFix": "Add strong :focus-visible styles and enlarge or space interactive targets to at least 24 CSS px, preferably 44 px for primary touch controls.", "effort": "small", "pathId": "home", "url": "https://my.xhsocial.com/", "artifacts": [ "evidence/platform-a11y-probe.json", "evidence/lighthouse.json" ] }, { "id": "F11", "severity": "high", "confidence": "high", "principleId": "support-core-task-success", "principleCheckId": "clear-system-state-and-recovery", "guidanceId": "persistent-toast-notifications", "summary": "Unknown routes return a raw server error with no recovery path", "evidence": "The unknown-route test displayed a bare “503 Service Temporarily Unavailable” nginx page with no site navigation, retry, search, or link home.", "suggestedFix": "Return an intentional branded 404/5xx state with search, home navigation, retry guidance, and correct HTTP status semantics.", "effort": "small", "pathId": "error", "url": "https://my.xhsocial.com/definitely-not-a-real-page-web-uplift", "artifacts": [ "evidence/404.png" ] }, { "id": "F12", "severity": "high", "confidence": "high", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "guidanceId": "performance", "summary": "Mobile LCP is outside the good range", "evidence": "Lighthouse measured LCP 3.8 s, FCP 2.9 s, and Speed Index 4.8 s; the root document alone took 1.76 s in that run.", "suggestedFix": "Reduce document latency, prioritise the LCP candidate, and defer non-critical UI and third-party work until after primary content.", "effort": "medium", "pathId": "home", "url": "https://my.xhsocial.com/", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-trace-summary.json" ] }, { "id": "F13", "severity": "medium", "confidence": "high", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "guidanceId": "optimize-script-priority", "summary": "The critical path includes a slow document and multiple parser-discovered styles", "evidence": "The HAR recorded 143 requests and 1.86 MB transferred, with three VeryHigh parser-inserted stylesheet candidates; Lighthouse measured 1.76 s document response time.", "suggestedFix": "Shorten server response time, inline only critical CSS, defer non-critical styles, and audit each parser-loaded script/style against first-view needs.", "effort": "medium", "pathId": "home", "url": "https://my.xhsocial.com/", "artifacts": [ "evidence/home-summary.json", "evidence/home.har", "evidence/lighthouse.json" ] }, { "id": "F14", "severity": "medium", "confidence": "high", "principleId": "be-fast-and-stable", "principleCheckId": "trim-unused-and-duplicate-code", "guidanceId": "identify-heavy-scripts", "summary": "The first load ships avoidable unused CSS and JavaScript", "evidence": "Lighthouse estimated 57 KiB unused CSS, with 87–95% waste in two mobile stylesheets, plus 26 KiB unused JavaScript; HAR shows 61 script requests and about 1.0 MB script transfer.", "suggestedFix": "Split route/component CSS and JavaScript, load consent/auth/media modules on demand, and remove duplicate or unused rules from the initial bundle.", "effort": "medium", "pathId": "home", "url": "https://my.xhsocial.com/", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-summary.json" ] }, { "id": "F15", "severity": "high", "confidence": "high", "principleId": "be-inclusive", "principleCheckId": "names-roles-labels", "guidanceId": "accessibility", "summary": "Interactive controls and list structure have accessibility-tree failures", "evidence": "Lighthouse found two unnamed buttons, two unnamed links, nine label/name mismatches, and a UL containing disallowed direct children; accessibility score was 0.72.", "suggestedFix": "Give every control a discernible name, keep visible labels within accessible names, and restore valid list/landmark semantics.", "effort": "medium", "pathId": "home", "url": "https://my.xhsocial.com/", "artifacts": [ "evidence/lighthouse.json" ] }, { "id": "F16", "severity": "high", "confidence": "high", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "guidanceId": "accessibility", "summary": "Focus visibility and semantic reading order are unreliable", "evidence": "Core buttons had no visible outline when focused, and Lighthouse found invalid list children and inappropriate role=button on a list item containing links.", "suggestedFix": "Use native interactive elements, valid list children, a logical tab order, and a consistent high-contrast :focus-visible indicator.", "effort": "medium", "pathId": "home", "url": "https://my.xhsocial.com/", "artifacts": [ "evidence/platform-a11y-probe.json", "evidence/lighthouse.json" ] }, { "id": "F17", "severity": "high", "confidence": "high", "principleId": "be-inclusive", "principleCheckId": "zoom-reflow-targets-and-media", "guidanceId": "fluid-scaling", "summary": "Zoom is disabled and narrow-screen reflow fails", "evidence": "Lighthouse reports user-scalable=no in the effective viewport meta and target-size failures; direct 360 px layout evidence shows 678 px overflow.", "suggestedFix": "Remove user-scalable=no and restrictive scale limits, then fix reflow and touch target sizing at mobile and 200% zoom.", "effort": "medium", "pathId": "home", "url": "https://my.xhsocial.com/", "artifacts": [ "evidence/lighthouse.json", "evidence/home-mobile-layout.json" ] }, { "id": "F18", "severity": "medium", "confidence": "high", "principleId": "be-discoverable", "principleCheckId": "canonical-and-indexing-signals", "guidanceId": "html", "summary": "Localized variants lack explicit hreflang and sitemap discovery signals", "evidence": "The Malay page links to more than 40 language hosts, but the DOM had no hreflang links; /sitemap.xml returned 404. The canonical also points from xhsocial.com to xhamster.com, so explicit alternate signals are especially important.", "suggestedFix": "Publish reciprocal hreflang/x-default links for localized equivalents, expose sitemap indexes, and verify canonical host mapping is intentional and consistent.", "effort": "medium", "pathId": "home", "url": "https://my.xhsocial.com/", "artifacts": [ "evidence/recon.json", "evidence/platform-a11y-probe.json", "evidence/sitemap-headers.txt" ] }, { "id": "F19", "severity": "medium", "confidence": "high", "principleId": "be-discoverable", "principleCheckId": "structured-and-shareable-metadata", "guidanceId": "html", "summary": "Content and organization pages expose no rich/share metadata", "evidence": "The homepage probe found no JSON-LD and no Open Graph metadata despite representing a media catalog with shareable video-detail entities.", "suggestedFix": "Add accurate Organization/WebSite and VideoObject JSON-LD plus Open Graph/Twitter metadata matching visible content on each archetype.", "effort": "medium", "pathId": "home", "url": "https://my.xhsocial.com/", "artifacts": [ "evidence/platform-a11y-probe.json" ] }, { "id": "F20", "severity": "high", "confidence": "high", "principleId": "be-private-and-secure", "principleCheckId": "secure-transport-and-headers", "guidanceId": "security", "summary": "Cookies and security headers are not consistently hardened", "evidence": "Cookie evidence found three cookies without Secure, including settings and x_csrf_token; settings also uses SameSite=None. Headers omit X-Content-Type-Options and Referrer-Policy.", "suggestedFix": "Mark all HTTPS cookies Secure, minimise SameSite=None, protect state tokens appropriately, and add nosniff plus a privacy-preserving Referrer-Policy.", "effort": "small", "pathId": "home", "url": "https://my.xhsocial.com/", "artifacts": [ "evidence/cookies.json", "evidence/headers.json" ] }, { "id": "F21", "severity": "high", "confidence": "high", "principleId": "be-private-and-secure", "principleCheckId": "data-minimisation-and-third-parties", "guidanceId": "privacy", "summary": "Third-party and analytics traffic begins before the user makes a consent choice", "evidence": "The initial HAR, captured while the consent modal was still present, recorded 117 third-party-host requests and 1.67 MB transferred, including Google, ad/media hosts, and collector.xhsocial.com.", "suggestedFix": "Block non-essential analytics, advertising, recommendation, and identity requests until consent; reduce origins and document each remaining processor.", "effort": "large", "pathId": "home", "url": "https://my.xhsocial.com/", "artifacts": [ "evidence/home-summary.json", "evidence/trackers.json", "evidence/home-desktop.png" ] }, { "id": "F22", "severity": "medium", "confidence": "high", "principleId": "be-private-and-secure", "principleCheckId": "in-context-permissions-and-modern-auth", "guidanceId": "passkeys", "summary": "Public authentication choices omit phishing-resistant sign-in", "evidence": "The signup surface exposed email/password, Google, and X choices; no passkey/WebAuthn action was present in the inspected public account flow.", "suggestedFix": "Offer passkey registration and sign-in as a first-class option, retaining recovery and federation fallbacks.", "effort": "large", "pathId": "signup", "url": "https://my.xhsocial.com/signup?source=menuSignup", "artifacts": [ "evidence/signup-email-probe.json", "evidence/signup.png" ] }, { "id": "F23", "severity": "high", "confidence": "high", "principleId": "be-private-and-secure", "principleCheckId": "defensive-browser-policies", "guidanceId": "security", "summary": "The Content Security Policy protects only framing", "evidence": "The CSP is only frame-ancestors self; headers also lack nosniff and Referrer-Policy, while Permissions-Policy allows high-entropy UA model/platform-version hints.", "suggestedFix": "Deploy an enforceable nonce/hash-based CSP, add nosniff and strict-origin-when-cross-origin, and narrow Permissions-Policy to capabilities actually required.", "effort": "medium", "pathId": "home", "url": "https://my.xhsocial.com/", "artifacts": [ "evidence/headers.json" ] }, { "id": "F24", "severity": "medium", "confidence": "high", "principleId": "be-resilient", "principleCheckId": "resilient-runtime-behaviour", "guidanceId": "resilient-context-menus-and-nested-dropdowns", "summary": "The most important overlay relies on custom runtime semantics", "evidence": "The blocking consent surface has no dialog/popover primitive, making focus, escape, and restoration behavior dependent on custom JavaScript.", "suggestedFix": "Move the flow to with explicit focus management and test it at edges, zoom, keyboard-only, and script-failure conditions.", "effort": "medium", "pathId": "home", "url": "https://my.xhsocial.com/", "artifacts": [ "evidence/platform-a11y-probe.json" ] }, { "id": "F25", "severity": "high", "confidence": "high", "principleId": "be-resilient", "principleCheckId": "network-and-http-failure-states", "guidanceId": "persistent-toast-notifications", "summary": "Server failures fall through to an unhelpful nginx page", "evidence": "The representative invalid route produced a raw 503 response with no retry, navigation, or preserved application context.", "suggestedFix": "Route 404/5xx failures through a resilient application shell and provide retry, home, and search actions.", "effort": "small", "pathId": "error", "url": "https://my.xhsocial.com/definitely-not-a-real-page-web-uplift", "artifacts": [ "evidence/404.png" ] }, { "id": "F26", "severity": "high", "confidence": "high", "principleId": "be-internationalised", "principleCheckId": "locale-aware-data", "guidanceId": "translator", "summary": "The Malay locale is mixed with United Kingdom targeting", "evidence": "The my.xhsocial.com Malay page displays “GB”, “Kategori Terkenal di UK”, and United Kingdom legal text; network recommendation parameters also use locationCountry=gb and clientLanguage=en.", "suggestedFix": "Derive language, territory, legal copy, and recommendation locale independently and consistently; do not map Malay language to UK territory defaults.", "effort": "medium", "pathId": "home", "url": "https://my.xhsocial.com/", "artifacts": [ "evidence/home-mobile.png", "evidence/categories-probe.json", "evidence/signup-email-probe.json", "evidence/home-summary.json" ] }, { "id": "F27", "severity": "medium", "confidence": "high", "principleId": "be-trustworthy", "principleCheckId": "no-dark-patterns", "guidanceId": "privacy", "summary": "Consent copy and pre-consent behavior are inconsistent", "evidence": "The modal says Reject prevents additional cookie purposes, yet the initial load before any choice contacted collector, identity, advertising, and recommendation hosts across 117 third-party-host requests.", "suggestedFix": "Make the default state genuinely non-essential-data-free and describe each purpose and partner in language matching observed network behavior.", "effort": "large", "pathId": "home", "url": "https://my.xhsocial.com/", "artifacts": [ "evidence/home-desktop.png", "evidence/home-summary.json" ] }, { "id": "F28", "severity": "medium", "confidence": "high", "principleId": "be-trustworthy", "principleCheckId": "humane-error-handling", "guidanceId": "forms", "summary": "The email sign-up fields lack native constraint semantics and labels", "evidence": "After opening email signup, both email and password controls reported required=false; the visible email and password inputs had no associated label, and email used type=text.", "suggestedFix": "Use type=email, associated labels, required, minlength where appropriate, and interaction-timed accessible validation with aria-invalid/error references.", "effort": "small", "pathId": "signup", "url": "https://my.xhsocial.com/signup?source=menuSignup", "artifacts": [ "evidence/signup-email-probe.json" ] }, { "id": "F29", "severity": "medium", "confidence": "high", "principleId": "be-trustworthy", "principleCheckId": "trustworthy-input-assistance", "guidanceId": "autofill-sign-up-form", "summary": "Email signup disables useful autofill semantics", "evidence": "The public email field is type=text with autocomplete=off; the password uses new-password correctly, but the email control does not expose email autocomplete.", "suggestedFix": "Use type=email and autocomplete=email for registration while retaining autocomplete=new-password for password creation.", "effort": "trivial", "pathId": "signup", "url": "https://my.xhsocial.com/signup?source=menuSignup", "artifacts": [ "evidence/signup-email-probe.json" ] }, { "id": "F30", "severity": "medium", "confidence": "high", "principleId": "be-sustainable", "principleCheckId": "optimised-assets", "guidanceId": "optimize-image-priority", "summary": "Many images lack dimensions or are oversized", "evidence": "The image audit found 29 of 36 images without width/height, 14 oversized images, eight below-fold images not lazy-loaded, and 14 legacy-format assets.", "suggestedFix": "Reserve intrinsic dimensions, serve right-sized AVIF/WebP candidates with srcset/sizes, and lazy-load below-fold media.", "effort": "medium", "pathId": "home", "url": "https://my.xhsocial.com/", "artifacts": [ "evidence/images.json" ] }, { "id": "F31", "severity": "medium", "confidence": "high", "principleId": "be-sustainable", "principleCheckId": "third-party-and-media-budget", "guidanceId": "deprioritize-background-fetches", "summary": "Third-party code dominates the initial transfer", "evidence": "HAR attribution assigns 1.67 MB of 1.86 MB and 117 of 143 requests to non-page origins; scripts account for about 1.0 MB.", "suggestedFix": "Set route-specific third-party budgets, defer identity/ads/media until needed or consented, and remove integrations that do not improve the core task.", "effort": "large", "pathId": "home", "url": "https://my.xhsocial.com/", "artifacts": [ "evidence/home-summary.json", "evidence/home.har" ] } ], "taskList": [ { "id": "T1", "title": "Rebuild mobile reflow, zoom, focus, and target sizing", "priority": 1, "findingIds": [ "F08", "F09", "F10", "F17" ], "guidanceId": "css-layout", "status": "open" }, { "id": "T2", "title": "Make consent honest, non-blocking, semantic, and pre-consent private", "priority": 2, "findingIds": [ "F05", "F06", "F21", "F23", "F24", "F27" ], "guidanceId": "declarative-dialog-popover-control", "status": "open" }, { "id": "T3", "title": "Repair names, roles, list semantics, contrast, and focus", "priority": 3, "findingIds": [ "F02", "F15", "F16" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T4", "title": "Harden cookies, CSP, and browser security policies", "priority": 4, "findingIds": [ "F20", "F23" ], "guidanceId": "security", "status": "open" }, { "id": "T5", "title": "Improve LCP and remove unused initial CSS/JavaScript", "priority": 5, "findingIds": [ "F12", "F13", "F14" ], "guidanceId": "performance", "status": "open" }, { "id": "T6", "title": "Fix locale/territory mapping and localized indexing signals", "priority": 6, "findingIds": [ "F18", "F26" ], "guidanceId": "translator", "status": "open" }, { "id": "T7", "title": "Add resilient branded 404/5xx recovery", "priority": 7, "findingIds": [ "F11", "F25" ], "guidanceId": "persistent-toast-notifications", "status": "open" }, { "id": "T8", "title": "Optimise image delivery and enforce third-party budgets", "priority": 8, "findingIds": [ "F30", "F31" ], "guidanceId": "optimize-image-priority", "status": "open" }, { "id": "T9", "title": "Add native, autofill-friendly signup constraints and passkeys", "priority": 9, "findingIds": [ "F22", "F28", "F29" ], "guidanceId": "autofill-sign-up-form", "status": "open" }, { "id": "T10", "title": "Reduce promotional chrome and respect motion preference", "priority": 10, "findingIds": [ "F01", "F04", "F07" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T11", "title": "Add structured/share metadata and route transitions", "priority": 11, "findingIds": [ "F03", "F19" ], "guidanceId": "cross-document-transitions", "status": "open" } ], "budget": { "pathCount": 5, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-19T08-05-38-416Z" }