{ "url": "https://bit.ly", "auditedAt": "2026-07-19T21:17:49.437Z", "mode": "report", "status": "completed", "statusDetail": "Coverage-complete representative audit of the redirected bitly.com public marketing, product, pricing, article, signup and error templates.", "page": { "appType": "hybrid", "framework": "WordPress marketing MPA plus embedded custom elements and a separate signup app", "notes": "bit.ly redirects to https://bitly.com/. Consent state materially affects first view." }, "evidenceUsed": [ "DOM inspection", "screenshots", "layout metrics", "evaluate probes", "performance trace", "HAR", "discoverability/no-JS comparison", "headers", "cookies", "trackers", "secrets scan", "image audit", "Lighthouse", "heap summaries", "HTTP fetch" ], "guidanceConsulted": [ "dark-mode", "accessibility", "performance", "html", "css", "css-layout", "forms", "security", "privacy", "passkeys", "size-aware-styling", "declarative-dialog-popover-control", "validate-input-after-interaction", "webmcp", "agentic-forms", "agentic-javascript-tools", "language-model" ], "artifacts": [ { "type": "other", "path": "coverage-manifest.json", "caption": "Exact 58-check coverage manifest with catalog checksum." }, { "type": "screenshot", "path": "evidence/404-mobile.png", "caption": "404 mobile evidence", "condition": "viewport: 360x800" }, { "type": "other", "path": "evidence/article-meta.json", "caption": "article meta evidence" }, { "type": "screenshot", "path": "evidence/article-mobile.png", "caption": "article mobile evidence", "findingIds": [ "F04" ], "condition": "viewport: 360x800" }, { "type": "other", "path": "evidence/cookies.json", "caption": "cookies evidence" }, { "type": "other", "path": "evidence/crawl-and-404.json", "caption": "crawl and 404 evidence" }, { "type": "discoverability", "path": "evidence/discoverability", "caption": "discoverability evidence" }, { "type": "screenshot", "path": "evidence/discoverability-crawler.png", "caption": "discoverability crawler evidence" }, { "type": "screenshot", "path": "evidence/discoverability-rendered.png", "caption": "discoverability rendered evidence" }, { "type": "dom", "path": "evidence/dom-home.json", "caption": "dom home evidence" }, { "type": "other", "path": "evidence/guidance-list.json", "caption": "guidance list evidence" }, { "type": "other", "path": "evidence/guidance-retrieved.md", "caption": "guidance retrieved evidence" }, { "type": "other", "path": "evidence/guidance-searches.jsonl", "caption": "guidance searches evidence" }, { "type": "other", "path": "evidence/headers.json", "caption": "headers evidence", "findingIds": [ "F18", "F21" ] }, { "type": "heap", "path": "evidence/heap-after-scroll.heapsnapshot", "caption": "heap after scroll evidence" }, { "type": "heap", "path": "evidence/heap-baseline.heapsnapshot", "caption": "heap baseline evidence" }, { "type": "heap", "path": "evidence/heap-post.heapsnapshot", "caption": "heap post evidence" }, { "type": "screenshot", "path": "evidence/home-contrast.png", "caption": "home contrast evidence", "condition": "prefers-contrast: more" }, { "type": "screenshot", "path": "evidence/home-dark.png", "caption": "home dark evidence", "findingIds": [ "F01" ], "condition": "prefers-color-scheme: dark" }, { "type": "screenshot", "path": "evidence/home-desktop.png", "caption": "home desktop evidence" }, { "type": "screenshot", "path": "evidence/home-dismissed.png", "caption": "home dismissed evidence" }, { "type": "screenshot", "path": "evidence/home-mobile.png", "caption": "home mobile evidence", "findingIds": [ "F04", "F05" ], "condition": "viewport: 360x800" }, { "type": "other", "path": "evidence/home-probe.json", "caption": "home probe evidence", "findingIds": [ "F05", "F14", "F22", "F27" ] }, { "type": "har-summary", "path": "evidence/home-summary.json", "caption": "home summary evidence", "findingIds": [ "F11", "F19", "F25", "F26" ] }, { "type": "trace-summary", "path": "evidence/home-trace-summary.json", "caption": "home trace summary evidence", "findingIds": [ "F08", "F10" ] }, { "type": "trace", "path": "evidence/home-trace.json", "caption": "home trace evidence" }, { "type": "har", "path": "evidence/home.har", "caption": "home evidence", "findingIds": [ "F11" ] }, { "type": "other", "path": "evidence/images.json", "caption": "images evidence", "findingIds": [ "F16", "F24" ] }, { "type": "other", "path": "evidence/interaction-structure.json", "caption": "interaction structure evidence", "findingIds": [ "F06", "F07" ] }, { "type": "layout", "path": "evidence/layout-desktop.json", "caption": "layout desktop evidence", "findingIds": [ "F03", "F09" ] }, { "type": "layout", "path": "evidence/layout-mobile.json", "caption": "layout mobile evidence", "findingIds": [ "F09" ], "condition": "viewport: 360x800" }, { "type": "lighthouse", "path": "evidence/lighthouse-summary.json", "caption": "lighthouse summary evidence" }, { "type": "lighthouse", "path": "evidence/lighthouse.json", "caption": "lighthouse evidence", "findingIds": [ "F08", "F09", "F10", "F12", "F13", "F14", "F15", "F17", "F19", "F25" ] }, { "type": "other", "path": "evidence/memory-metrics.json", "caption": "memory metrics evidence" }, { "type": "other", "path": "evidence/platform-features.json", "caption": "platform features evidence", "findingIds": [ "F01", "F02", "F03", "F22", "F27" ] }, { "type": "other", "path": "evidence/pricing-meta.json", "caption": "pricing meta evidence" }, { "type": "screenshot", "path": "evidence/pricing-mobile.png", "caption": "pricing mobile evidence", "findingIds": [ "F04" ], "condition": "viewport: 360x800" }, { "type": "other", "path": "evidence/product-meta.json", "caption": "product meta evidence", "findingIds": [ "F14" ] }, { "type": "other", "path": "evidence/reduced-motion.json", "caption": "reduced motion evidence" }, { "type": "other", "path": "evidence/secrets.json", "caption": "secrets evidence" }, { "type": "screenshot", "path": "evidence/signup-errors.png", "caption": "signup errors evidence" }, { "type": "screenshot", "path": "evidence/signup-mobile.png", "caption": "signup mobile evidence", "findingIds": [ "F20" ], "condition": "viewport: 360x800" }, { "type": "other", "path": "evidence/signup-probe.json", "caption": "signup probe evidence", "findingIds": [ "F20", "F23" ] }, { "type": "other", "path": "evidence/signup-validation.json", "caption": "signup validation evidence" }, { "type": "other", "path": "evidence/trackers.json", "caption": "trackers evidence", "findingIds": [ "F19", "F26" ] }, { "type": "screenshot", "path": "evidence/url-shortener-mobile.png", "caption": "url shortener mobile evidence", "condition": "viewport: 360x800" } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 58, "blocked": 0, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": true }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "issues", "confidence": "high", "method": "Compared normal and dark screenshots and probed media/CSS state.", "evidence": "Dark emulation produced the same visual/bytes; no dark rules and color-scheme is normal.", "artifacts": [ "evidence/home-dark.png", "evidence/platform-features.json" ], "pathIds": [ "home" ], "findingIds": [ "F01" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "pass", "confidence": "medium", "method": "Emulated prefers-reduced-motion: reduce and inspected active animations.", "evidence": "The condition matched and document.getAnimations() returned no running animations on load.", "artifacts": [ "evidence/reduced-motion.json" ], "pathIds": [ "home" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "pass", "confidence": "medium", "method": "Captured prefers-contrast: more and inspected contrast rules plus Lighthouse.", "evidence": "Controls and text remain visible under increased contrast; stylesheet probing found a contrast media rule.", "artifacts": [ "evidence/home-contrast.png", "evidence/platform-features.json" ], "pathIds": [ "home" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "issues", "confidence": "medium", "method": "Inspected runtime/CSS for View Transition use across MPA routes.", "evidence": "No view-transition CSS was found and tested route changes use ordinary full-page navigation.", "artifacts": [ "evidence/platform-features.json" ], "pathIds": [ "home" ], "findingIds": [ "F02" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "not-applicable", "confidence": "high", "method": "Inspected runtime and CSS for scroll-linked effects.", "evidence": "No scroll-linked animation was present on sampled paths, so there is no such effect to implement declaratively.", "reason": "No scroll-linked motion was observed on the representative paths." }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "not-applicable", "confidence": "high", "method": "Reviewed mobile screenshots and interactive controls for gesture-driven UI.", "evidence": "The representative paths use links, forms and buttons rather than custom swipe/pull interactions.", "reason": "No gesture-driven interaction is part of the sampled public flows." }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "issues", "confidence": "medium", "method": "Compared long-page layout with scroll-state/timeline feature probes.", "evidence": "The page is 8,568 px tall but offers static chrome and no scroll-state/timeline cue.", "artifacts": [ "evidence/layout-desktop.json", "evidence/platform-features.json" ], "pathIds": [ "home" ], "findingIds": [ "F03" ] }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "not-applicable", "confidence": "medium", "method": "Reviewed sampled states for tooltips or tethered popovers.", "evidence": "No tooltip or anchored transient overlay was presented in the sampled journeys.", "reason": "No anchored overlay was encountered in the exercised paths." }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "pass", "confidence": "high", "method": "Reviewed first-view screenshots, CTA labels and skip navigation.", "evidence": "First views have strong descriptive headings/CTAs, and the DOM contains a Skip Navigation link.", "artifacts": [ "evidence/home-dismissed.png", "evidence/signup-mobile.png", "evidence/home-probe.json" ], "pathIds": [ "home", "signup" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "issues", "confidence": "high", "method": "Captured on-load screenshots across four marketing templates.", "evidence": "The consent surface obscures most of the mobile viewport on home, pricing and article routes.", "artifacts": [ "evidence/home-mobile.png", "evidence/pricing-mobile.png", "evidence/article-mobile.png" ], "pathIds": [ "home", "pricing", "article" ], "findingIds": [ "F04" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "issues", "confidence": "high", "method": "Inspected overlay DOM primitives.", "evidence": "The visible consent overlay is implemented with neither dialog nor popover (counts are both zero).", "artifacts": [ "evidence/home-probe.json", "evidence/home-mobile.png" ], "pathIds": [ "home" ], "findingIds": [ "F05" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "pass", "confidence": "high", "method": "Dismissed consent and reviewed the content/chrome proportion.", "evidence": "After dismissal, primary content dominates the viewport and header chrome is compact.", "artifacts": [ "evidence/home-dismissed.png" ], "pathIds": [ "home" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "pass", "confidence": "high", "method": "Measured desktop/mobile overflow and reviewed mobile templates.", "evidence": "At 360 px, horizontalOverflowPx is 0 and all sampled mobile templates reflow without clipping.", "artifacts": [ "evidence/layout-mobile.json", "evidence/url-shortener-mobile.png", "evidence/pricing-mobile.png" ], "pathIds": [ "home", "url-shortener", "pricing" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "issues", "confidence": "medium", "method": "Inspected accessible stylesheets for @container usage.", "evidence": "No container query was found in the loaded accessible CSS despite reusable modules.", "artifacts": [ "evidence/interaction-structure.json" ], "pathIds": [ "home" ], "findingIds": [ "F06" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "issues", "confidence": "high", "method": "Measured visible target bounds and programmatically focused the first control.", "evidence": "Focus outline is visible, but 81/95 controls have a dimension under 44 px, including a 38×38 menu.", "artifacts": [ "evidence/interaction-structure.json" ], "pathIds": [ "home" ], "findingIds": [ "F07" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "pass", "confidence": "high", "method": "Reviewed first view, headings, navigation labels and CTAs across core templates.", "evidence": "Home, product, pricing, article and signup views communicate purpose and expose a clear next action.", "artifacts": [ "evidence/home-dismissed.png", "evidence/url-shortener-mobile.png", "evidence/pricing-mobile.png", "evidence/signup-mobile.png" ], "pathIds": [ "home", "url-shortener", "pricing", "signup" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "pass", "confidence": "medium", "method": "Walked from public CTAs to signup without creating an account.", "evidence": "The CTA leads to a concise labelled account form with email/password and Google options; no dead end appears before the irreversible account-creation step.", "artifacts": [ "evidence/signup-mobile.png", "evidence/signup-probe.json" ], "pathIds": [ "home", "signup" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "pass", "confidence": "high", "method": "Submitted the empty signup form and loaded a missing URL.", "evidence": "Signup exposes a clear email error and password requirements; the 404 explains the error and corrective action.", "artifacts": [ "evidence/signup-validation.json", "evidence/404-mobile.png" ], "pathIds": [ "signup", "404" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "high", "method": "Ran Lighthouse, trace and layout observers.", "evidence": "Lighthouse LCP is 23.39 s with CLS 0.112 and TBT 251 ms; trace LCP is 7.31 s.", "artifacts": [ "evidence/lighthouse.json", "evidence/home-trace-summary.json" ], "pathIds": [ "home" ], "findingIds": [ "F08" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "issues", "confidence": "high", "method": "Observed layout shifts in desktop/mobile and corroborated with Lighthouse.", "evidence": "CLS ranged from 0.084–0.112 with late shifts around 2.6–3.8 s.", "artifacts": [ "evidence/layout-desktop.json", "evidence/layout-mobile.json", "evidence/lighthouse.json" ], "pathIds": [ "home" ], "findingIds": [ "F09" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "issues", "confidence": "high", "method": "Measured long tasks/TBT with Lighthouse and trace.", "evidence": "Lighthouse TBT is 251 ms; trace captured an 81.85 ms long task.", "artifacts": [ "evidence/lighthouse.json", "evidence/home-trace-summary.json" ], "pathIds": [ "home" ], "findingIds": [ "F10" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "Captured HAR and confirmed parser-inserted stylesheet placement from DOM metadata.", "evidence": "166 requests transfer 3.88 MB, with 24 stylesheets and a long parser-inserted VeryHigh-priority CSS chain.", "artifacts": [ "evidence/home-summary.json", "evidence/home-probe.json" ], "pathIds": [ "home" ], "findingIds": [ "F11" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "high", "method": "Ran Lighthouse code-coverage opportunities and HAR.", "evidence": "Estimated waste is 704 KiB JS plus 447 KiB CSS.", "artifacts": [ "evidence/lighthouse.json", "evidence/home-summary.json" ], "pathIds": [ "home" ], "findingIds": [ "F12" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "pass", "confidence": "high", "method": "Ran Lighthouse accessibility audits and inspected forms/buttons.", "evidence": "Lighthouse reported no label or image-alt failures; signup controls have visible labels and controls have accessible text/ARIA.", "artifacts": [ "evidence/lighthouse.json", "evidence/signup-probe.json" ], "pathIds": [ "home", "signup" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "issues", "confidence": "high", "method": "Ran Lighthouse color contrast audit.", "evidence": "A preheading measures 4.19:1 instead of 4.5:1.", "artifacts": [ "evidence/lighthouse.json" ], "pathIds": [ "home" ], "findingIds": [ "F13" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "issues", "confidence": "high", "method": "Inspected headings/landmarks/focus and ran Lighthouse.", "evidence": "Landmarks and focus outline exist, but home/product lack H1 in probes and Lighthouse reports skipped heading levels.", "artifacts": [ "evidence/home-probe.json", "evidence/product-meta.json", "evidence/interaction-structure.json", "evidence/lighthouse.json" ], "pathIds": [ "home", "url-shortener" ], "findingIds": [ "F14" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "pass", "confidence": "high", "method": "Visually reviewed desktop and mobile typography across templates.", "evidence": "Body copy has comfortable line length/spacing and no sampled text clipping; mobile headings wrap clearly.", "artifacts": [ "evidence/home-dismissed.png", "evidence/pricing-mobile.png", "evidence/article-mobile.png" ], "pathIds": [ "home", "pricing", "article" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "pass", "confidence": "medium", "method": "Checked viewport policy, 360 px reflow, Lighthouse target-size and media inventory.", "evidence": "Viewport allows scaling, pages reflow without overflow, Lighthouse target-size audit has no failing nodes, and no media needing captions was found.", "artifacts": [ "evidence/layout-mobile.json", "evidence/lighthouse.json", "evidence/home-probe.json" ], "pathIds": [ "home" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "issues", "confidence": "high", "method": "Ran Lighthouse console audit on normal load.", "evidence": "Two identity-related errors were logged on unauthenticated public load.", "artifacts": [ "evidence/lighthouse.json" ], "pathIds": [ "home" ], "findingIds": [ "F15" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "issues", "confidence": "high", "method": "Probed doctype/charset and ran image audit.", "evidence": "Doctype and UTF-8 pass, but 22 images lack dimensions and 10 are oversized.", "artifacts": [ "evidence/platform-features.json", "evidence/images.json" ], "pathIds": [ "home" ], "findingIds": [ "F16" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "issues", "confidence": "medium", "method": "Reviewed Lighthouse deprecation, BFCache, prompt and inspector diagnostics.", "evidence": "Deprecation/BFCache/prompt checks pass, but a broken Snowplow source map and Optimizely cookie inspector issue remain.", "artifacts": [ "evidence/lighthouse.json" ], "pathIds": [ "home" ], "findingIds": [ "F17" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "pass", "confidence": "high", "method": "Probed title/description across representative templates and ran Lighthouse SEO.", "evidence": "Home, product, pricing and article have unique descriptive titles/descriptions; SEO score is 0.92.", "artifacts": [ "evidence/home-probe.json", "evidence/product-meta.json", "evidence/pricing-meta.json", "evidence/article-meta.json" ], "pathIds": [ "home", "url-shortener", "pricing", "article" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "pass", "confidence": "high", "method": "Inspected hrefs/viewport/robots and ran Lighthouse SEO.", "evidence": "Real descriptive hrefs and viewport meta are present; robots welcomes general crawlers and Lighthouse found no crawlable-anchor failures.", "artifacts": [ "evidence/home-probe.json", "evidence/crawl-and-404.json", "evidence/lighthouse.json" ], "pathIds": [ "home" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "pass", "confidence": "high", "method": "Inspected canonical/robots/hreflang and fetched robots/HTTP status.", "evidence": "Public samples return success, expose canonicals, localized alternates and indexable robots policy; robots lists two sitemap indexes.", "artifacts": [ "evidence/home-probe.json", "evidence/product-meta.json", "evidence/article-meta.json", "evidence/crawl-and-404.json" ], "pathIds": [ "home", "url-shortener", "article" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "pass", "confidence": "high", "method": "Inspected JSON-LD and social metadata against visible content.", "evidence": "Home/product/article expose JSON-LD; home has complete Open Graph/Twitter image metadata matching the visible Bitly entity.", "artifacts": [ "evidence/home-probe.json", "evidence/product-meta.json", "evidence/article-meta.json" ], "pathIds": [ "home", "url-shortener", "article" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "issues", "confidence": "high", "method": "Ran headers, cookies, secrets and HAR primitives.", "evidence": "HTTPS/HSTS and X-Frame-Options pass with no exposed secret, but CSP and nosniff are missing.", "artifacts": [ "evidence/headers.json", "evidence/secrets.json", "evidence/cookies.json" ], "pathIds": [ "home" ], "findingIds": [ "F18" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "issues", "confidence": "high", "method": "Ran trackers/HAR/Lighthouse third-party diagnostics.", "evidence": "19 third-party origins, five known trackers, and an Optimizely third-party cookie were observed.", "artifacts": [ "evidence/trackers.json", "evidence/home-summary.json", "evidence/lighthouse.json" ], "pathIds": [ "home" ], "findingIds": [ "F19" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "issues", "confidence": "high", "method": "Inspected signup auth/autocomplete and Lighthouse permission-on-load audits.", "evidence": "No permission prompts fire on load, but signup has password/SSO only, no passkey signal, and empty autocomplete.", "artifacts": [ "evidence/signup-probe.json", "evidence/lighthouse.json" ], "pathIds": [ "signup" ], "findingIds": [ "F20" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "high", "method": "Inspected main response security policies.", "evidence": "HSTS and X-Frame-Options are present; CSP, Referrer-Policy, Permissions-Policy and nosniff are absent.", "artifacts": [ "evidence/headers.json" ], "pathIds": [ "home" ], "findingIds": [ "F21" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "pass", "confidence": "high", "method": "Ran discoverability/no-JS raw HTML comparison.", "evidence": "91% of rendered content words exist in raw HTML; the site is not a JS shell and title/description survive without JS.", "artifacts": [ "evidence/discoverability", "evidence/discoverability-crawler.png" ], "pathIds": [ "home" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "pass", "confidence": "medium", "method": "Reviewed responsive overlays/navigation and error states across viewports.", "evidence": "Sampled routes remain usable without cut-off horizontal content and the missing route resolves to a stable explanatory page.", "artifacts": [ "evidence/layout-mobile.json", "evidence/404-mobile.png" ], "pathIds": [ "home" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "not-applicable", "confidence": "high", "method": "Checked page type and manifest/service-worker signals.", "evidence": "This is a public marketing MPA, not an installable application; no manifest is declared.", "reason": "Offline/installability is not proportionate for the sampled marketing and article surfaces." }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "pass", "confidence": "high", "method": "Loaded a representative missing URL and captured its response/state.", "evidence": "The server returns HTTP 404 and a clear page explaining the wrong address and how to recover.", "artifacts": [ "evidence/crawl-and-404.json", "evidence/404-mobile.png" ], "pathIds": [ "404" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "issues", "confidence": "high", "method": "Inspected lang/dir, localized links and logical CSS feature use.", "evidence": "lang and localized alternates exist, but dir is absent and no logical spacing/position rules were found.", "artifacts": [ "evidence/home-probe.json", "evidence/platform-features.json" ], "pathIds": [ "home" ], "findingIds": [ "F22" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "not-applicable", "confidence": "high", "method": "Reviewed representative rendered content/forms for locale-sensitive data.", "evidence": "No user-facing dates, currencies, measurements or durations requiring locale formatting appear in the sampled core flow.", "reason": "The sampled core marketing/signup flow contains no locale-sensitive data value to format." }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "not-applicable", "confidence": "high", "method": "Reviewed representative content for scheduled or stored time concepts.", "evidence": "No event scheduling, recurring time or timezone-sensitive value appears in the sampled flow.", "reason": "No timezone-sensitive task exists in the representative paths." }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "pass", "confidence": "high", "method": "Reviewed consent, pricing and signup terms visually.", "evidence": "Accept All and Reject All have equal prominence, pricing purpose is explicit, and signup terms are visible before submission.", "artifacts": [ "evidence/home-mobile.png", "evidence/pricing-mobile.png", "evidence/signup-mobile.png" ], "pathIds": [ "home", "pricing", "signup" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "pass", "confidence": "high", "method": "Submitted the signup form empty and inspected accessible validation state.", "evidence": "After interaction, email receives aria-invalid=true with “Please enter your email address”; password requirements are stated without blame.", "artifacts": [ "evidence/signup-validation.json" ], "pathIds": [ "signup" ] }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "issues", "confidence": "high", "method": "Inspected signup input labels and autocomplete tokens.", "evidence": "Email/password labels exist but autocomplete values are empty.", "artifacts": [ "evidence/signup-probe.json" ], "pathIds": [ "signup" ], "findingIds": [ "F23" ] }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "pass", "confidence": "medium", "method": "Reviewed pricing and pre-account signup surfaces without creating an account.", "evidence": "Pricing intent, free-account action, SSO alternative and linked legal commitments are visible before account creation.", "artifacts": [ "evidence/pricing-mobile.png", "evidence/signup-mobile.png" ], "pathIds": [ "pricing", "signup" ] }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "issues", "confidence": "high", "method": "Ran image inventory and HAR resource accounting.", "evidence": "10 oversized, 15 legacy-format and 20 non-responsive images were detected.", "artifacts": [ "evidence/images.json", "evidence/home-summary.json" ], "pathIds": [ "home" ], "findingIds": [ "F24" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "issues", "confidence": "high", "method": "Compared shipped scripts/styles and Lighthouse code coverage to page purpose.", "evidence": "The marketing page ships 40 scripts/24 stylesheets with about 1.15 MiB estimated unused code.", "artifacts": [ "evidence/home-summary.json", "evidence/lighthouse.json" ], "pathIds": [ "home" ], "findingIds": [ "F25" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "issues", "confidence": "high", "method": "Measured third-party requests/bytes and inspected media/autoplay.", "evidence": "No autoplay media exists, but 19 third-party origins and multiple large tag-manager scripts dominate a 3.88 MB load.", "artifacts": [ "evidence/trackers.json", "evidence/home-summary.json", "evidence/home-probe.json" ], "pathIds": [ "home" ], "findingIds": [ "F26" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "issues", "confidence": "medium", "method": "Inspected agent-related navigation and browser WebMCP runtime.", "evidence": "Bitly advertises MCP/LLM integrations, but navigator.modelContext is not used on the sampled browser surface.", "artifacts": [ "evidence/home-probe.json", "evidence/platform-features.json" ], "pathIds": [ "home" ], "findingIds": [ "F27" ] }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "high", "method": "Reviewed sampled public tasks for an appropriate local inference use case.", "evidence": "The core shortening, pricing and signup tasks do not require in-browser language-model or summarization inference.", "reason": "On-device inference would not improve the representative core tasks." }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "pass", "confidence": "medium", "method": "Compared baseline and post heap summaries after ten bottom/top scroll cycles.", "evidence": "Node count fell 586,451→585,860 while total self size rose only 35.71→36.06 MB (~1%); closures also fell.", "artifacts": [ "evidence/heap-baseline.heapsnapshot", "evidence/heap-after-scroll.heapsnapshot" ], "pathIds": [ "home" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "pass", "confidence": "medium", "method": "Reviewed heap totals and constructor distribution against page complexity.", "evidence": "Heap summary is ~35.7 MB for the third-party-heavy marketing page and remains proportionate/stable after interaction.", "artifacts": [ "evidence/heap-baseline.heapsnapshot", "evidence/heap-after-scroll.heapsnapshot" ], "pathIds": [ "home" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "pass", "confidence": "medium", "method": "Compared heap type/constructor populations and instrumented listeners/timers during repeated scrolling.", "evidence": "No Detached* constructor appears among top retained constructors; node/closure counts do not grow and no new interval was created.", "artifacts": [ "evidence/heap-baseline.heapsnapshot", "evidence/heap-after-scroll.heapsnapshot", "evidence/memory-metrics.json" ], "pathIds": [ "home" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F01" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "issues", "findingIds": [ "F02" ] }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "issues", "findingIds": [ "F03" ] }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "issues", "findingIds": [ "F04", "F05" ] }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "issues", "findingIds": [ "F06", "F07" ] }, { "principleId": "support-core-task-success", "expectation": "default", "status": "pass" }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F08", "F09", "F10", "F11", "F12" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F13", "F14" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "issues", "findingIds": [ "F15", "F16", "F17" ] }, { "principleId": "be-discoverable", "expectation": "default", "status": "pass" }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F18", "F19", "F20", "F21" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "pass" }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "issues", "findingIds": [ "F22" ] }, { "principleId": "be-trustworthy", "expectation": "default", "status": "issues", "findingIds": [ "F23" ] }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F24", "F25", "F26" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "issues", "findingIds": [ "F27" ] }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "pass" } ], "paths": [ { "id": "home", "description": "Entry and primary marketing template; tested normal, dark, increased contrast, reduced motion, desktop/mobile, no-JS, network, security and repeated scrolling.", "url": "https://bit.ly", "conditions": [ "desktop", "viewport: 360x800", "prefers-color-scheme: dark", "prefers-contrast: more", "prefers-reduced-motion: reduce", "JavaScript disabled/raw HTML", "repeated scroll x10" ], "result": "issues" }, { "id": "url-shortener", "description": "Representative product-detail template for the core shortening offer.", "url": "https://bitly.com/pages/products/url-shortener", "conditions": [ "viewport: 360x800", "metadata/heading probe" ], "result": "issues" }, { "id": "pricing", "description": "Commercial plan-selection template and commitment clarity.", "url": "https://bitly.com/pages/pricing", "conditions": [ "viewport: 360x800", "metadata probe" ], "result": "issues" }, { "id": "article", "description": "Representative editorial/content template.", "url": "https://bitly.com/blog/introducing-bitly-assist-weekly-insights/", "conditions": [ "viewport: 360x800", "metadata probe" ], "result": "issues" }, { "id": "signup", "description": "Primary account-creation flow up to, but not including, account creation; exercised empty-submit validation.", "url": "https://bitly.com/a/sign_up", "conditions": [ "viewport: 360x800", "empty form submission" ], "result": "issues" }, { "id": "404", "description": "Representative HTTP failure and recovery state.", "url": "https://bitly.com/this-path-should-not-exist-web-uplift", "conditions": [ "viewport: 360x800" ], "result": "pass" }, { "id": "excluded", "description": "Not covered: localized duplicates, other product/solution pages sharing sampled templates, authenticated product UI, checkout/cancellation, and actual account creation because they require credentials, transactions, or side effects.", "result": "skipped" } ], "findings": [ { "id": "F01", "severity": "medium", "principleId": "respect-user-preferences", "principleCheckId": "respects-color-scheme", "guidanceId": "dark-mode", "guidanceCategory": "user-experience", "summary": "The public site ignores the user’s dark color-scheme preference.", "evidence": "The dark-condition screenshot is byte-identical to the normal screenshot (82,752 bytes), and the platform probe reports color-scheme: normal with no prefers-color-scheme rules.", "suggestedFix": "Declare color-scheme and provide preference-driven light/dark surface and text tokens using prefers-color-scheme or light-dark().", "artifacts": [ "evidence/home-dark.png", "evidence/platform-features.json" ], "effort": "medium", "pathId": "home", "url": "https://bitly.com/", "confidence": "high" }, { "id": "F02", "severity": "low", "principleId": "implement-natural-interactions", "principleCheckId": "view-transitions", "guidanceId": "css", "guidanceCategory": "css", "summary": "Route and major state changes do not use View Transitions.", "evidence": "The platform probe found no view-transition CSS; tested navigation is a conventional MPA swap.", "suggestedFix": "Use cross-document View Transitions for same-origin marketing routes, with reduced-motion handling.", "artifacts": [ "evidence/platform-features.json" ], "effort": "medium", "pathId": "home", "url": "https://bitly.com/", "confidence": "high" }, { "id": "F03", "severity": "low", "principleId": "provide-guided-navigation", "principleCheckId": "scroll-state-aware-chrome", "guidanceId": "css", "guidanceCategory": "css", "summary": "Long pages provide no scroll-state-aware orientation.", "evidence": "The home page is 8,568 px tall, but the platform probe found no scroll timeline and screenshots show static chrome with no progress or scrolled-state cue.", "suggestedFix": "Add a lightweight scroll-state cue or progress affordance on long content routes; avoid a scroll event loop.", "artifacts": [ "evidence/layout-desktop.json", "evidence/platform-features.json" ], "effort": "small", "pathId": "home", "url": "https://bitly.com/", "confidence": "high" }, { "id": "F04", "severity": "high", "principleId": "maximize-content-reduce-noise", "principleCheckId": "no-intrusive-interruptions", "guidanceId": "declarative-dialog-popover-control", "guidanceCategory": "user-experience", "summary": "The cookie banner obscures most of the first mobile viewport on every marketing template.", "evidence": "At 360×800, the on-load banner covers the primary content from y=358 through the viewport bottom on home and pricing, and similarly obscures the article.", "suggestedFix": "Use a compact, content-respecting consent surface that keeps equally prominent accept/reject controls without covering the primary task.", "artifacts": [ "evidence/home-mobile.png", "evidence/pricing-mobile.png", "evidence/article-mobile.png" ], "effort": "small", "pathId": "home", "url": "https://bitly.com/", "confidence": "high" }, { "id": "F05", "severity": "medium", "principleId": "maximize-content-reduce-noise", "principleCheckId": "semantic-dismissible-primitives", "guidanceId": "declarative-dialog-popover-control", "guidanceCategory": "user-experience", "summary": "The consent overlay is custom chrome rather than a semantic dialog.", "evidence": "The DOM probe found 0 dialog and 0 popover elements while the screenshots show a modal-like consent surface with custom close and preference controls.", "suggestedFix": "Represent modal consent settings with and declarative close controls, preserving equal accept/reject choices and focus management.", "artifacts": [ "evidence/home-probe.json", "evidence/home-mobile.png" ], "effort": "medium", "pathId": "home", "url": "https://bitly.com/", "confidence": "high" }, { "id": "F06", "severity": "low", "principleId": "adapt-to-the-form-factor", "principleCheckId": "component-level-responsiveness", "guidanceId": "size-aware-styling", "guidanceCategory": "user-experience", "summary": "The marketing component system does not use component-level responsiveness.", "evidence": "The live stylesheet probe found no @container rules; components depend on viewport-level behavior despite many reusable cards and navigation modules.", "suggestedFix": "Introduce container-type and targeted @container rules for reusable card, hero, and CTA modules.", "artifacts": [ "evidence/interaction-structure.json" ], "effort": "medium", "pathId": "home", "url": "https://bitly.com/", "confidence": "high" }, { "id": "F07", "severity": "medium", "principleId": "adapt-to-the-form-factor", "principleCheckId": "input-modality-aware", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "summary": "Many visible controls have sub-44px touch dimensions.", "evidence": "At 360 px, 81 of 95 visible interactive elements had at least one dimension below 44 px; the menu button measured 38×38 and the sign-up CTA 38 px high.", "suggestedFix": "Give primary controls and icon buttons at least a 44×44 CSS pixel hit area while retaining visible keyboard focus.", "artifacts": [ "evidence/interaction-structure.json" ], "effort": "small", "pathId": "home", "url": "https://bitly.com/", "confidence": "high" }, { "id": "F08", "severity": "high", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "guidanceId": "performance", "guidanceCategory": "performance", "summary": "Cold-load LCP is far outside the good range.", "evidence": "Lighthouse measured LCP 23.39 s, FCP 8.26 s, CLS 0.112 and TBT 251 ms (performance score 0.47); the independent trace measured LCP 7.31 s.", "suggestedFix": "Prioritise the LCP content, shorten render-blocking chains, defer nonessential scripts, and retest under the same mobile conditions.", "artifacts": [ "evidence/lighthouse.json", "evidence/home-trace-summary.json" ], "effort": "large", "pathId": "home", "url": "https://bitly.com/", "confidence": "high" }, { "id": "F09", "severity": "medium", "principleId": "be-fast-and-stable", "principleCheckId": "visual-stability", "guidanceId": "performance", "guidanceCategory": "performance", "summary": "Late content causes measurable layout shift.", "evidence": "Layout observation measured CLS 0.084 desktop and 0.088 mobile; Lighthouse measured 0.112, crossing the good threshold.", "suggestedFix": "Reserve dimensions for late banners, images, and embeds; stabilise font fallbacks and consent insertion.", "artifacts": [ "evidence/layout-desktop.json", "evidence/layout-mobile.json", "evidence/lighthouse.json" ], "effort": "medium", "pathId": "home", "url": "https://bitly.com/", "confidence": "high" }, { "id": "F10", "severity": "medium", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-main-thread", "guidanceId": "performance", "guidanceCategory": "performance", "summary": "Main-thread work remains heavier than necessary.", "evidence": "Lighthouse measured 251 ms TBT. The trace found one 81.85 ms long task even though its shorter test window totalled only 31.85 ms TBT.", "suggestedFix": "Defer and split nonessential initialization, especially analytics, experimentation, accessibility-widget, and free-tool integrations.", "artifacts": [ "evidence/lighthouse.json", "evidence/home-trace-summary.json" ], "effort": "large", "pathId": "home", "url": "https://bitly.com/", "confidence": "high" }, { "id": "F11", "severity": "high", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "guidanceId": "performance", "guidanceCategory": "performance", "summary": "The load has a large render-blocking and network dependency surface.", "evidence": "The HAR recorded 166 requests and 3.88 MB transferred, including 24 stylesheets and 40 scripts; many parser-inserted, VeryHigh-priority stylesheets are render-blocking candidates.", "suggestedFix": "Consolidate critical CSS, inline only the critical subset, defer noncritical styles and scripts, and set useful caching.", "artifacts": [ "evidence/home-summary.json", "evidence/home.har" ], "effort": "large", "pathId": "home", "url": "https://bitly.com/", "confidence": "high" }, { "id": "F12", "severity": "high", "principleId": "be-fast-and-stable", "principleCheckId": "trim-unused-and-duplicate-code", "guidanceId": "performance", "guidanceCategory": "performance", "summary": "The page ships substantial unused CSS and JavaScript.", "evidence": "Lighthouse estimated 704 KiB unused JavaScript and 447 KiB unused CSS, including 93% unused Foundation CSS and 99.9% unused animate.css.", "suggestedFix": "Remove page-global bundles, tree-shake or route-split integrations, and load third-party features only when needed.", "artifacts": [ "evidence/lighthouse.json" ], "effort": "large", "pathId": "home", "url": "https://bitly.com/", "confidence": "high" }, { "id": "F13", "severity": "medium", "principleId": "be-inclusive", "principleCheckId": "sufficient-contrast", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "summary": "A visible preheading misses WCAG contrast minimums.", "evidence": "Lighthouse measured 4.19:1 for “GREAT CONNECTIONS START WITH A CLICK OR SCAN” (#777570 on #f7f4ee), below the required 4.5:1.", "suggestedFix": "Darken the text token or adjust the background so normal text reaches at least 4.5:1 in all themes.", "artifacts": [ "evidence/lighthouse.json" ], "effort": "trivial", "pathId": "home", "url": "https://bitly.com/", "confidence": "high" }, { "id": "F14", "severity": "medium", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "summary": "Heading hierarchy is inconsistent on key marketing templates.", "evidence": "The home probe exposed no H1 and began with many H3 elements; the URL Shortener probe also found no H1. Lighthouse reported H3 and H5 heading-order failures.", "suggestedFix": "Use one descriptive H1 per template and nest subsequent headings without skipping levels; keep visual styling separate from heading rank.", "artifacts": [ "evidence/home-probe.json", "evidence/product-meta.json", "evidence/lighthouse.json" ], "effort": "medium", "pathId": "home", "url": "https://bitly.com/", "confidence": "high" }, { "id": "F15", "severity": "low", "principleId": "follow-best-practices", "principleCheckId": "no-console-errors", "guidanceId": "html", "guidanceCategory": "html", "summary": "The home page logs errors during normal load.", "evidence": "Lighthouse captured a Google Identity FedCM NetworkError and “Not signed in with the identity provider” on a public unauthenticated load.", "suggestedFix": "Do not initialise sign-in flows until requested; handle unavailable identity state without console errors.", "artifacts": [ "evidence/lighthouse.json" ], "effort": "small", "pathId": "home", "url": "https://bitly.com/", "confidence": "high" }, { "id": "F16", "severity": "medium", "principleId": "follow-best-practices", "principleCheckId": "sound-document-and-assets", "guidanceId": "html", "guidanceCategory": "html", "summary": "Image delivery has sizing and responsive-source gaps.", "evidence": "The image primitive found 22 images without dimensions, 10 oversized images, 20 without srcset, and 19 below-fold images not lazily loaded.", "suggestedFix": "Add intrinsic width/height, responsive srcset/sizes, and lazy loading for below-fold content; verify aspect ratios.", "artifacts": [ "evidence/images.json" ], "effort": "medium", "pathId": "home", "url": "https://bitly.com/", "confidence": "high" }, { "id": "F17", "severity": "low", "principleId": "follow-best-practices", "principleCheckId": "browser-platform-hygiene", "guidanceId": "html", "guidanceCategory": "html", "summary": "Developer diagnostics include a broken third-party source map and an inspector cookie issue.", "evidence": "Lighthouse emitted a Snowplow source-map column-out-of-bounds warning and reported an Optimizely client-storage cookie inspector issue.", "suggestedFix": "Update or remove the affected third-party bundle and verify clean source maps and DevTools Issues output.", "artifacts": [ "evidence/lighthouse.json" ], "effort": "small", "pathId": "home", "url": "https://bitly.com/", "confidence": "medium" }, { "id": "F18", "severity": "high", "principleId": "be-private-and-secure", "principleCheckId": "secure-transport-and-headers", "guidanceId": "security", "guidanceCategory": "security", "summary": "Core browser security headers are missing.", "evidence": "HTTPS and HSTS are present, but the main response lacks Content-Security-Policy and X-Content-Type-Options.", "suggestedFix": "Deploy CSP in report-only mode, converge on a restrictive policy, send nosniff, and keep HSTS and clickjacking protection.", "artifacts": [ "evidence/headers.json" ], "effort": "medium", "pathId": "home", "url": "https://bitly.com/", "confidence": "high" }, { "id": "F19", "severity": "high", "principleId": "be-private-and-secure", "principleCheckId": "data-minimisation-and-third-parties", "guidanceId": "privacy", "guidanceCategory": "privacy", "summary": "The public landing page has a broad tracking and third-party footprint.", "evidence": "The tracker probe saw 19 third-party origins and five known tracker domains; Lighthouse found an Optimizely third-party cookie. The HAR transferred 3.88 MB across 166 requests.", "suggestedFix": "Reduce trackers to demonstrated needs, gate optional vendors on consent, and lazy-load integrations only at the point of user value.", "artifacts": [ "evidence/trackers.json", "evidence/home-summary.json", "evidence/lighthouse.json" ], "effort": "large", "pathId": "home", "url": "https://bitly.com/", "confidence": "high" }, { "id": "F20", "severity": "medium", "principleId": "be-private-and-secure", "principleCheckId": "in-context-permissions-and-modern-auth", "guidanceId": "passkeys", "guidanceCategory": "passkeys", "summary": "Account creation lacks passkey support and useful credential autocomplete.", "evidence": "The signup flow offers password and Google SSO, with no passkey/WebAuthn signal; email and password inputs expose empty autocomplete values. No permission prompt fired on load.", "suggestedFix": "Add passkey registration/authentication and correct email/new-password autocomplete tokens, retaining federated sign-in as a choice.", "artifacts": [ "evidence/signup-probe.json", "evidence/signup-mobile.png" ], "effort": "large", "pathId": "signup", "url": "https://bitly.com/a/sign_up", "confidence": "high" }, { "id": "F21", "severity": "medium", "principleId": "be-private-and-secure", "principleCheckId": "defensive-browser-policies", "guidanceId": "security", "guidanceCategory": "security", "summary": "Several defensive response policies are absent.", "evidence": "The headers probe found no Referrer-Policy or Permissions-Policy; clickjacking protection (X-Frame-Options: DENY) and HSTS are present.", "suggestedFix": "Set a strict referrer policy and a least-privilege Permissions-Policy, then evaluate CSP frame-ancestors as the modern clickjacking control.", "artifacts": [ "evidence/headers.json" ], "effort": "small", "pathId": "home", "url": "https://bitly.com/", "confidence": "high" }, { "id": "F22", "severity": "medium", "principleId": "be-internationalised", "principleCheckId": "lang-dir-and-logical-properties", "guidanceId": "css", "guidanceCategory": "css", "summary": "Localized routes exist, but the sampled CSS lacks logical-property and explicit direction support.", "evidence": "The page advertises eight localized variants and sets lang=en-US, but dir is empty and the stylesheet probe found no margin/padding/inset logical properties.", "suggestedFix": "Set direction where needed and migrate layout spacing/positioning to logical properties; test at least one RTL locale.", "artifacts": [ "evidence/home-probe.json", "evidence/platform-features.json" ], "effort": "medium", "pathId": "home", "url": "https://bitly.com/", "confidence": "high" }, { "id": "F23", "severity": "medium", "principleId": "be-trustworthy", "principleCheckId": "trustworthy-input-assistance", "guidanceId": "forms", "guidanceCategory": "forms", "summary": "Signup inputs omit autocomplete assistance.", "evidence": "The signup probe found labelled email and password fields but both autocomplete properties were empty.", "suggestedFix": "Use autocomplete=email (or username where appropriate) and autocomplete=new-password, with password-manager-friendly names.", "artifacts": [ "evidence/signup-probe.json" ], "effort": "trivial", "pathId": "signup", "url": "https://bitly.com/a/sign_up", "confidence": "high" }, { "id": "F24", "severity": "medium", "principleId": "be-sustainable", "principleCheckId": "optimised-assets", "guidanceId": "performance", "guidanceCategory": "performance", "summary": "Several image assets are not delivered at an efficient resolution or format.", "evidence": "The image audit found 10 oversized images, 15 legacy-format images, 20 missing responsive sources, and 19 below-fold images not lazy-loaded.", "suggestedFix": "Generate AVIF/WebP variants, supply srcset/sizes, and defer below-fold imagery while retaining dimensions.", "artifacts": [ "evidence/images.json" ], "effort": "medium", "pathId": "home", "url": "https://bitly.com/", "confidence": "high" }, { "id": "F25", "severity": "high", "principleId": "be-sustainable", "principleCheckId": "no-wasteful-work", "guidanceId": "performance", "guidanceCategory": "performance", "summary": "The home page performs disproportionate work before interaction.", "evidence": "The HAR shows 40 scripts and 24 stylesheets; Lighthouse estimates about 1.15 MiB combined unused JS/CSS on a marketing landing page.", "suggestedFix": "Set a page-weight budget, remove unused frameworks/styles, and conditionally initialise analytics and embedded tools.", "artifacts": [ "evidence/home-summary.json", "evidence/lighthouse.json" ], "effort": "large", "pathId": "home", "url": "https://bitly.com/", "confidence": "high" }, { "id": "F26", "severity": "high", "principleId": "be-sustainable", "principleCheckId": "third-party-and-media-budget", "guidanceId": "privacy", "guidanceCategory": "privacy", "summary": "Third-party code consumes a disproportionate share of the page budget.", "evidence": "Tracker evidence found 19 third-party origins; Google Tag Manager/gtag resources alone account for several of the largest scripts, while the load transfers 3.88 MB.", "suggestedFix": "Audit vendor value, collapse duplicate analytics destinations, defer optional vendors, and enforce a third-party byte/request budget.", "artifacts": [ "evidence/trackers.json", "evidence/home-summary.json" ], "effort": "large", "pathId": "home", "url": "https://bitly.com/", "confidence": "high" }, { "id": "F27", "severity": "medium", "principleId": "be-agent-ready", "principleCheckId": "structured-agent-capabilities", "guidanceId": "webmcp", "guidanceCategory": "webmcp", "summary": "Bitly markets MCP and AI integrations but exposes no browser-native structured capability on the audited public surface.", "evidence": "Navigation links prominently advertise Bitly MCP and LLM integrations, making agent readiness applicable, while the runtime probe reports navigator.modelContext absent/unused.", "suggestedFix": "Expose safe, scoped browser actions with declarative agentic forms or WebMCP tools where public shortening and account flows can support them.", "artifacts": [ "evidence/home-probe.json", "evidence/platform-features.json" ], "effort": "large", "pathId": "home", "url": "https://bitly.com/", "confidence": "medium" } ], "taskList": [ { "id": "T01", "title": "Cut render-blocking and unused third-party code", "priority": 1, "findingIds": [ "F08", "F10", "F11", "F12", "F19", "F25", "F26" ], "guidanceId": "performance", "status": "open" }, { "id": "T02", "title": "Replace the viewport-obscuring consent banner with a semantic compact dialog", "priority": 2, "findingIds": [ "F04", "F05" ], "guidanceId": "declarative-dialog-popover-control", "status": "open" }, { "id": "T03", "title": "Deploy CSP and complete defensive response headers", "priority": 3, "findingIds": [ "F18", "F21" ], "guidanceId": "security", "status": "open" }, { "id": "T04", "title": "Stabilise late content and reserve image/banner space", "priority": 4, "findingIds": [ "F09", "F16" ], "guidanceId": "performance", "status": "open" }, { "id": "T05", "title": "Fix heading hierarchy and the failing text contrast token", "priority": 5, "findingIds": [ "F13", "F14" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T06", "title": "Add passkeys and correct signup autocomplete tokens", "priority": 6, "findingIds": [ "F20", "F23" ], "guidanceId": "passkeys", "status": "open" }, { "id": "T07", "title": "Optimise responsive image delivery", "priority": 7, "findingIds": [ "F16", "F24" ], "guidanceId": "performance", "status": "open" }, { "id": "T08", "title": "Add preference-driven dark mode", "priority": 8, "findingIds": [ "F01" ], "guidanceId": "dark-mode", "status": "open" }, { "id": "T09", "title": "Increase touch hit areas", "priority": 9, "findingIds": [ "F07" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T10", "title": "Adopt container queries and logical properties", "priority": 10, "findingIds": [ "F06", "F22" ], "guidanceId": "size-aware-styling", "status": "open" }, { "id": "T11", "title": "Clean console, source-map and inspector diagnostics", "priority": 11, "findingIds": [ "F15", "F17" ], "guidanceId": "html", "status": "open" }, { "id": "T12", "title": "Add route transitions and long-page orientation cues", "priority": 12, "findingIds": [ "F02", "F03" ], "guidanceId": "css", "status": "open" }, { "id": "T13", "title": "Expose safe structured browser agent capabilities", "priority": 13, "findingIds": [ "F27" ], "guidanceId": "webmcp", "status": "open" } ], "budget": { "pathCount": 6, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-19T21-17-49-437Z" }