{ "url": "https://xham.live", "auditedAt": "2026-07-20T01:49:07.227Z", "mode": "report", "status": "completed", "statusDetail": "Atomic coverage complete across 58/58 checks; dynamic model availability and content may vary by visit.", "page": { "appType": "hybrid", "framework": "React/Redux client application with server shell", "notes": "Public adult live-camera listing with category, detail, account and recovery templates. Dynamic/explicit imagery was blurred by the site during the audit." }, "evidenceUsed": [ "screenshot", "dom+computed-styles", "evaluate-probe", "layout-metrics", "trace", "har", "images", "headers", "cookies", "trackers", "secrets", "discoverability", "heap-summary", "lighthouse" ], "guidanceConsulted": [ "dark-mode", "component-specific-light-dark-theme", "accessibility", "adapt-scrollbar-to-contrast-preferences", "same-document-transitions", "cross-document-transitions", "group-element-transitions", "faster-spa-view-transitions", "scrollytelling", "parallax-scroll-effects", "scroll-entry-exit-effects", "carousel-slide-effects", "physics-based-easing", "individual-transform-properties", "animate-element-entry-exit", "animate-to-from-top-layer", "animate-to-intrinsic-sizes", "dynamic-sibling-animations", "interactive-content-reveal", "pull-to-reveal", "swipe-to-remove", "shrinking-header-on-scroll", "scroll-progress-indicator", "scroll-position-aware-elements", "scroll-snap-realtime-feedback", "scroll-snap-state-sync", "scroll-target-on-load", "soft-edge-content-fade", "scrollability-affordance-hints", "anchor-positioning-tab-underline", "position-aware-tooltips", "interest-triggered-tooltips", "interest-triggered-action-previews", "directional-navigation-transitions", "carousel-snap-highlights", "navigation-drawer", "stack-drill-down", "persistent-app-tours", "persistent-toast-notifications", "light-dismiss-a-dialog", "platform-controls-dismiss-dialog", "declarative-dialog-popover-control", "animated-select-picker", "branded-select-styling", "brand-consistent-forms", "custom-select-picker-layouts", "rich-media-picker", "complex-shapes", "shaped-cutouts", "overflow-clipping-control", "visually-texture-content", "apply-webgl-shaders", "interactive-content-in-3d-scenes", "highlight-text-ranges", "prevent-text-wrapping", "customize-scrollbar-color-and-thickness", "export-html-media-from-canvas", "fluid-scaling", "calculate-with-intrinsic-sizes", "css-layout", "size-aware-styling", "content-based-styling", "child-state-based-styling", "design-token-reactivity", "dynamic-sibling-styling", "form-fields-automatically-fit-contents", "improve-text-layout-and-legibility", "forms", "accessible-error-announcement", "required-field-feedback", "validate-input-after-interaction", "identify-inp-causes", "schedule-tasks-by-priority", "optimize-preload-priority", "improve-next-page-load-performance", "interactions-in-complex-layouts", "performance", "visually-stable-font-fallbacks", "break-up-long-tasks", "identify-heavy-scripts", "optimize-script-priority", "defer-rendering-heavy-content", "defer-work-until-scroll-ends", "optimize-image-priority", "conditional-async-dependencies", "expose-canvas-content-to-browser-features", "move-dom-element-without-losing-state", "precise-text-alignment", "visually-stable-mixed-fonts", "css", "html", "reduce-style-repetition", "security", "privacy", "batch-analytics-events", "full-session-analytics", "calculate-total-foreground-time", "passkeys", "passkey-registration", "passkey-authentication", "passkey-reauthentication", "passkey-conditional-create", "passkey-management", "flicker-free-client-side-ab-testing", "consistent-cross-document-transitions", "stabilize-reactive-state", "resilient-context-menus-and-nested-dropdowns", "persistent-top-layer-ui", "detect-initial-visibility-state", "sequence-distributed-events", "translator", "language-detection", "support-global-calendar-systems", "capture-location-agnostic-data", "format-human-readable-durations", "manage-recurring-intervals", "calculate-event-differentials", "coordinate-global-events", "model-partial-time-concepts", "search-hidden-content", "select-menu-interaction", "style-parent-with-has", "autofill-address-form", "autofill-payment-form", "autofill-sign-in-form", "autofill-sign-up-form", "autofill-highlight-inputs", "deliver-optimized-decorative-images", "resolution-optimized-pseudo-elements", "deprioritize-background-fetches", "efficient-background-processing", "webmcp", "agentic-forms", "agentic-javascript-tools", "language-model", "summarizer" ], "artifacts": [ { "type": "screenshot", "path": "evidence/home-desktop.png", "caption": "Desktop home/listing first viewport", "condition": "1440x1000", "findingIds": [ "F06", "F10" ] }, { "type": "screenshot", "path": "evidence/home-mobile.png", "caption": "Mobile home showing compact navigation, age and cookie prompts", "condition": "360x800", "findingIds": [ "F05", "F07", "F08", "F09", "F10", "F18", "F29" ] }, { "type": "screenshot", "path": "evidence/home-dark.png", "caption": "Home under dark-color preference remains light", "condition": "prefers-color-scheme: dark", "findingIds": [ "F01" ] }, { "type": "screenshot", "path": "evidence/home-contrast.png", "caption": "Home under increased contrast preference", "condition": "prefers-contrast: more", "findingIds": [ "F03" ] }, { "type": "screenshot", "path": "evidence/category-desktop.png", "caption": "Representative category listing", "condition": "1440x1000", "findingIds": [] }, { "type": "screenshot", "path": "evidence/detail-desktop.png", "caption": "Representative live model detail and age gate", "condition": "1440x1000", "findingIds": [] }, { "type": "screenshot", "path": "evidence/signup-mobile.png", "caption": "Account creation flow", "condition": "360x800", "findingIds": [ "F29" ] }, { "type": "screenshot", "path": "evidence/login-mobile.png", "caption": "Login, federation and passwordless options", "condition": "360x800", "findingIds": [ "F29" ] }, { "type": "screenshot", "path": "evidence/404-mobile.png", "caption": "Not-found recovery state", "condition": "360x800", "findingIds": [] }, { "type": "dom", "path": "evidence/home-dom.json", "caption": "Rendered home DOM and computed styles", "condition": "default", "findingIds": [ "F01" ] }, { "type": "dom", "path": "evidence/category-dom.json", "caption": "Category DOM evidence", "condition": "default", "findingIds": [] }, { "type": "dom", "path": "evidence/detail-dom.json", "caption": "Detail DOM evidence", "condition": "default", "findingIds": [] }, { "type": "dom", "path": "evidence/signup-dom.json", "caption": "Signup DOM evidence", "condition": "default", "findingIds": [] }, { "type": "dom", "path": "evidence/404-dom.json", "caption": "404 DOM evidence", "condition": "default", "findingIds": [] }, { "type": "layout", "path": "evidence/layout-mobile.json", "caption": "Mobile layout, CLS and long-task observations", "condition": "360x800", "findingIds": [ "F13", "F14" ] }, { "type": "trace", "path": "evidence/home-trace.json", "caption": "DevTools performance trace", "condition": "default", "findingIds": [] }, { "type": "trace-summary", "path": "evidence/home-trace-summary.json", "caption": "Compact trace timings and main-thread summary", "condition": "default", "findingIds": [ "F12", "F14" ] }, { "type": "har", "path": "evidence/home.har", "caption": "Initial-load HAR", "condition": "5 second capture", "findingIds": [ "F15" ] }, { "type": "har-summary", "path": "evidence/home-summary.json", "caption": "Compact network summary", "condition": "5 second capture", "findingIds": [ "F15", "F16", "F26", "F32", "F33" ] }, { "type": "lighthouse", "path": "evidence/lighthouse.json", "caption": "Lighthouse JSON", "condition": "mobile default", "findingIds": [] }, { "type": "other", "path": "evidence/lighthouse-summary.json", "caption": "Compact Lighthouse scores and failures", "condition": "mobile default", "findingIds": [ "F03", "F12", "F14", "F16", "F17", "F18", "F21", "F22", "F32" ] }, { "type": "other", "path": "evidence/images.json", "caption": "Image dimensions, lazy-loading and resolution audit", "condition": "default", "findingIds": [ "F13", "F20", "F31" ] }, { "type": "other", "path": "evidence/headers.json", "caption": "Main-document security headers", "condition": "default", "findingIds": [ "F25", "F27" ] }, { "type": "other", "path": "evidence/cookies.json", "caption": "Cookie flag audit", "condition": "default", "findingIds": [ "F25" ] }, { "type": "other", "path": "evidence/trackers.json", "caption": "Third-party origin inventory", "condition": "default", "findingIds": [ "F26", "F33" ] }, { "type": "other", "path": "evidence/secrets.json", "caption": "Client secret-pattern scan; detected JWT was analysed as non-user config", "condition": "default", "findingIds": [] }, { "type": "other", "path": "evidence/secret-context.json", "caption": "Redacted JWT context", "condition": "default", "findingIds": [] }, { "type": "other", "path": "evidence/jwt-analysis.json", "caption": "Decoded claim names only; no user identity and no expiry", "condition": "default", "findingIds": [] }, { "type": "discoverability", "path": "evidence/discoverability-home.json", "caption": "Raw HTML/rendered coverage comparison", "condition": "crawler vs browser", "findingIds": [ "F22", "F28" ] }, { "type": "screenshot", "path": "evidence/discoverability-home-rendered.png", "caption": "Browser-rendered home", "condition": "JavaScript enabled", "findingIds": [ "F22" ] }, { "type": "screenshot", "path": "evidence/discoverability-home-crawler.png", "caption": "Crawler view from raw response", "condition": "JavaScript disabled", "findingIds": [ "F22", "F28" ] }, { "type": "heap", "path": "evidence/heap-baseline.json", "caption": "Initial heap summary", "condition": "settled load", "findingIds": [] }, { "type": "heap", "path": "evidence/heap-prewarmed.json", "caption": "Heap after one full scroll to warm lazy content", "condition": "one cycle", "findingIds": [ "F34" ] }, { "type": "heap", "path": "evidence/heap-post.json", "caption": "Heap after ten full-scroll cycles", "condition": "10 cycles", "findingIds": [ "F34" ] }, { "type": "other", "path": "evidence/static-probe.json", "caption": "Metadata, CSS feature, focus and target probe", "condition": "default", "findingIds": [ "F02", "F04", "F05", "F06", "F08", "F10", "F11", "F19", "F20", "F23", "F24" ] }, { "type": "other", "path": "evidence/reduced-motion.json", "caption": "Animation state under reduced motion", "condition": "prefers-reduced-motion: reduce", "findingIds": [ "F02" ] }, { "type": "other", "path": "evidence/robots-sitemap.json", "caption": "robots.txt and sitemap responses", "condition": "default", "findingIds": [ "F23" ] }, { "type": "other", "path": "evidence/pwa.json", "caption": "Manifest and service-worker registration", "condition": "default", "findingIds": [] }, { "type": "other", "path": "evidence/scripts.json", "caption": "Script async/defer inventory", "condition": "default", "findingIds": [ "F26" ] }, { "type": "other", "path": "evidence/signup-probe.json", "caption": "Signup fields and form semantics", "condition": "default", "findingIds": [ "F17", "F30" ] }, { "type": "other", "path": "evidence/login-probe.json", "caption": "Login fields and auth capabilities", "condition": "default", "findingIds": [ "F17", "F30" ] }, { "type": "other", "path": "evidence/detail-probe.json", "caption": "Detail metadata and media state", "condition": "default", "findingIds": [] }, { "type": "other", "path": "evidence/memory-metrics.json", "caption": "Runtime heap and DOM counts", "condition": "default", "findingIds": [] }, { "type": "other", "path": "evidence/i18n.json", "caption": "Language/direction and locale-value probe", "condition": "default", "findingIds": [] } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 58, "blocked": 0, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": true }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "The dark-mode screenshot is visually identical to the default light page; the DOM reports color-scheme: normal and the stylesheet probe found no prefers-color-scheme rule.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F01" ], "artifacts": [ "evidence/home-dark.png", "evidence/home-dom.json" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "The normal and prefers-reduced-motion probes both report two 250 ms animations, and the stylesheet probe found no reduced-motion media query.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F02" ], "artifacts": [ "evidence/reduced-motion.json", "evidence/static-probe.json" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "The stylesheet probe found no prefers-contrast or forced-colors rule; the contrast-conditioned screenshot remains unchanged, while Lighthouse identifies foreground/background failures as low as 2.55:1.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F03" ], "artifacts": [ "evidence/home-contrast.png", "evidence/lighthouse-summary.json" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "The CSS/source probe found no view-transition declarations on this multi-page browsing experience.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F04" ], "artifacts": [ "evidence/static-probe.json" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "No parallax, scrollytelling, reveal or other scroll-linked animation was observed on the representative pages, so there is no scroll animation implementation to assess.", "pathIds": [ "home" ], "status": "not-applicable", "reason": "No parallax, scrollytelling, reveal or other scroll-linked animation was observed on the representative pages, so there is no scroll animation implementation to assess." }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "Mobile listing interaction uses native scrolling; no custom pointermove gesture implementation or platform-fighting overscroll was observed.", "pathIds": [ "home" ], "status": "pass" }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "The long listing keeps fixed header/banner chrome, and CSS inspection found no scroll-state or scroll-progress implementation.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F05" ], "artifacts": [ "evidence/home-mobile.png", "evidence/static-probe.json" ] }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "The site exposes header/menu overlays, but the CSS probe found no anchor-name, position-anchor or fallback-position rules.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F06" ], "artifacts": [ "evidence/home-desktop.png", "evidence/static-probe.json" ] }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "Active category tabs are underlined, section headings label each content group, and the 404 view presents a clear return action.", "pathIds": [ "home" ], "status": "pass" }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "The 360×800 screenshot shows a 116 px age banner plus a fixed cookie panel covering the lower model cards on first load.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F07" ], "artifacts": [ "evidence/home-mobile.png" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "The initial screenshot shows a fixed consent panel with Manage and Accept All but no direct dismiss/reject action; the DOM probe found popover=0.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F08" ], "artifacts": [ "evidence/home-mobile.png", "evidence/static-probe.json" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "Before the first complete content row, the mobile view spends 212 px on two nav rows and age verification, while the cookie panel overlays another 115 px.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F09" ], "artifacts": [ "evidence/home-mobile.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "At 360×800 the layout primitive measured scrollWidth=clientWidth=360 with zero horizontal overflow and a viewport meta tag; the screenshot shows a usable two-column listing.", "pathIds": [ "home" ], "status": "pass" }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "Desktop and mobile screenshots show adaptation, but CSS inspection found no @container declarations despite cards/nav components appearing in differently sized contexts.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F10" ], "artifacts": [ "evidence/home-desktop.png", "evidence/home-mobile.png", "evidence/static-probe.json" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "A programmatic focus walk found outline-style:none and box-shadow:none on the sampled navigation links; 123 of 160 rendered controls were also under 44 px in one dimension.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F11" ], "artifacts": [ "evidence/static-probe.json" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "The first viewport clearly presents live webcam categories, named listing sections and direct model cards, plus an explicit age-verification action where required.", "pathIds": [ "home" ], "status": "pass" }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "The browse path reaches a category and live detail directly; signup presents social, passwordless and account-creation routes with visible terms and a bot check rather than an unexplained dead end.", "pathIds": [ "home" ], "status": "pass" }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "The detail clearly explains the age-locked state and action, and a nonexistent route returns a legible 404 with Go to Main Page and featured alternatives.", "pathIds": [ "home" ], "status": "pass" }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "Lighthouse measured LCP 4.0 s, CLS 0.125 and TBT 650 ms; the independent trace measured LCP 4.46 s and 318 ms total blocking time.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F12" ], "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-trace-summary.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "The mobile layout observer measured CLS 0.1277, including a single 0.1276 shift at 3.7 s; all 36 audited images lacked width/height attributes.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F13" ], "artifacts": [ "evidence/layout-mobile.json", "evidence/images.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "Lighthouse measured 650 ms TBT; the trace found four long tasks up to 172.6 ms, and the layout observer recorded 143 ms and 100 ms tasks.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F14" ], "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-trace-summary.json", "evidence/layout-mobile.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "The HAR captured 163 requests and 2.57 MB transferred, including 463 KB of fonts and 1.35 MB of scripts; two VeryHigh stylesheets load before first content.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F15" ], "artifacts": [ "evidence/home-summary.json", "evidence/home.har" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "Lighthouse estimates 1,148 KiB unused JavaScript and 124 KiB unused CSS; the largest bootstrap script transfers 724,642 bytes.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F16" ], "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-summary.json" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "Lighthouse failed link-name for model-card anchors. Signup/login probes found username, email and password fields with no label or aria-label.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F17" ], "artifacts": [ "evidence/lighthouse-summary.json", "evidence/signup-probe.json", "evidence/login-probe.json" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "Lighthouse found multiple failures, including Join Free at 2.58:1, age-banner copy at 2.55:1 and the 18+ highlight at 2.74:1.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F18" ], "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-mobile.png" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "The focus probe reported no outline and no box shadow for the sampled focused links, preventing keyboard users from tracking position.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F19" ], "artifacts": [ "evidence/static-probe.json" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "Desktop and mobile screenshots show stable, unclipped headings and compact but readable listing labels; no text overlap was observed.", "pathIds": [ "home" ], "status": "pass" }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "The viewport allows scaling, the 360 px layout reflows without horizontal overflow, and Lighthouse target-size passed; the live video is visual user-generated media rather than prerecorded dialogue.", "pathIds": [ "home" ], "status": "pass" }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "Lighthouse reports “No browser errors logged to the console” with score 1 and zero items.", "pathIds": [ "home" ], "status": "pass" }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "The images primitive found width and height missing on all 36 images, even though the document otherwise has a valid HTML doctype and UTF-8 charset.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F20" ], "artifacts": [ "evidence/images.json", "evidence/static-probe.json" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "Lighthouse found three deprecated API warnings, inspector issues, a BFCache blocker and third-party-cookie use.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F21" ], "artifacts": [ "evidence/lighthouse-summary.json" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "Home, detail, signup and login probes all expose descriptive titles; the audited public pages include meta descriptions.", "pathIds": [ "home" ], "status": "pass" }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "The discoverability primitive received HTTP 403, measured 5% raw/rendered word coverage, and classified the response as a JS shell; title, H1 and description were absent from raw HTML. Lighthouse also failed crawlable-anchors.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F22" ], "artifacts": [ "evidence/discoverability-home.json", "evidence/discoverability-home-rendered.png", "evidence/discoverability-home-crawler.png", "evidence/lighthouse-summary.json" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "The page at xham.live declares https://xhamsterlive.com/ canonical, while /sitemap.xml returns 404; robots.txt otherwise allows the public paths.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F23" ], "artifacts": [ "evidence/static-probe.json", "evidence/robots-sitemap.json" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "The metadata probe found an Open Graph title/description but an empty og:image value; one JSON-LD block is present.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F24" ], "artifacts": [ "evidence/static-probe.json" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "HTTPS and HSTS are present, but CSP and X-Content-Type-Options are missing; the cookie audit reports 25 cookies without Secure, including long-lived experiment cookies.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F25" ], "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "The HAR attributes 148 of 163 requests and 2.43 of 2.57 MB to third-party origins; the DOM loads FingerprintJS and the tracker probe sees eight third-party origins.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F26" ], "artifacts": [ "evidence/home-summary.json", "evidence/trackers.json", "evidence/scripts.json" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "No permission prompt appeared on load. Login offers Google/xHamster federation and “Continue without Password” in addition to password login, so authentication is not password-only.", "pathIds": [ "home" ], "status": "pass" }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "Headers inspection found no CSP, frame-ancestors/X-Frame-Options, Referrer-Policy, Permissions-Policy or nosniff; only HSTS was present.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F27" ], "artifacts": [ "evidence/headers.json" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "The raw/crawler response is a 403 JS shell with only 5% content coverage, while the browser-rendered page contains the listings and headings.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F28" ], "artifacts": [ "evidence/discoverability-home.json", "evidence/discoverability-home-crawler.png" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "Menus, listings, detail state and account panels rendered without clipped active overlays or blank runtime states in desktop and mobile captures.", "pathIds": [ "home" ], "status": "pass" }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "confidence": "medium", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "The app supplies a valid standalone manifest with 192/512 icons and has an active scoped service worker registration. Offline response content was not deeply exercised, so confidence is medium.", "pathIds": [ "home" ], "status": "pass" }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "A representative invalid route renders a dedicated 404 explanation, a primary recovery link and alternative content instead of a broken shell.", "pathIds": [ "error" ], "status": "pass" }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "The document declares lang=en and resolves to ltr; 34 hreflang variants and an in-page language control demonstrate translated variants for the current surface.", "pathIds": [ "home" ], "status": "pass" }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "The representative public surfaces expose no dates, currencies, durations or calendar values requiring locale-sensitive formatting; live counts are simple dimensionless values.", "pathIds": [ "home" ], "status": "not-applicable", "reason": "The representative public surfaces expose no dates, currencies, durations or calendar values requiring locale-sensitive formatting; live counts are simple dimensionless values." }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "No event scheduling, timestamps or recurring time concepts appear in the representative public surfaces.", "pathIds": [ "home" ], "status": "not-applicable", "reason": "No event scheduling, timestamps or recurring time concepts appear in the representative public surfaces." }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "Every captured page shows a green Accept All button and a lower-emphasis Manage action, but no Reject All control at the same level.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F29" ], "artifacts": [ "evidence/home-mobile.png", "evidence/signup-mobile.png", "evidence/login-mobile.png" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "The observed account forms use a visible Cloudflare verification state and do not display premature blame/error text before interaction; native/custom validation can proceed at submit.", "pathIds": [ "home" ], "status": "pass" }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "Signup has username/email inputs without labels and with autocomplete off/empty; login username and password fields have empty autocomplete tokens.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F30" ], "artifacts": [ "evidence/signup-probe.json", "evidence/login-probe.json" ] }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "Signup and login state account creation clearly, show terms/privacy copy, provide password recovery and passwordless/federated alternatives, and do not expose an unexpected purchase step.", "pathIds": [ "signup", "login" ], "status": "pass" }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "Of 36 images, 36 lack intrinsic dimensions, 22 lack srcset, 13 are more than 2× display width, 15 below-fold images are not lazy and 15 use legacy formats.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F31" ], "artifacts": [ "evidence/images.json" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "The page transfers 1.35 MB of script and Lighthouse estimates 1,148 KiB is unused, alongside 46 XHR/fetch requests in the initial HAR.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F32" ], "artifacts": [ "evidence/home-summary.json", "evidence/lighthouse-summary.json" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "Third parties account for 148 requests and 2.43 MB, or about 95% of transferred bytes; 2.12 MB comes from assets.chapturist.com alone.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F33" ], "artifacts": [ "evidence/home-summary.json", "evidence/trackers.json" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "This public browsing site does not declare an agent-facing capability or intent; emerging WebMCP exposure is therefore treated as out of scope, not a failure.", "pathIds": [ "home" ], "status": "not-applicable", "reason": "This public browsing site does not declare an agent-facing capability or intent; emerging WebMCP exposure is therefore treated as out of scope, not a failure." }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "No summarisation, language-model or inference task is part of the observed core journey, so on-device inference is not applicable.", "pathIds": [ "home" ], "status": "not-applicable", "reason": "No summarisation, language-model or inference task is part of the observed core journey, so on-device inference is not applicable." }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "confidence": "low", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "A prewarmed full-scroll heap was 61.2 MB/1.27M nodes; after 10 down/up cycles it was 73.2 MB/1.58M nodes, about 19.5% more bytes and 24.7% more nodes. Separate browser runs and intentional caches lower confidence.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F34" ], "artifacts": [ "evidence/heap-prewarmed.json", "evidence/heap-post.json" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "confidence": "high", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "The settled homepage used about 52 MB JS heap by performance.memory and a 53.6 MB heap snapshot. This is substantial but proportionate to a live, media-rich, multi-card application and below an obvious device-risk threshold.", "pathIds": [ "home" ], "status": "pass" }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "confidence": "low", "method": "Direct browser evidence using the planned condition and representative paths", "evidence": "Neither heap summary’s top constructors contained Detached* nodes, EventListener or Timer populations. This is a low-confidence pass because constructor summaries are not retaining-path analysis.", "pathIds": [ "home" ], "status": "pass" } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F01", "F02", "F03" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "issues", "findingIds": [ "F04" ] }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "issues", "findingIds": [ "F05", "F06" ] }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "issues", "findingIds": [ "F07", "F08", "F09" ] }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "issues", "findingIds": [ "F10", "F11" ] }, { "principleId": "support-core-task-success", "expectation": "default", "status": "pass" }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F12", "F13", "F14", "F15", "F16" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F17", "F18", "F19" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "issues", "findingIds": [ "F20", "F21" ] }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F22", "F23", "F24" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F25", "F26", "F27" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "issues", "findingIds": [ "F28" ] }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "pass" }, { "principleId": "be-trustworthy", "expectation": "default", "status": "issues", "findingIds": [ "F29", "F30" ] }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F31", "F32", "F33" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "not-applicable", "reason": "This public browsing site does not declare an agent-facing capability or intent; emerging WebMCP exposure is therefore treated as out of scope, not a failure. No summarisation, language-model or inference task is part of the observed core journey, so on-device inference is not applicable." }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "issues", "findingIds": [ "F34" ] } ], "paths": [ { "id": "home", "description": "Homepage/listing template: primary discovery surface, navigation, preferences, mobile reflow, performance, privacy and crawler behavior.", "url": "https://xham.live/", "conditions": [ "1440x1000", "360x800", "prefers-color-scheme: dark", "prefers-reduced-motion: reduce", "prefers-contrast: more", "crawler/no JavaScript" ], "result": "issues" }, { "id": "category", "description": "British Models category: representative long listing template; other demographic/tag listings share this template and were de-duplicated.", "url": "https://xham.live/girls/british-models", "conditions": [ "1440x1000" ], "result": "issues" }, { "id": "detail", "description": "Live model detail: representative media/chat/age-gated core destination.", "url": "https://xham.live/Honeyxoxxo", "conditions": [ "1440x1000" ], "result": "issues" }, { "id": "signup", "description": "Signup: representative account-creation form and consent/terms surface; no account was created.", "url": "https://xham.live/signup", "conditions": [ "360x800", "keyboard/form semantics" ], "result": "issues" }, { "id": "login", "description": "Login: authentication, recovery, federation, passwordless and autofill surface.", "url": "https://xham.live/login", "conditions": [ "360x800", "form semantics" ], "result": "issues" }, { "id": "error", "description": "Invalid route: representative HTTP/navigation recovery state.", "url": "https://xham.live/not-a-real-route-web-uplift", "conditions": [ "360x800" ], "result": "pass" } ], "findings": [ { "id": "F01", "pathId": "home", "url": "https://xham.live/", "principleId": "respect-user-preferences", "principleCheckId": "respects-color-scheme", "guidanceId": "dark-mode", "severity": "medium", "confidence": "high", "summary": "The interface ignores the user’s dark-color preference.", "evidence": "The dark-mode screenshot is visually identical to the default light page; the DOM reports color-scheme: normal and the stylesheet probe found no prefers-color-scheme rule.", "suggestedFix": "Declare color-scheme and provide preference-driven dark surface, text, control and media-placeholder colors.", "effort": "medium", "artifacts": [ "evidence/home-dark.png", "evidence/home-dom.json" ] }, { "id": "F02", "pathId": "home", "url": "https://xham.live/", "principleId": "respect-user-preferences", "principleCheckId": "respects-reduced-motion", "guidanceId": "accessibility", "severity": "low", "confidence": "high", "summary": "Non-essential animation is not reduced when requested.", "evidence": "The normal and prefers-reduced-motion probes both report two 250 ms animations, and the stylesheet probe found no reduced-motion media query.", "suggestedFix": "Wrap non-essential transition and animation rules in a no-preference query and disable or shorten them under reduce.", "effort": "small", "artifacts": [ "evidence/reduced-motion.json", "evidence/static-probe.json" ] }, { "id": "F03", "pathId": "home", "url": "https://xham.live/", "principleId": "respect-user-preferences", "principleCheckId": "respects-contrast", "guidanceId": "adapt-scrollbar-to-contrast-preferences", "severity": "medium", "confidence": "high", "summary": "The page does not adapt to increased-contrast preferences.", "evidence": "The stylesheet probe found no prefers-contrast or forced-colors rule; the contrast-conditioned screenshot remains unchanged, while Lighthouse identifies foreground/background failures as low as 2.55:1.", "suggestedFix": "Add forced-colors and prefers-contrast adaptations and preserve visible borders, text, focus and controls.", "effort": "medium", "artifacts": [ "evidence/home-contrast.png", "evidence/lighthouse-summary.json" ] }, { "id": "F04", "pathId": "home", "url": "https://xham.live/", "principleId": "implement-natural-interactions", "principleCheckId": "view-transitions", "guidanceId": "cross-document-transitions", "severity": "low", "confidence": "medium", "summary": "Route changes do not use view transitions.", "evidence": "The CSS/source probe found no view-transition declarations on this multi-page browsing experience.", "suggestedFix": "Use cross-document view transitions for same-origin category, listing and detail navigation, with reduced-motion opt-out.", "effort": "medium", "artifacts": [ "evidence/static-probe.json" ] }, { "id": "F05", "pathId": "home", "url": "https://xham.live/", "principleId": "provide-guided-navigation", "principleCheckId": "scroll-state-aware-chrome", "guidanceId": "shrinking-header-on-scroll", "severity": "low", "confidence": "high", "summary": "Persistent chrome does not react to scroll position.", "evidence": "The long listing keeps fixed header/banner chrome, and CSS inspection found no scroll-state or scroll-progress implementation.", "suggestedFix": "Reduce or adapt persistent chrome once content scrolls, preferably with scroll-state container queries and a stable fallback.", "effort": "small", "artifacts": [ "evidence/home-mobile.png", "evidence/static-probe.json" ] }, { "id": "F06", "pathId": "home", "url": "https://xham.live/", "principleId": "provide-guided-navigation", "principleCheckId": "anchored-positioning", "guidanceId": "position-aware-tooltips", "severity": "low", "confidence": "medium", "summary": "Menus and transient controls lack anchor-positioning support.", "evidence": "The site exposes header/menu overlays, but the CSS probe found no anchor-name, position-anchor or fallback-position rules.", "suggestedFix": "Anchor menus and transient overlays to their trigger with position-try fallbacks, retaining the current positioning as fallback.", "effort": "medium", "artifacts": [ "evidence/home-desktop.png", "evidence/static-probe.json" ] }, { "id": "F07", "pathId": "home", "url": "https://xham.live/", "principleId": "maximize-content-reduce-noise", "principleCheckId": "no-intrusive-interruptions", "guidanceId": "light-dismiss-a-dialog", "severity": "medium", "confidence": "high", "summary": "Stacked age and cookie prompts obscure primary content on mobile.", "evidence": "The 360×800 screenshot shows a 116 px age banner plus a fixed cookie panel covering the lower model cards on first load.", "suggestedFix": "Reserve one compact, non-overlapping notice area and keep consent controls content-first and dismissible.", "effort": "medium", "artifacts": [ "evidence/home-mobile.png" ] }, { "id": "F08", "pathId": "home", "url": "https://xham.live/", "principleId": "maximize-content-reduce-noise", "principleCheckId": "semantic-dismissible-primitives", "guidanceId": "declarative-dialog-popover-control", "severity": "low", "confidence": "high", "summary": "The cookie prompt behaves as custom fixed chrome rather than a clearly dismissible semantic primitive.", "evidence": "The initial screenshot shows a fixed consent panel with Manage and Accept All but no direct dismiss/reject action; the DOM probe found popover=0.", "suggestedFix": "Use an appropriately labelled dialog or popover with keyboard-safe focus and equivalent accept/reject/manage actions.", "effort": "medium", "artifacts": [ "evidence/home-mobile.png", "evidence/static-probe.json" ] }, { "id": "F09", "pathId": "home", "url": "https://xham.live/", "principleId": "maximize-content-reduce-noise", "principleCheckId": "reduced-chrome", "guidanceId": "scrollability-affordance-hints", "severity": "medium", "confidence": "high", "summary": "Navigation and notices consume a large share of the first mobile viewport.", "evidence": "Before the first complete content row, the mobile view spends 212 px on two nav rows and age verification, while the cookie panel overlays another 115 px.", "suggestedFix": "Collapse secondary navigation and defer nonessential controls so the live listings dominate the viewport.", "effort": "small", "artifacts": [ "evidence/home-mobile.png" ] }, { "id": "F10", "pathId": "home", "url": "https://xham.live/", "principleId": "adapt-to-the-form-factor", "principleCheckId": "component-level-responsiveness", "guidanceId": "size-aware-styling", "severity": "low", "confidence": "medium", "summary": "Responsive changes rely on viewport layouts rather than component-level adaptation.", "evidence": "Desktop and mobile screenshots show adaptation, but CSS inspection found no @container declarations despite cards/nav components appearing in differently sized contexts.", "suggestedFix": "Adopt size container queries for reusable cards, navigation groups and banners while keeping a viewport fallback.", "effort": "medium", "artifacts": [ "evidence/home-desktop.png", "evidence/home-mobile.png", "evidence/static-probe.json" ] }, { "id": "F11", "pathId": "home", "url": "https://xham.live/", "principleId": "adapt-to-the-form-factor", "principleCheckId": "input-modality-aware", "guidanceId": "accessibility", "severity": "high", "confidence": "high", "summary": "Keyboard focus is not visibly indicated on many interactive elements.", "evidence": "A programmatic focus walk found outline-style:none and box-shadow:none on the sampled navigation links; 123 of 160 rendered controls were also under 44 px in one dimension.", "suggestedFix": "Add a high-contrast :focus-visible treatment and verify target size/spacing on the actual mobile control set.", "effort": "small", "artifacts": [ "evidence/static-probe.json" ] }, { "id": "F12", "pathId": "home", "url": "https://xham.live/", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "guidanceId": "performance", "severity": "high", "confidence": "high", "summary": "Loading performance misses the good Core Web Vitals range.", "evidence": "Lighthouse measured LCP 4.0 s, CLS 0.125 and TBT 650 ms; the independent trace measured LCP 4.46 s and 318 ms total blocking time.", "suggestedFix": "Prioritise the LCP surface, reserve dynamic slots and defer noncritical scripts/data until after the first useful content.", "effort": "large", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-trace-summary.json" ] }, { "id": "F13", "pathId": "home", "url": "https://xham.live/", "principleId": "be-fast-and-stable", "principleCheckId": "visual-stability", "guidanceId": "optimize-image-priority", "severity": "medium", "confidence": "high", "summary": "Late content causes visible layout shift.", "evidence": "The mobile layout observer measured CLS 0.1277, including a single 0.1276 shift at 3.7 s; all 36 audited images lacked width/height attributes.", "suggestedFix": "Reserve media and banner space with intrinsic dimensions or aspect-ratio and avoid inserting notices above loaded content.", "effort": "medium", "artifacts": [ "evidence/layout-mobile.json", "evidence/images.json" ] }, { "id": "F14", "pathId": "home", "url": "https://xham.live/", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-main-thread", "guidanceId": "break-up-long-tasks", "severity": "high", "confidence": "high", "summary": "JavaScript blocks the main thread during startup.", "evidence": "Lighthouse measured 650 ms TBT; the trace found four long tasks up to 172.6 ms, and the layout observer recorded 143 ms and 100 ms tasks.", "suggestedFix": "Profile the bootstrap path, split long tasks, and schedule noncritical hydration, analytics and feed work by priority.", "effort": "large", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-trace-summary.json", "evidence/layout-mobile.json" ] }, { "id": "F15", "pathId": "home", "url": "https://xham.live/", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "guidanceId": "optimize-preload-priority", "severity": "medium", "confidence": "high", "summary": "The critical load is large and dependency-heavy.", "evidence": "The HAR captured 163 requests and 2.57 MB transferred, including 463 KB of fonts and 1.35 MB of scripts; two VeryHigh stylesheets load before first content.", "suggestedFix": "Subset fonts, reduce initial bundles and CSS, and preload only confirmed LCP-critical resources.", "effort": "large", "artifacts": [ "evidence/home-summary.json", "evidence/home.har" ] }, { "id": "F16", "pathId": "home", "url": "https://xham.live/", "principleId": "be-fast-and-stable", "principleCheckId": "trim-unused-and-duplicate-code", "guidanceId": "identify-heavy-scripts", "severity": "high", "confidence": "high", "summary": "The page ships substantial unused code.", "evidence": "Lighthouse estimates 1,148 KiB unused JavaScript and 124 KiB unused CSS; the largest bootstrap script transfers 724,642 bytes.", "suggestedFix": "Code-split by route and interaction, remove legacy/duplicate bundles, and load player/analytics code only when needed.", "effort": "large", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-summary.json" ] }, { "id": "F17", "pathId": "home", "url": "https://xham.live/", "principleId": "be-inclusive", "principleCheckId": "names-roles-labels", "guidanceId": "accessibility", "severity": "high", "confidence": "high", "summary": "Important links and account inputs lack accessible names or labels.", "evidence": "Lighthouse failed link-name for model-card anchors. Signup/login probes found username, email and password fields with no label or aria-label.", "suggestedFix": "Give each card link a model-specific accessible name and associate visible labels with every account input.", "effort": "small", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/signup-probe.json", "evidence/login-probe.json" ] }, { "id": "F18", "pathId": "home", "url": "https://xham.live/", "principleId": "be-inclusive", "principleCheckId": "sufficient-contrast", "guidanceId": "accessibility", "severity": "high", "confidence": "high", "summary": "Text and controls fail WCAG contrast minimums.", "evidence": "Lighthouse found multiple failures, including Join Free at 2.58:1, age-banner copy at 2.55:1 and the 18+ highlight at 2.74:1.", "suggestedFix": "Adjust foreground/background design tokens to at least 4.5:1 for normal text and re-test every state.", "effort": "small", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-mobile.png" ] }, { "id": "F19", "pathId": "home", "url": "https://xham.live/", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "guidanceId": "accessibility", "severity": "high", "confidence": "high", "summary": "Focus visibility is missing across navigation.", "evidence": "The focus probe reported no outline and no box shadow for the sampled focused links, preventing keyboard users from tracking position.", "suggestedFix": "Create a consistent :focus-visible ring with sufficient contrast and test a complete keyboard traversal on all archetypes.", "effort": "small", "artifacts": [ "evidence/static-probe.json" ] }, { "id": "F20", "pathId": "home", "url": "https://xham.live/", "principleId": "follow-best-practices", "principleCheckId": "sound-document-and-assets", "guidanceId": "html", "severity": "medium", "confidence": "high", "summary": "Images omit intrinsic dimensions.", "evidence": "The images primitive found width and height missing on all 36 images, even though the document otherwise has a valid HTML doctype and UTF-8 charset.", "suggestedFix": "Emit width/height or a stable aspect-ratio for each image and retain responsive CSS sizing.", "effort": "small", "artifacts": [ "evidence/images.json", "evidence/static-probe.json" ] }, { "id": "F21", "pathId": "home", "url": "https://xham.live/", "principleId": "follow-best-practices", "principleCheckId": "browser-platform-hygiene", "guidanceId": "html", "severity": "medium", "confidence": "high", "summary": "The runtime has platform hygiene failures.", "evidence": "Lighthouse found three deprecated API warnings, inspector issues, a BFCache blocker and third-party-cookie use.", "suggestedFix": "Remove or isolate the offending challenge/third-party code, resolve inspector issues and eliminate avoidable BFCache blockers.", "effort": "medium", "artifacts": [ "evidence/lighthouse-summary.json" ] }, { "id": "F22", "pathId": "home", "url": "https://xham.live/", "principleId": "be-discoverable", "principleCheckId": "crawlable-and-mobile-friendly", "guidanceId": "search-hidden-content", "severity": "high", "confidence": "high", "summary": "Non-JavaScript crawlers receive almost none of the listing content.", "evidence": "The discoverability primitive received HTTP 403, measured 5% raw/rendered word coverage, and classified the response as a JS shell; title, H1 and description were absent from raw HTML. Lighthouse also failed crawlable-anchors.", "suggestedFix": "Server-render meaningful listing content and metadata, return a successful crawlable response to legitimate bots, and keep card links as real named anchors.", "effort": "large", "artifacts": [ "evidence/discoverability-home.json", "evidence/discoverability-home-rendered.png", "evidence/discoverability-home-crawler.png", "evidence/lighthouse-summary.json" ] }, { "id": "F23", "pathId": "home", "url": "https://xham.live/", "principleId": "be-discoverable", "principleCheckId": "canonical-and-indexing-signals", "guidanceId": "html", "severity": "medium", "confidence": "high", "summary": "Indexing signals are inconsistent for the audited host.", "evidence": "The page at xham.live declares https://xhamsterlive.com/ canonical, while /sitemap.xml returns 404; robots.txt otherwise allows the public paths.", "suggestedFix": "Choose and document the canonical host, redirect alternates consistently, and publish a sitemap matching canonical URLs.", "effort": "medium", "artifacts": [ "evidence/static-probe.json", "evidence/robots-sitemap.json" ] }, { "id": "F24", "pathId": "home", "url": "https://xham.live/", "principleId": "be-discoverable", "principleCheckId": "structured-and-shareable-metadata", "guidanceId": "html", "severity": "low", "confidence": "high", "summary": "Share metadata has no preview image.", "evidence": "The metadata probe found an Open Graph title/description but an empty og:image value; one JSON-LD block is present.", "suggestedFix": "Provide an accurate absolute preview image and validate Open Graph and JSON-LD against visible content.", "effort": "small", "artifacts": [ "evidence/static-probe.json" ] }, { "id": "F25", "pathId": "home", "url": "https://xham.live/", "principleId": "be-private-and-secure", "principleCheckId": "secure-transport-and-headers", "guidanceId": "security", "severity": "high", "confidence": "high", "summary": "Security headers and cookie flags are incomplete.", "evidence": "HTTPS and HSTS are present, but CSP and X-Content-Type-Options are missing; the cookie audit reports 25 cookies without Secure, including long-lived experiment cookies.", "suggestedFix": "Roll out a nonce/hash CSP, nosniff and Secure cookie defaults; retain SameSite/HttpOnly according to purpose.", "effort": "medium", "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ] }, { "id": "F26", "pathId": "home", "url": "https://xham.live/", "principleId": "be-private-and-secure", "principleCheckId": "data-minimisation-and-third-parties", "guidanceId": "privacy", "severity": "high", "confidence": "high", "summary": "The initial page has a broad third-party and fingerprinting footprint.", "evidence": "The HAR attributes 148 of 163 requests and 2.43 of 2.57 MB to third-party origins; the DOM loads FingerprintJS and the tracker probe sees eight third-party origins.", "suggestedFix": "Inventory each third party, remove fingerprinting/nonessential calls, gate optional analytics on consent, and batch remaining events.", "effort": "large", "artifacts": [ "evidence/home-summary.json", "evidence/trackers.json", "evidence/scripts.json" ] }, { "id": "F27", "pathId": "home", "url": "https://xham.live/", "principleId": "be-private-and-secure", "principleCheckId": "defensive-browser-policies", "guidanceId": "security", "severity": "high", "confidence": "high", "summary": "Browser-enforced defensive policies are mostly absent.", "evidence": "Headers inspection found no CSP, frame-ancestors/X-Frame-Options, Referrer-Policy, Permissions-Policy or nosniff; only HSTS was present.", "suggestedFix": "Deploy report-only then enforced CSP, clickjacking protection, strict referrer policy and least-privilege permissions policy.", "effort": "medium", "artifacts": [ "evidence/headers.json" ] }, { "id": "F28", "pathId": "home", "url": "https://xham.live/", "principleId": "be-resilient", "principleCheckId": "progressive-enhancement", "guidanceId": "search-hidden-content", "severity": "high", "confidence": "high", "summary": "Core public content does not progressively enhance from usable HTML.", "evidence": "The raw/crawler response is a 403 JS shell with only 5% content coverage, while the browser-rendered page contains the listings and headings.", "suggestedFix": "Return semantic server-rendered headings, listings and links, then hydrate enhancements without replacing core reachability.", "effort": "large", "artifacts": [ "evidence/discoverability-home.json", "evidence/discoverability-home-crawler.png" ] }, { "id": "F29", "pathId": "home", "url": "https://xham.live/", "principleId": "be-trustworthy", "principleCheckId": "no-dark-patterns", "guidanceId": "privacy", "severity": "high", "confidence": "high", "summary": "Consent presents Accept All prominently without an equivalent Reject action.", "evidence": "Every captured page shows a green Accept All button and a lower-emphasis Manage action, but no Reject All control at the same level.", "suggestedFix": "Provide equally prominent Accept All, Reject All and Manage choices and persist the user’s choice without nagging.", "effort": "small", "artifacts": [ "evidence/home-mobile.png", "evidence/signup-mobile.png", "evidence/login-mobile.png" ] }, { "id": "F30", "pathId": "home", "url": "https://xham.live/", "principleId": "be-trustworthy", "principleCheckId": "trustworthy-input-assistance", "guidanceId": "autofill-sign-in-form", "severity": "medium", "confidence": "high", "summary": "Account fields do not expose useful autofill semantics.", "evidence": "Signup has username/email inputs without labels and with autocomplete off/empty; login username and password fields have empty autocomplete tokens.", "suggestedFix": "Use stable names and autocomplete=username, email, current-password or new-password as appropriate, with visible labels.", "effort": "small", "artifacts": [ "evidence/signup-probe.json", "evidence/login-probe.json" ] }, { "id": "F31", "pathId": "home", "url": "https://xham.live/", "principleId": "be-sustainable", "principleCheckId": "optimised-assets", "guidanceId": "deliver-optimized-decorative-images", "severity": "medium", "confidence": "high", "summary": "Listing images are not delivered responsively.", "evidence": "Of 36 images, 36 lack intrinsic dimensions, 22 lack srcset, 13 are more than 2× display width, 15 below-fold images are not lazy and 15 use legacy formats.", "suggestedFix": "Serve responsive AVIF/WebP sources, intrinsic dimensions and lazy loading below the fold.", "effort": "medium", "artifacts": [ "evidence/images.json" ] }, { "id": "F32", "pathId": "home", "url": "https://xham.live/", "principleId": "be-sustainable", "principleCheckId": "no-wasteful-work", "guidanceId": "deprioritize-background-fetches", "severity": "high", "confidence": "high", "summary": "Unused scripts and startup work consume unnecessary resources.", "evidence": "The page transfers 1.35 MB of script and Lighthouse estimates 1,148 KiB is unused, alongside 46 XHR/fetch requests in the initial HAR.", "suggestedFix": "Conditionally load player, analytics and route code, reduce polling and defer background fetches until user intent.", "effort": "large", "artifacts": [ "evidence/home-summary.json", "evidence/lighthouse-summary.json" ] }, { "id": "F33", "pathId": "home", "url": "https://xham.live/", "principleId": "be-sustainable", "principleCheckId": "third-party-and-media-budget", "guidanceId": "efficient-background-processing", "severity": "high", "confidence": "high", "summary": "Third-party code dominates the page budget.", "evidence": "Third parties account for 148 requests and 2.43 MB, or about 95% of transferred bytes; 2.12 MB comes from assets.chapturist.com alone.", "suggestedFix": "Set a third-party request/byte budget, self-host critical assets where appropriate, and defer noncritical third-party code.", "effort": "large", "artifacts": [ "evidence/home-summary.json", "evidence/trackers.json" ] }, { "id": "F34", "pathId": "home", "url": "https://xham.live/", "principleId": "be-memory-efficient", "principleCheckId": "no-leak-under-repeated-interaction", "guidanceId": "manage-recurring-intervals", "severity": "medium", "confidence": "low", "summary": "Repeated full-list scrolling retains a materially larger heap.", "evidence": "A prewarmed full-scroll heap was 61.2 MB/1.27M nodes; after 10 down/up cycles it was 73.2 MB/1.58M nodes, about 19.5% more bytes and 24.7% more nodes. Separate browser runs and intentional caches lower confidence.", "suggestedFix": "Repeat the test in one instrumented session with explicit GC, then inspect retaining paths and cap list/cache growth if the increase persists.", "effort": "large", "artifacts": [ "evidence/heap-prewarmed.json", "evidence/heap-post.json" ] } ], "taskList": [ { "id": "T01", "title": "Server-render crawlable core listings and normalize canonical/indexing signals", "priority": 1, "findingIds": [ "F22", "F23", "F28" ], "guidanceId": "search-hidden-content", "status": "open" }, { "id": "T02", "title": "Cut and defer initial JavaScript, requests and third-party work", "priority": 2, "findingIds": [ "F12", "F14", "F15", "F16", "F26", "F32", "F33" ], "guidanceId": "identify-heavy-scripts", "status": "open" }, { "id": "T03", "title": "Deploy CSP, browser policies and secure cookie defaults", "priority": 3, "findingIds": [ "F25", "F27" ], "guidanceId": "security", "status": "open" }, { "id": "T04", "title": "Fix accessible names, labels, focus and color contrast", "priority": 4, "findingIds": [ "F03", "F11", "F17", "F18", "F19", "F30" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T05", "title": "Reserve image space and deliver responsive, lazy modern images", "priority": 5, "findingIds": [ "F13", "F20", "F31" ], "guidanceId": "optimize-image-priority", "status": "open" }, { "id": "T06", "title": "Add equal Reject All consent and reduce stacked first-load prompts", "priority": 6, "findingIds": [ "F07", "F08", "F09", "F29" ], "guidanceId": "privacy", "status": "open" }, { "id": "T07", "title": "Honor dark, reduced-motion and contrast preferences", "priority": 7, "findingIds": [ "F01", "F02", "F03" ], "guidanceId": "dark-mode", "status": "open" }, { "id": "T08", "title": "Verify and eliminate retained heap growth across repeated scrolling", "priority": 8, "findingIds": [ "F34" ], "guidanceId": "manage-recurring-intervals", "status": "open" }, { "id": "T09", "title": "Modernize navigation transitions and component positioning/responsiveness", "priority": 9, "findingIds": [ "F04", "F05", "F06", "F10" ], "guidanceId": "size-aware-styling", "status": "open" }, { "id": "T10", "title": "Resolve deprecated APIs, inspector issues and BFCache blockers", "priority": 10, "findingIds": [ "F21" ], "guidanceId": "html", "status": "open" }, { "id": "T11", "title": "Complete structured share previews", "priority": 11, "findingIds": [ "F24" ], "guidanceId": "html", "status": "open" } ], "budget": { "pathCount": 6, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-20T01-36-06-560Z" }