{ "url": "https://tiktokio.com", "auditedAt": "2026-07-20T17:17:24.035Z", "mode": "report", "status": "completed", "statusDetail": "Atomic coverage complete: all 58 checks judged across five representative page archetypes plus the primary downloader flow and a missing-route failure state.", "page": { "appType": "hybrid", "framework": "WordPress/Flatsome with an open-shadow-root downloader widget", "notes": "Server-rendered multilingual content plus a JavaScript shadow-DOM conversion tool and Google Funding Choices consent UI." }, "evidenceUsed": [ "screenshot", "dom", "layout-metrics", "evaluate-probe", "axe-core", "lighthouse", "trace", "har", "headers", "cookies", "trackers", "images", "secrets", "discoverability", "heap-summary", "curl" ], "guidanceConsulted": [ "dark-mode", "accessibility", "fluid-scaling", "forms", "performance", "optimize-image-priority", "break-up-long-tasks", "html", "security", "privacy", "validate-input-after-interaction", "deliver-optimized-decorative-images", "webmcp", "manage-recurring-intervals" ], "artifacts": [ { "type": "other", "path": "evidence/404-headers.txt", "caption": "404 headers", "findingIds": [ "F21" ] }, { "type": "screenshot", "path": "evidence/404-mobile.png", "caption": "404 mobile", "condition": "viewport: 360x800" }, { "type": "other", "path": "evidence/404-probe.json", "caption": "404 probe", "findingIds": [ "F21" ] }, { "type": "other", "path": "evidence/404.html", "caption": "404" }, { "type": "other", "path": "evidence/a11y-probe.json", "caption": "a11y probe", "findingIds": [ "F02", "F12", "F13", "F14" ] }, { "type": "other", "path": "evidence/accepted-probe.json", "caption": "accepted probe" }, { "type": "screenshot", "path": "evidence/arabic-mobile.png", "caption": "arabic mobile", "condition": "viewport: 360x800" }, { "type": "other", "path": "evidence/arabic-probe.json", "caption": "arabic probe" }, { "type": "screenshot", "path": "evidence/article-mobile.png", "caption": "article mobile", "condition": "viewport: 360x800" }, { "type": "other", "path": "evidence/article-probe.json", "caption": "article probe" }, { "type": "other", "path": "evidence/consent-controls.json", "caption": "consent controls", "findingIds": [ "F05", "F22", "F29" ] }, { "type": "other", "path": "evidence/cookies.json", "caption": "cookies", "findingIds": [ "F17" ] }, { "type": "other", "path": "evidence/core-flow.json", "caption": "core flow", "findingIds": [ "F07", "F12", "F14", "F23", "F24" ] }, { "type": "other", "path": "evidence/core-success-flow.json", "caption": "core success flow", "findingIds": [ "F03" ] }, { "type": "other", "path": "evidence/core-ui-probe.json", "caption": "core ui probe", "findingIds": [ "F20", "F28" ] }, { "type": "screenshot", "path": "evidence/discoverability-crawler.png", "caption": "discoverability crawler" }, { "type": "screenshot", "path": "evidence/discoverability-rendered.png", "caption": "discoverability rendered" }, { "type": "discoverability", "path": "evidence/discoverability.json", "caption": "discoverability", "findingIds": [ "F20" ] }, { "type": "other", "path": "evidence/document-probe.json", "caption": "document probe", "findingIds": [ "F23" ] }, { "type": "other", "path": "evidence/headers.json", "caption": "headers", "findingIds": [ "F17", "F19" ] }, { "type": "heap", "path": "evidence/heap-baseline.json", "caption": "heap baseline", "findingIds": [ "F29" ] }, { "type": "heap", "path": "evidence/heap-post.json", "caption": "heap post" }, { "type": "screenshot", "path": "evidence/home-content-desktop.png", "caption": "home content desktop" }, { "type": "screenshot", "path": "evidence/home-content-mobile.png", "caption": "home content mobile", "condition": "viewport: 360x800" }, { "type": "screenshot", "path": "evidence/home-dark.png", "caption": "home dark", "findingIds": [ "F01" ], "condition": "prefers-color-scheme: dark" }, { "type": "screenshot", "path": "evidence/home-desktop.png", "caption": "home desktop", "findingIds": [ "F01", "F04", "F22" ] }, { "type": "dom", "path": "evidence/home-dom.json", "caption": "home dom" }, { "type": "screenshot", "path": "evidence/home-mobile.png", "caption": "home mobile", "findingIds": [ "F04" ], "condition": "viewport: 360x800" }, { "type": "screenshot", "path": "evidence/home-rejected.png", "caption": "home rejected" }, { "type": "other", "path": "evidence/home-summary.json", "caption": "home summary", "findingIds": [ "F10", "F18", "F26", "F27" ] }, { "type": "trace-summary", "path": "evidence/home-trace-summary.json", "caption": "home trace summary" }, { "type": "trace", "path": "evidence/home-trace.json", "caption": "home trace" }, { "type": "har", "path": "evidence/home.har", "caption": "home" }, { "type": "other", "path": "evidence/images.json", "caption": "images", "findingIds": [ "F12", "F15", "F25" ] }, { "type": "layout", "path": "evidence/layout-mobile.json", "caption": "layout mobile", "findingIds": [ "F08", "F09" ], "condition": "viewport: 360x800" }, { "type": "lighthouse", "path": "evidence/lighthouse-details.json", "caption": "lighthouse details", "findingIds": [ "F10", "F11", "F16", "F26" ] }, { "type": "lighthouse", "path": "evidence/lighthouse-summary.json", "caption": "lighthouse summary", "findingIds": [ "F08", "F28" ] }, { "type": "lighthouse", "path": "evidence/lighthouse.json", "caption": "lighthouse" }, { "type": "screenshot", "path": "evidence/mp3-mobile.png", "caption": "mp3 mobile", "condition": "viewport: 360x800" }, { "type": "other", "path": "evidence/mp3-probe.json", "caption": "mp3 probe" }, { "type": "screenshot", "path": "evidence/photo-mobile.png", "caption": "photo mobile", "condition": "viewport: 360x800" }, { "type": "other", "path": "evidence/photo-probe.json", "caption": "photo probe" }, { "type": "other", "path": "evidence/post-consent-probe.json", "caption": "post consent probe", "findingIds": [ "F03", "F05", "F06" ] }, { "type": "other", "path": "evidence/preferences-probe.json", "caption": "preferences probe", "findingIds": [ "F07" ] }, { "type": "other", "path": "evidence/recon.json", "caption": "recon" }, { "type": "other", "path": "evidence/robots-headers.txt", "caption": "robots headers" }, { "type": "other", "path": "evidence/robots.txt", "caption": "robots" }, { "type": "other", "path": "evidence/secrets.json", "caption": "secrets" }, { "type": "other", "path": "evidence/sitemap-headers.txt", "caption": "sitemap headers" }, { "type": "other", "path": "evidence/sitemap.xml", "caption": "sitemap" }, { "type": "other", "path": "evidence/trackers.json", "caption": "trackers", "findingIds": [ "F18" ] } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 58, "blocked": 0, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": true }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, or tool evidence gathered on representative paths", "evidence": "The light and dark screenshots are byte-identical (49,292 bytes), and the preference probe reports computed color-scheme: normal.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dark.png", "evidence/home-desktop.png" ], "findingIds": [ "F01" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "pass", "confidence": "high", "method": "Direct review across representative screenshots, DOM/evaluate probes, and active flow evidence", "evidence": "Reduced-motion emulation reported zero active animations.", "pathIds": [ "home" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, or tool evidence gathered on representative paths", "evidence": "axe found 131 color-contrast failures, including 2.93:1 text on #df6d1e, plus four links distinguished only by low-contrast colour.", "pathIds": [ "home" ], "artifacts": [ "evidence/a11y-probe.json" ], "findingIds": [ "F02" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, or tool evidence gathered on representative paths", "evidence": "The app injects result HTML into an open shadow root; the probe found no View Transition support or usage and no running transition for the download state change.", "pathIds": [ "home" ], "artifacts": [ "evidence/post-consent-probe.json", "evidence/core-success-flow.json" ], "findingIds": [ "F03" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "pass", "confidence": "high", "method": "Direct review across representative screenshots, DOM/evaluate probes, and active flow evidence", "evidence": "CSS inspection found no scroll timelines and the page uses no scroll-linked visual motion.", "pathIds": [ "home" ] }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "pass", "confidence": "high", "method": "Direct review across representative screenshots, DOM/evaluate probes, and active flow evidence", "evidence": "No custom pointer gesture surface is present; native page scrolling remains available.", "pathIds": [ "home" ] }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "pass", "confidence": "high", "method": "Direct review across representative screenshots, DOM/evaluate probes, and active flow evidence", "evidence": "The long document keeps browser scrolling unobstructed and does not add JS-driven sticky chrome.", "pathIds": [ "home" ] }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "pass", "confidence": "high", "method": "Direct review across representative screenshots, DOM/evaluate probes, and active flow evidence", "evidence": "No tooltip or edge-positioned menu requiring anchored positioning appears in the representative paths.", "pathIds": [ "home" ] }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "pass", "confidence": "high", "method": "Direct review across representative screenshots, DOM/evaluate probes, and active flow evidence", "evidence": "Real anchor hrefs, a skip link, descriptive navigation, and clear post-download result links preserve direction.", "pathIds": [ "home" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, or tool evidence gathered on representative paths", "evidence": "Desktop and mobile screenshots show the content dimmed behind a full-screen consent dialog before the downloader can be used.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/home-mobile.png" ], "findingIds": [ "F04" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, or tool evidence gathered on representative paths", "evidence": "DOM probes found zero dialog, popover, and details elements while the custom .fc-consent-root implements a blocking modal.", "pathIds": [ "home" ], "artifacts": [ "evidence/consent-controls.json", "evidence/post-consent-probe.json" ], "findingIds": [ "F05" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "pass", "confidence": "high", "method": "Direct review across representative screenshots, DOM/evaluate probes, and active flow evidence", "evidence": "After the consent layer, the downloader and content occupy the page without persistent app framing.", "pathIds": [ "home" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "pass", "confidence": "high", "method": "Direct review across representative screenshots, DOM/evaluate probes, and active flow evidence", "evidence": "At 360x800 the layout primitive reported scrollWidth 360, clientWidth 360, and zero overflow on all sampled templates.", "pathIds": [ "home" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, or tool evidence gathered on representative paths", "evidence": "The CSS probe found zero container rules across the long multi-card page; adaptation is viewport-only.", "pathIds": [ "home" ], "artifacts": [ "evidence/post-consent-probe.json" ], "findingIds": [ "F06" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, or tool evidence gathered on representative paths", "evidence": "Programmatic focus on the shadow-DOM URL input and the skip link produced outline-style none; the primary input has no alternative visible focus indicator.", "pathIds": [ "home" ], "artifacts": [ "evidence/core-flow.json", "evidence/preferences-probe.json" ], "findingIds": [ "F07" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "pass", "confidence": "high", "method": "Direct review across representative screenshots, DOM/evaluate probes, and active flow evidence", "evidence": "Each sampled page has a descriptive H1 and the homepage immediately identifies TikTok download as its purpose.", "pathIds": [ "home" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "pass", "confidence": "high", "method": "Direct review across representative screenshots, DOM/evaluate probes, and active flow evidence", "evidence": "A known public TikTok URL returned four usable result links: no-watermark, HD, watermark, and MP3.", "pathIds": [ "home" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "pass", "confidence": "high", "method": "Direct review across representative screenshots, DOM/evaluate probes, and active flow evidence", "evidence": "Empty and invalid submissions produce immediate error text, and successful submission restores the Download button with result links.", "pathIds": [ "home" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, or tool evidence gathered on representative paths", "evidence": "Mobile Lighthouse measured LCP 8.6 s and CLS 0.144; the layout primitive independently measured CLS 0.155.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-summary.json", "evidence/layout-mobile.json" ], "findingIds": [ "F08" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, or tool evidence gathered on representative paths", "evidence": "The layout observer recorded shifts of 0.144 at 2.33 s and 0.010 at 4.61 s, totalling CLS 0.155.", "pathIds": [ "home" ], "artifacts": [ "evidence/layout-mobile.json" ], "findingIds": [ "F09" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "pass", "confidence": "high", "method": "Direct review across representative screenshots, DOM/evaluate probes, and active flow evidence", "evidence": "Trace found zero long tasks and 0 ms total blocking time; Lighthouse TBT was 85.5 ms.", "pathIds": [ "home" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, or tool evidence gathered on representative paths", "evidence": "HAR confirms parser-inserted jQuery and jquery-migrate without async/defer, while Lighthouse reports an 8.6 s LCP and a 2.48 s LCP element render delay.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/lighthouse-details.json" ], "findingIds": [ "F10" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, or tool evidence gathered on representative paths", "evidence": "Lighthouse estimates 262 KiB unused JavaScript and 42 KiB unused CSS; 92.9% of the Flatsome stylesheet was unused.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-details.json" ], "findingIds": [ "F11" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, or tool evidence gathered on representative paths", "evidence": "axe found an unnamed focusable image link; the images primitive found 8 images without alt text, and the downloader text input has no label or aria-label.", "pathIds": [ "home" ], "artifacts": [ "evidence/a11y-probe.json", "evidence/images.json", "evidence/core-flow.json" ], "findingIds": [ "F12" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, or tool evidence gathered on representative paths", "evidence": "axe reports 131 serious colour-contrast nodes and four links that rely on colour without a 3:1 difference from body text.", "pathIds": [ "home" ], "artifacts": [ "evidence/a11y-probe.json" ], "findingIds": [ "F13" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, or tool evidence gathered on representative paths", "evidence": "axe found duplicate/nested main landmarks, invalid heading order, and non-unique landmarks; focus probes found no visible outline.", "pathIds": [ "home" ], "artifacts": [ "evidence/a11y-probe.json", "evidence/core-flow.json" ], "findingIds": [ "F14" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "pass", "confidence": "high", "method": "Direct review across representative screenshots, DOM/evaluate probes, and active flow evidence", "evidence": "Mobile screenshots and zero horizontal overflow show readable reflow without clipping on sampled templates.", "pathIds": [ "home" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "pass", "confidence": "high", "method": "Direct review across representative screenshots, DOM/evaluate probes, and active flow evidence", "evidence": "Viewport permits normal scaling, mobile reflow has no overflow, and Lighthouse target-size passed.", "pathIds": [ "home" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "pass", "confidence": "high", "method": "Direct review across representative screenshots, DOM/evaluate probes, and active flow evidence", "evidence": "Lighthouse did not report runtime/console errors, and the exercised successful flow completed.", "pathIds": [ "home" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, or tool evidence gathered on representative paths", "evidence": "The images primitive found 1 image without dimensions, 3 oversized images, 3 below-fold images not lazy-loaded, and 8 missing alt values.", "pathIds": [ "home" ], "artifacts": [ "evidence/images.json" ], "findingIds": [ "F15" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, or tool evidence gathered on representative paths", "evidence": "Lighthouse recorded three deprecated API warnings from the Cloudflare challenge script, including deprecated Shared Storage and persistent storage usage.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-details.json" ], "findingIds": [ "F16" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "pass", "confidence": "high", "method": "Direct review across representative screenshots, DOM/evaluate probes, and active flow evidence", "evidence": "Homepage, MP3, photo, article, and Arabic probes each expose descriptive titles and meta descriptions.", "pathIds": [ "home", "mp3", "photo", "article", "arabic" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "pass", "confidence": "high", "method": "Direct review across representative screenshots, DOM/evaluate probes, and active flow evidence", "evidence": "Raw HTML contains real href links, viewport metadata is present, and robots allows public content.", "pathIds": [ "home", "mp3", "photo", "article", "arabic" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "pass", "confidence": "high", "method": "Direct review across representative screenshots, DOM/evaluate probes, and active flow evidence", "evidence": "Sampled pages expose matching canonicals and extensive hreflang; robots permits indexing and points to a sitemap.", "pathIds": [ "home", "mp3", "photo", "article", "arabic" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "pass", "confidence": "high", "method": "Direct review across representative screenshots, DOM/evaluate probes, and active flow evidence", "evidence": "Homepage exposes Organization/WebSite/WebPage JSON-LD and matching Open Graph title, description, URL, and site name.", "pathIds": [ "home", "mp3", "photo", "article", "arabic" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, or tool evidence gathered on representative paths", "evidence": "HTTPS is used, but CSP, HSTS, nosniff, frame protection, Referrer-Policy, and Permissions-Policy are absent; 3 analytics/consent cookies are not Secure.", "pathIds": [ "home" ], "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ], "findingIds": [ "F17" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, or tool evidence gathered on representative paths", "evidence": "The tracker probe found 11 third-party origins and three known trackers; HAR shows 642,413 third-party bytes, 74% of all transferred bytes.", "pathIds": [ "home" ], "artifacts": [ "evidence/trackers.json", "evidence/home-summary.json" ], "findingIds": [ "F18" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "pass", "confidence": "high", "method": "Direct review across representative screenshots, DOM/evaluate probes, and active flow evidence", "evidence": "Source probe found no geolocation or notification request on load; the site has no authentication surface.", "pathIds": [ "home" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, or tool evidence gathered on representative paths", "evidence": "The headers primitive found no HSTS, clickjacking protection, Referrer-Policy, Permissions-Policy, CSP, or nosniff protection.", "pathIds": [ "home" ], "artifacts": [ "evidence/headers.json" ], "findingIds": [ "F19" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, or tool evidence gathered on representative paths", "evidence": "Raw HTML exposes 94% of content copy, but the downloader is created by attachShadow() and event listeners in inline JavaScript; the no-JS crawler cannot operate the core tool.", "pathIds": [ "home" ], "artifacts": [ "evidence/discoverability.json", "evidence/core-ui-probe.json" ], "findingIds": [ "F20" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "pass", "confidence": "high", "method": "Direct review across representative screenshots, DOM/evaluate probes, and active flow evidence", "evidence": "The AJAX downloader completed successfully and reset its disabled/loading state with result links.", "pathIds": [ "home" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from site purpose and representative-path recon", "evidence": "The downloader inherently requires a live source URL and server conversion; installability/offline conversion is not a meaningful core capability.", "reason": "The downloader inherently requires a live source URL and server conversion; installability/offline conversion is not a meaningful core capability.", "pathIds": [ "home" ] }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, or tool evidence gathered on representative paths", "evidence": "A request for /web-uplift-missing-404 returned a 301 and rendered the homepage title and downloader instead of a 404 with recovery guidance.", "pathIds": [ "home" ], "artifacts": [ "evidence/404-headers.txt", "evidence/404-probe.json" ], "findingIds": [ "F21" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "pass", "confidence": "high", "method": "Direct review across representative screenshots, DOM/evaluate probes, and active flow evidence", "evidence": "English uses lang=en-US; Arabic uses lang=ar and dir=rtl with zero mobile overflow.", "pathIds": [ "home", "arabic" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from site purpose and representative-path recon", "evidence": "Representative pages contain no user-facing dates, currencies, durations, or locale-sensitive numeric data.", "reason": "Representative pages contain no user-facing dates, currencies, durations, or locale-sensitive numeric data.", "pathIds": [ "home" ] }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from site purpose and representative-path recon", "evidence": "The site does not schedule or display events or times.", "reason": "The site does not schedule or display events or times.", "pathIds": [ "home" ] }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, or tool evidence gathered on representative paths", "evidence": "The first-layer dialog offers Consent and Manage options but no Reject all; rejection requires another layer while accepting is one click.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/consent-controls.json" ], "findingIds": [ "F22" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, or tool evidence gathered on representative paths", "evidence": "Invalid input yields “Paste correct link and try again 0x03” by replacing innerHTML, with no aria-live/status semantics exposed by the shadow host.", "pathIds": [ "home" ], "artifacts": [ "evidence/core-flow.json", "evidence/document-probe.json" ], "findingIds": [ "F23" ] }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, or tool evidence gathered on representative paths", "evidence": "The field is type=text with no label, autocomplete token, inputmode, or URL-specific validation despite requiring a TikTok URL.", "pathIds": [ "home" ], "artifacts": [ "evidence/core-flow.json" ], "findingIds": [ "F24" ] }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "pass", "confidence": "high", "method": "Direct review across representative screenshots, DOM/evaluate probes, and active flow evidence", "evidence": "No checkout, subscription, authentication, or account-management flow exists on this free downloader.", "pathIds": [ "home" ] }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, or tool evidence gathered on representative paths", "evidence": "The images primitive reports 54 legacy-format images, 3 oversized images, 1 missing srcset, and 3 below-fold images not lazy-loaded.", "pathIds": [ "home" ], "artifacts": [ "evidence/images.json" ], "findingIds": [ "F25" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, or tool evidence gathered on representative paths", "evidence": "HAR recorded 629,868 script bytes and Lighthouse estimated 262 KiB unused JS, mostly ad, analytics, and consent scripts.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/lighthouse-details.json" ], "findingIds": [ "F26" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, or tool evidence gathered on representative paths", "evidence": "Third parties transfer 642,413 of 862,683 bytes; AdSense, Tag Manager, Funding Choices, and fonts are the largest origins.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json" ], "findingIds": [ "F27" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, or tool evidence gathered on representative paths", "evidence": "Lighthouse agentic browsing scored 0.26 and found no well-formed agent accessibility tree or llms.txt; the actionable downloader lives inside shadow DOM with no WebMCP tool.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-summary.json", "evidence/core-ui-probe.json" ], "findingIds": [ "F28" ] }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from site purpose and representative-path recon", "evidence": "On-device language-model or summarisation features do not provide a proportionate benefit to this URL conversion task.", "reason": "On-device language-model or summarisation features do not provide a proportionate benefit to this URL conversion task.", "pathIds": [ "home" ] }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "pass", "confidence": "high", "method": "Direct review across representative screenshots, DOM/evaluate probes, and active flow evidence", "evidence": "After 10 consent manage/back cycles, heap grew only 235,884 bytes (1.08%) and 2,388 nodes, with no unbounded trend established.", "pathIds": [ "home" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, or tool evidence gathered on representative paths", "evidence": "The baseline heap contains 381,113 nodes and 21.84 MB self size, while the rendered consent DOM lists hundreds of vendor controls before interaction.", "pathIds": [ "home" ], "artifacts": [ "evidence/heap-baseline.json", "evidence/consent-controls.json" ], "findingIds": [ "F29" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "pass", "confidence": "high", "method": "Direct review across representative screenshots, DOM/evaluate probes, and active flow evidence", "evidence": "Before/after summaries show modest growth and no Detached constructor among top retained constructors.", "pathIds": [ "home" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F01", "F02" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "issues", "findingIds": [ "F03" ] }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "pass" }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "issues", "findingIds": [ "F04", "F05" ] }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "issues", "findingIds": [ "F06", "F07" ] }, { "principleId": "support-core-task-success", "expectation": "default", "status": "pass" }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F08", "F09", "F10", "F11" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F12", "F13", "F14" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "issues", "findingIds": [ "F15", "F16" ] }, { "principleId": "be-discoverable", "expectation": "default", "status": "pass" }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F17", "F18", "F19" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "issues", "findingIds": [ "F20", "F21" ] }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "pass" }, { "principleId": "be-trustworthy", "expectation": "default", "status": "issues", "findingIds": [ "F22", "F23", "F24" ] }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F25", "F26", "F27" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "issues", "findingIds": [ "F28" ] }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "issues", "findingIds": [ "F29" ] } ], "paths": [ { "id": "home", "description": "Homepage and primary downloader journey: first-load consent, empty/invalid input, and successful TikTok conversion.", "url": "https://tiktokio.com/", "conditions": [ "desktop", "viewport: 360x800", "prefers-color-scheme: dark", "prefers-reduced-motion: reduce", "keyboard focus", "successful and invalid submission" ], "result": "issues" }, { "id": "mp3", "description": "Representative alternate conversion-tool template for TikTok-to-MP3.", "url": "https://tiktokio.com/tiktok-mp3/", "conditions": [ "viewport: 360x800" ], "result": "issues" }, { "id": "photo", "description": "Representative photo/slideshow downloader template.", "url": "https://tiktokio.com/download-tiktok-photo-and-slide/", "conditions": [ "viewport: 360x800" ], "result": "issues" }, { "id": "article", "description": "Representative instructional/content page.", "url": "https://tiktokio.com/how-to-save-tiktok-videos-without-watermark/", "conditions": [ "viewport: 360x800" ], "result": "issues" }, { "id": "arabic", "description": "RTL localized homepage to verify language, direction, metadata, and reflow.", "url": "https://tiktokio.com/ar/", "conditions": [ "viewport: 360x800", "rtl" ], "result": "issues" }, { "id": "missing", "description": "Unknown route to assess HTTP and recovery behaviour.", "url": "https://tiktokio.com/web-uplift-missing-404", "conditions": [ "HTTP response", "viewport: 360x800" ], "result": "issues" } ], "findings": [ { "id": "F01", "pathId": "home", "url": "https://tiktokio.com/", "principleId": "respect-user-preferences", "principleCheckId": "respects-color-scheme", "guidanceId": "dark-mode", "guidanceCategory": "web", "severity": "medium", "confidence": "high", "summary": "The site ignores the user’s dark-theme preference", "evidence": "The light and dark screenshots are byte-identical (49,292 bytes), and the preference probe reports computed color-scheme: normal.", "artifacts": [ "evidence/home-dark.png", "evidence/home-desktop.png" ], "suggestedFix": "Declare color-scheme and use prefers-color-scheme or light-dark() tokens for every surface, including the consent UI.", "effort": "small" }, { "id": "F02", "pathId": "home", "url": "https://tiktokio.com/", "principleId": "respect-user-preferences", "principleCheckId": "respects-contrast", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "severity": "high", "confidence": "high", "summary": "Text and essential links fail contrast requirements", "evidence": "axe found 131 color-contrast failures, including 2.93:1 text on #df6d1e, plus four links distinguished only by low-contrast colour.", "artifacts": [ "evidence/a11y-probe.json" ], "suggestedFix": "Replace low-contrast colour pairs and give inline links a non-colour affordance such as an underline.", "effort": "medium" }, { "id": "F03", "pathId": "home", "url": "https://tiktokio.com/", "principleId": "implement-natural-interactions", "principleCheckId": "view-transitions", "guidanceId": "html", "guidanceCategory": "web", "severity": "low", "confidence": "high", "summary": "Primary result state changes abruptly", "evidence": "The app injects result HTML into an open shadow root; the probe found no View Transition support or usage and no running transition for the download state change.", "artifacts": [ "evidence/post-consent-probe.json", "evidence/core-success-flow.json" ], "suggestedFix": "Wrap the result-state update in document.startViewTransition() with a no-motion fallback.", "effort": "small" }, { "id": "F04", "pathId": "home", "url": "https://tiktokio.com/", "principleId": "maximize-content-reduce-noise", "principleCheckId": "no-intrusive-interruptions", "guidanceId": "privacy", "guidanceCategory": "privacy", "severity": "high", "confidence": "high", "summary": "A consent interstitial blocks the entire primary task on first load", "evidence": "Desktop and mobile screenshots show the content dimmed behind a full-screen consent dialog before the downloader can be used.", "artifacts": [ "evidence/home-desktop.png", "evidence/home-mobile.png" ], "suggestedFix": "Use a compact, content-first consent surface and keep a clearly labelled reject option at the same level as accept.", "effort": "medium" }, { "id": "F05", "pathId": "home", "url": "https://tiktokio.com/", "principleId": "maximize-content-reduce-noise", "principleCheckId": "semantic-dismissible-primitives", "guidanceId": "html", "guidanceCategory": "web", "severity": "medium", "confidence": "high", "summary": "The consent modal is custom div-based UI rather than a native dialog", "evidence": "DOM probes found zero dialog, popover, and details elements while the custom .fc-consent-root implements a blocking modal.", "artifacts": [ "evidence/consent-controls.json", "evidence/post-consent-probe.json" ], "suggestedFix": "Use a native dialog with correct modal focus management and platform dismissal semantics.", "effort": "small" }, { "id": "F06", "pathId": "home", "url": "https://tiktokio.com/", "principleId": "adapt-to-the-form-factor", "principleCheckId": "component-level-responsiveness", "guidanceId": "fluid-scaling", "guidanceCategory": "web", "severity": "low", "confidence": "high", "summary": "Reusable UI has no component-level responsiveness", "evidence": "The CSS probe found zero container rules across the long multi-card page; adaptation is viewport-only.", "artifacts": [ "evidence/post-consent-probe.json" ], "suggestedFix": "Give reused cards and downloader panels containment and size-aware @container rules where their layout changes.", "effort": "small" }, { "id": "F07", "pathId": "home", "url": "https://tiktokio.com/", "principleId": "adapt-to-the-form-factor", "principleCheckId": "input-modality-aware", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "severity": "high", "confidence": "high", "summary": "Keyboard focus is not visibly indicated on primary controls", "evidence": "Programmatic focus on the shadow-DOM URL input and the skip link produced outline-style none; the primary input has no alternative visible focus indicator.", "artifacts": [ "evidence/core-flow.json", "evidence/preferences-probe.json" ], "suggestedFix": "Add a high-contrast :focus-visible ring to every link, button, and shadow-root input without removing native outlines.", "effort": "medium" }, { "id": "F08", "pathId": "home", "url": "https://tiktokio.com/", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "guidanceId": "performance", "guidanceCategory": "performance", "severity": "high", "confidence": "high", "summary": "Largest Contentful Paint is very slow and layout stability misses the good range", "evidence": "Mobile Lighthouse measured LCP 8.6 s and CLS 0.144; the layout primitive independently measured CLS 0.155.", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/layout-mobile.json" ], "suggestedFix": "Remove the consent UI from the critical rendering path, reserve its layout, and prioritise the true primary content.", "effort": "medium" }, { "id": "F09", "pathId": "home", "url": "https://tiktokio.com/", "principleId": "be-fast-and-stable", "principleCheckId": "visual-stability", "guidanceId": "performance", "guidanceCategory": "performance", "severity": "medium", "confidence": "high", "summary": "Late consent content causes measurable layout shift", "evidence": "The layout observer recorded shifts of 0.144 at 2.33 s and 0.010 at 4.61 s, totalling CLS 0.155.", "artifacts": [ "evidence/layout-mobile.json" ], "suggestedFix": "Reserve stable space or render the consent state atomically before first paint; set dimensions for all images.", "effort": "small" }, { "id": "F10", "pathId": "home", "url": "https://tiktokio.com/", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "guidanceId": "performance", "guidanceCategory": "performance", "severity": "high", "confidence": "high", "summary": "Blocking scripts and dependency work delay useful content", "evidence": "HAR confirms parser-inserted jQuery and jquery-migrate without async/defer, while Lighthouse reports an 8.6 s LCP and a 2.48 s LCP element render delay.", "artifacts": [ "evidence/home-summary.json", "evidence/lighthouse-details.json" ], "suggestedFix": "Remove jquery-migrate where possible, defer non-critical scripts, and keep ad/consent dependencies out of the critical chain.", "effort": "medium" }, { "id": "F11", "pathId": "home", "url": "https://tiktokio.com/", "principleId": "be-fast-and-stable", "principleCheckId": "trim-unused-and-duplicate-code", "guidanceId": "performance", "guidanceCategory": "performance", "severity": "high", "confidence": "high", "summary": "The page ships substantial unused ad and theme code", "evidence": "Lighthouse estimates 262 KiB unused JavaScript and 42 KiB unused CSS; 92.9% of the Flatsome stylesheet was unused.", "artifacts": [ "evidence/lighthouse-details.json" ], "suggestedFix": "Conditionally load ad/consent code after a lawful choice and generate route-level critical CSS instead of the full theme bundle.", "effort": "medium" }, { "id": "F12", "pathId": "home", "url": "https://tiktokio.com/", "principleId": "be-inclusive", "principleCheckId": "names-roles-labels", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "severity": "high", "confidence": "high", "summary": "Some controls and images lack accessible names", "evidence": "axe found an unnamed focusable image link; the images primitive found 8 images without alt text, and the downloader text input has no label or aria-label.", "artifacts": [ "evidence/a11y-probe.json", "evidence/images.json", "evidence/core-flow.json" ], "suggestedFix": "Label the URL field, name every focusable link, and provide meaningful or empty alt text according to image purpose.", "effort": "medium" }, { "id": "F13", "pathId": "home", "url": "https://tiktokio.com/", "principleId": "be-inclusive", "principleCheckId": "sufficient-contrast", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "severity": "high", "confidence": "high", "summary": "Foreground/background contrast is insufficient across the page", "evidence": "axe reports 131 serious colour-contrast nodes and four links that rely on colour without a 3:1 difference from body text.", "artifacts": [ "evidence/a11y-probe.json" ], "suggestedFix": "Adopt tested accessible colour tokens and underline links in prose.", "effort": "medium" }, { "id": "F14", "pathId": "home", "url": "https://tiktokio.com/", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "severity": "high", "confidence": "high", "summary": "Landmarks, heading order, and focus treatment are not robust", "evidence": "axe found duplicate/nested main landmarks, invalid heading order, and non-unique landmarks; focus probes found no visible outline.", "artifacts": [ "evidence/a11y-probe.json", "evidence/core-flow.json" ], "suggestedFix": "Keep one top-level main, repair heading order, uniquely label repeated landmarks, and add :focus-visible styles.", "effort": "medium" }, { "id": "F15", "pathId": "home", "url": "https://tiktokio.com/", "principleId": "follow-best-practices", "principleCheckId": "sound-document-and-assets", "guidanceId": "html", "guidanceCategory": "web", "severity": "medium", "confidence": "high", "summary": "Image asset hygiene is inconsistent", "evidence": "The images primitive found 1 image without dimensions, 3 oversized images, 3 below-fold images not lazy-loaded, and 8 missing alt values.", "artifacts": [ "evidence/images.json" ], "suggestedFix": "Set intrinsic dimensions, use responsive srcset/sizes, lazy-load below-fold images, and repair alt text.", "effort": "small" }, { "id": "F16", "pathId": "home", "url": "https://tiktokio.com/", "principleId": "follow-best-practices", "principleCheckId": "browser-platform-hygiene", "guidanceId": "html", "guidanceCategory": "web", "severity": "medium", "confidence": "high", "summary": "Deprecated APIs execute during page load", "evidence": "Lighthouse recorded three deprecated API warnings from the Cloudflare challenge script, including deprecated Shared Storage and persistent storage usage.", "artifacts": [ "evidence/lighthouse-details.json" ], "suggestedFix": "Update or configure the challenge integration so it does not execute deprecated browser APIs.", "effort": "small" }, { "id": "F17", "pathId": "home", "url": "https://tiktokio.com/", "principleId": "be-private-and-secure", "principleCheckId": "secure-transport-and-headers", "guidanceId": "security", "guidanceCategory": "security", "severity": "high", "confidence": "high", "summary": "Security headers and cookie attributes are weak", "evidence": "HTTPS is used, but CSP, HSTS, nosniff, frame protection, Referrer-Policy, and Permissions-Policy are absent; 3 analytics/consent cookies are not Secure.", "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ], "suggestedFix": "Deploy a staged CSP, HSTS, nosniff, frame-ancestors, Referrer-Policy, and Permissions-Policy; mark all HTTPS cookies Secure with appropriate SameSite.", "effort": "medium" }, { "id": "F18", "pathId": "home", "url": "https://tiktokio.com/", "principleId": "be-private-and-secure", "principleCheckId": "data-minimisation-and-third-parties", "guidanceId": "privacy", "guidanceCategory": "privacy", "severity": "high", "confidence": "high", "summary": "Advertising and analytics dominate the network footprint", "evidence": "The tracker probe found 11 third-party origins and three known trackers; HAR shows 642,413 third-party bytes, 74% of all transferred bytes.", "artifacts": [ "evidence/trackers.json", "evidence/home-summary.json" ], "suggestedFix": "Minimise vendors, delay non-essential analytics/ads until consent, and prefer batched first-party measurement.", "effort": "medium" }, { "id": "F19", "pathId": "home", "url": "https://tiktokio.com/", "principleId": "be-private-and-secure", "principleCheckId": "defensive-browser-policies", "guidanceId": "security", "guidanceCategory": "security", "severity": "high", "confidence": "high", "summary": "Browser-enforced defensive policies are absent", "evidence": "The headers primitive found no HSTS, clickjacking protection, Referrer-Policy, Permissions-Policy, CSP, or nosniff protection.", "artifacts": [ "evidence/headers.json" ], "suggestedFix": "Add HSTS, CSP frame-ancestors, nosniff, strict-origin-when-cross-origin, and a least-privilege Permissions-Policy.", "effort": "medium" }, { "id": "F20", "pathId": "home", "url": "https://tiktokio.com/", "principleId": "be-resilient", "principleCheckId": "progressive-enhancement", "guidanceId": "html", "guidanceCategory": "web", "severity": "high", "confidence": "high", "summary": "The core downloader disappears without JavaScript", "evidence": "Raw HTML exposes 94% of content copy, but the downloader is created by attachShadow() and event listeners in inline JavaScript; the no-JS crawler cannot operate the core tool.", "artifacts": [ "evidence/discoverability.json", "evidence/core-ui-probe.json" ], "suggestedFix": "Render a labelled URL form in HTML that posts to the existing endpoint, then enhance it with shadow DOM and AJAX.", "effort": "medium" }, { "id": "F21", "pathId": "home", "url": "https://tiktokio.com/", "principleId": "be-resilient", "principleCheckId": "network-and-http-failure-states", "guidanceId": "html", "guidanceCategory": "web", "severity": "medium", "confidence": "high", "summary": "Missing URLs silently redirect to the homepage", "evidence": "A request for /web-uplift-missing-404 returned a 301 and rendered the homepage title and downloader instead of a 404 with recovery guidance.", "artifacts": [ "evidence/404-headers.txt", "evidence/404-probe.json" ], "suggestedFix": "Return a real 404 status and a focused not-found page with search/home recovery links.", "effort": "small" }, { "id": "F22", "pathId": "home", "url": "https://tiktokio.com/", "principleId": "be-trustworthy", "principleCheckId": "no-dark-patterns", "guidanceId": "privacy", "guidanceCategory": "privacy", "severity": "high", "confidence": "high", "summary": "Consent is easier to accept than refuse", "evidence": "The first-layer dialog offers Consent and Manage options but no Reject all; rejection requires another layer while accepting is one click.", "artifacts": [ "evidence/home-desktop.png", "evidence/consent-controls.json" ], "suggestedFix": "Provide equally prominent Accept all and Reject all actions on the first layer and minimise default purposes/vendors.", "effort": "medium" }, { "id": "F23", "pathId": "home", "url": "https://tiktokio.com/", "principleId": "be-trustworthy", "principleCheckId": "humane-error-handling", "guidanceId": "validate-input-after-interaction", "guidanceCategory": "web", "severity": "medium", "confidence": "high", "summary": "Downloader errors are visual-only and use an opaque error code", "evidence": "Invalid input yields “Paste correct link and try again 0x03” by replacing innerHTML, with no aria-live/status semantics exposed by the shadow host.", "artifacts": [ "evidence/core-flow.json", "evidence/document-probe.json" ], "suggestedFix": "Validate the URL after interaction, associate clear guidance with the input, and announce errors through role=status or aria-live.", "effort": "small" }, { "id": "F24", "pathId": "home", "url": "https://tiktokio.com/", "principleId": "be-trustworthy", "principleCheckId": "trustworthy-input-assistance", "guidanceId": "forms", "guidanceCategory": "web", "severity": "low", "confidence": "high", "summary": "The primary URL field does not expose URL input semantics", "evidence": "The field is type=text with no label, autocomplete token, inputmode, or URL-specific validation despite requiring a TikTok URL.", "artifacts": [ "evidence/core-flow.json" ], "suggestedFix": "Use type=url, a visible label, inputmode=url, spellcheck=false, and descriptive validation.", "effort": "small" }, { "id": "F25", "pathId": "home", "url": "https://tiktokio.com/", "principleId": "be-sustainable", "principleCheckId": "optimised-assets", "guidanceId": "deliver-optimized-decorative-images", "guidanceCategory": "web", "severity": "medium", "confidence": "high", "summary": "Most image elements use legacy formats or lack responsive delivery", "evidence": "The images primitive reports 54 legacy-format images, 3 oversized images, 1 missing srcset, and 3 below-fold images not lazy-loaded.", "artifacts": [ "evidence/images.json" ], "suggestedFix": "Serve content images as AVIF/WebP with srcset/sizes and lazy-load below-fold assets.", "effort": "small" }, { "id": "F26", "pathId": "home", "url": "https://tiktokio.com/", "principleId": "be-sustainable", "principleCheckId": "no-wasteful-work", "guidanceId": "performance", "guidanceCategory": "performance", "severity": "high", "confidence": "high", "summary": "Non-core advertising work outweighs the product code", "evidence": "HAR recorded 629,868 script bytes and Lighthouse estimated 262 KiB unused JS, mostly ad, analytics, and consent scripts.", "artifacts": [ "evidence/home-summary.json", "evidence/lighthouse-details.json" ], "suggestedFix": "Load non-essential scripts only after consent and interaction, and remove redundant analytics and migration code.", "effort": "medium" }, { "id": "F27", "pathId": "home", "url": "https://tiktokio.com/", "principleId": "be-sustainable", "principleCheckId": "third-party-and-media-budget", "guidanceId": "privacy", "guidanceCategory": "privacy", "severity": "high", "confidence": "high", "summary": "Third-party scripts consume most transferred bytes", "evidence": "Third parties transfer 642,413 of 862,683 bytes; AdSense, Tag Manager, Funding Choices, and fonts are the largest origins.", "artifacts": [ "evidence/home-summary.json" ], "suggestedFix": "Set and enforce a third-party byte/request budget, self-host the one needed font subset, and defer ads.", "effort": "medium" }, { "id": "F28", "pathId": "home", "url": "https://tiktokio.com/", "principleId": "be-agent-ready", "principleCheckId": "structured-agent-capabilities", "guidanceId": "webmcp", "guidanceCategory": "web", "severity": "low", "confidence": "high", "summary": "The downloader has no structured agent-facing capability", "evidence": "Lighthouse agentic browsing scored 0.26 and found no well-formed agent accessibility tree or llms.txt; the actionable downloader lives inside shadow DOM with no WebMCP tool.", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/core-ui-probe.json" ], "suggestedFix": "Expose the downloader as a safe, validated agentic form or WebMCP tool while retaining the standard HTML form.", "effort": "small" }, { "id": "F29", "pathId": "home", "url": "https://tiktokio.com/", "principleId": "be-memory-efficient", "principleCheckId": "bounded-footprint", "guidanceId": "manage-recurring-intervals", "guidanceCategory": "web", "severity": "medium", "confidence": "high", "summary": "The initial footprint is large for a simple downloader", "evidence": "The baseline heap contains 381,113 nodes and 21.84 MB self size, while the rendered consent DOM lists hundreds of vendor controls before interaction.", "artifacts": [ "evidence/heap-baseline.json", "evidence/consent-controls.json" ], "suggestedFix": "Virtualise or defer vendor detail DOM and load only the consent summary initially.", "effort": "small" } ], "taskList": [ { "id": "T01", "title": "Use a compact, content-first consent surface and keep a clearly labelled reject option at the same level as accept.", "priority": 1, "findingIds": [ "F04" ], "guidanceId": "privacy", "status": "open" }, { "id": "T02", "title": "Deploy a staged CSP, HSTS, nosniff, frame-ancestors, Referrer-Policy, and Permissions-Policy; mark all HTTPS cookies Secure with appropriate SameSite.", "priority": 2, "findingIds": [ "F17" ], "guidanceId": "security", "status": "open" }, { "id": "T03", "title": "Remove the consent UI from the critical rendering path, reserve its layout, and prioritise the true primary content.", "priority": 3, "findingIds": [ "F08" ], "guidanceId": "performance", "status": "open" }, { "id": "T04", "title": "Minimise vendors, delay non-essential analytics/ads until consent, and prefer batched first-party measurement.", "priority": 4, "findingIds": [ "F18" ], "guidanceId": "privacy", "status": "open" }, { "id": "T05", "title": "Add a high-contrast :focus-visible ring to every link, button, and shadow-root input without removing native outlines.", "priority": 5, "findingIds": [ "F07" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T06", "title": "Label the URL field, name every focusable link, and provide meaningful or empty alt text according to image purpose.", "priority": 6, "findingIds": [ "F12" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T07", "title": "Render a labelled URL form in HTML that posts to the existing endpoint, then enhance it with shadow DOM and AJAX.", "priority": 7, "findingIds": [ "F20" ], "guidanceId": "html", "status": "open" }, { "id": "T08", "title": "Conditionally load ad/consent code after a lawful choice and generate route-level critical CSS instead of the full theme bundle.", "priority": 8, "findingIds": [ "F11" ], "guidanceId": "performance", "status": "open" }, { "id": "T09", "title": "Provide equally prominent Accept all and Reject all actions on the first layer and minimise default purposes/vendors.", "priority": 9, "findingIds": [ "F22" ], "guidanceId": "privacy", "status": "open" }, { "id": "T10", "title": "Return a real 404 status and a focused not-found page with search/home recovery links.", "priority": 10, "findingIds": [ "F21" ], "guidanceId": "html", "status": "open" } ], "budget": { "wallClockSeconds": 900, "pathCount": 6, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-20T17-17-24-035Z" }