{ "url": "https://posteid.poste.it", "auditedAt": "2026-07-26T15:50:37.958Z", "mode": "report", "status": "completed", "statusDetail": "Coverage-complete audit of five representative public paths. Edge rate limiting intermittently produced 403s during parallel evidence collection; claims use successful captures or identify the reproducible user-facing 403 route explicitly.", "page": { "appType": "mpa", "framework": "Legacy server-rendered portal with jQuery/Bootstrap-style components and third-party assistance/analytics scripts", "notes": "Public Italian digital identity landing, registration, recovery, suspension and linked accessible-version surfaces." }, "evidenceUsed": [ "screenshot", "dom", "evaluate-probe", "layout-metrics", "trace", "HAR (rate-limited capture retained but not used for performance claims)", "Lighthouse", "raw HTTP/curl", "response headers", "trackers", "cookies", "secrets", "images", "discoverability", "heap-summary" ], "guidanceConsulted": [ "accessibility", "accessible-error-announcement", "adapt-scrollbar-to-contrast-preferences", "anchor-positioning-tab-underline", "autofill-address-form", "autofill-payment-form", "break-up-long-tasks", "complex-shapes", "coordinate-global-events", "css", "dark-mode", "declarative-dialog-popover-control", "deliver-optimized-decorative-images", "deprioritize-background-fetches", "directional-navigation-transitions", "flicker-free-client-side-ab-testing", "fluid-scaling", "forms", "html", "identify-heavy-scripts", "identify-inp-causes", "improve-text-layout-and-legibility", "language-model", "light-dismiss-a-dialog", "manage-recurring-intervals", "move-dom-element-without-losing-state", "optimize-image-priority", "passkeys", "persistent-toast-notifications", "physics-based-easing", "privacy", "resilient-context-menus-and-nested-dropdowns", "same-document-transitions", "scrollytelling", "search-hidden-content", "security", "shrinking-header-on-scroll", "size-aware-styling", "support-global-calendar-systems", "translator", "visually-stable-font-fallbacks", "webmcp" ], "artifacts": [ { "type": "layout", "path": "evidence/accessible-layout-mobile.json", "caption": "Audit evidence: accessible layout mobile.", "condition": "viewport: 360x800", "findingIds": [] }, { "type": "screenshot", "path": "evidence/accessible-mobile.png", "caption": "Audit evidence: accessible mobile.", "condition": "viewport: 360x800", "findingIds": [ "F17" ] }, { "type": "other", "path": "evidence/accessible-probe.json", "caption": "Audit evidence: accessible probe.", "findingIds": [] }, { "type": "other", "path": "evidence/home-cookies.json", "caption": "Audit evidence: home cookies.", "findingIds": [] }, { "type": "screenshot", "path": "evidence/home-dark.png", "caption": "Audit evidence: home dark.", "condition": "prefers-color-scheme: dark", "findingIds": [ "F01" ] }, { "type": "screenshot", "path": "evidence/home-desktop.png", "caption": "Audit evidence: home desktop.", "findingIds": [ "F02", "F03", "F15", "F16" ] }, { "type": "screenshot", "path": "evidence/home-discoverability-crawler.png", "caption": "Audit evidence: home discoverability crawler.", "findingIds": [] }, { "type": "screenshot", "path": "evidence/home-discoverability-rendered.png", "caption": "Audit evidence: home discoverability rendered.", "findingIds": [] }, { "type": "discoverability", "path": "evidence/home-discoverability.json", "caption": "Audit evidence: home discoverability.", "findingIds": [] }, { "type": "dom", "path": "evidence/home-dom.json", "caption": "Audit evidence: home dom.", "findingIds": [] }, { "type": "other", "path": "evidence/home-feature-signals.txt", "caption": "Audit evidence: home feature signals.", "findingIds": [ "F16" ] }, { "type": "other", "path": "evidence/home-headers.json", "caption": "Audit evidence: home headers.", "findingIds": [] }, { "type": "heap", "path": "evidence/home-heap-baseline.json", "caption": "Audit evidence: home heap baseline.", "findingIds": [] }, { "type": "heap", "path": "evidence/home-heap-comparison.json", "caption": "Audit evidence: home heap comparison.", "findingIds": [] }, { "type": "heap", "path": "evidence/home-heap-post.json", "caption": "Audit evidence: home heap post.", "findingIds": [] }, { "type": "screenshot", "path": "evidence/home-high-contrast.png", "caption": "Audit evidence: home high contrast.", "condition": "prefers-contrast: more", "findingIds": [ "F01" ] }, { "type": "other", "path": "evidence/home-images.json", "caption": "Audit evidence: home images.", "findingIds": [ "F11", "F19" ] }, { "type": "other", "path": "evidence/home-interaction-targets.json", "caption": "Audit evidence: home interaction targets.", "findingIds": [] }, { "type": "layout", "path": "evidence/home-layout-mobile.json", "caption": "Audit evidence: home layout mobile.", "condition": "viewport: 360x800", "findingIds": [] }, { "type": "lighthouse", "path": "evidence/home-lighthouse-details.json", "caption": "Audit evidence: home lighthouse details.", "findingIds": [ "F01", "F04", "F06", "F07", "F08", "F09", "F10", "F11", "F13", "F15", "F19" ] }, { "type": "lighthouse", "path": "evidence/home-lighthouse-summary.json", "caption": "Audit evidence: home lighthouse summary.", "findingIds": [ "F06", "F07", "F08", "F12" ] }, { "type": "lighthouse", "path": "evidence/home-lighthouse.json", "caption": "Audit evidence: home lighthouse.", "findingIds": [] }, { "type": "screenshot", "path": "evidence/home-mobile.png", "caption": "Audit evidence: home mobile.", "condition": "viewport: 360x800", "findingIds": [ "F03", "F10" ] }, { "type": "other", "path": "evidence/home-preferences-default.json", "caption": "Audit evidence: home preferences default.", "findingIds": [] }, { "type": "other", "path": "evidence/home-probe.json", "caption": "Audit evidence: home probe.", "findingIds": [ "F04", "F08", "F12" ] }, { "type": "dom", "path": "evidence/home-raw.html", "caption": "Audit evidence: home raw.", "findingIds": [ "F02" ] }, { "type": "other", "path": "evidence/home-reduced-motion.json", "caption": "Audit evidence: home reduced motion.", "condition": "prefers-reduced-motion: reduce", "findingIds": [] }, { "type": "other", "path": "evidence/home-response-headers.txt", "caption": "Audit evidence: home response headers.", "findingIds": [ "F14" ] }, { "type": "other", "path": "evidence/home-secrets.json", "caption": "Audit evidence: home secrets.", "findingIds": [] }, { "type": "har-summary", "path": "evidence/home-summary.json", "caption": "Audit evidence: home summary.", "findingIds": [] }, { "type": "trace-summary", "path": "evidence/home-trace-summary.json", "caption": "Audit evidence: home trace summary.", "findingIds": [ "F06" ] }, { "type": "trace", "path": "evidence/home-trace.json", "caption": "Audit evidence: home trace.", "findingIds": [] }, { "type": "other", "path": "evidence/home-trackers.json", "caption": "Audit evidence: home trackers.", "findingIds": [ "F15", "F19" ] }, { "type": "har", "path": "evidence/home.har", "caption": "Audit evidence: home.", "findingIds": [] }, { "type": "other", "path": "evidence/recon.json", "caption": "Audit evidence: recon.", "findingIds": [] }, { "type": "dom", "path": "evidence/recovery-form-dom.json", "caption": "Audit evidence: recovery form dom.", "findingIds": [] }, { "type": "other", "path": "evidence/recovery-form-probe.json", "caption": "Audit evidence: recovery form probe.", "findingIds": [] }, { "type": "other", "path": "evidence/recovery-form-signals.txt", "caption": "Audit evidence: recovery form signals.", "findingIds": [ "F18" ] }, { "type": "layout", "path": "evidence/recovery-layout-mobile.json", "caption": "Audit evidence: recovery layout mobile.", "condition": "viewport: 360x800", "findingIds": [] }, { "type": "screenshot", "path": "evidence/recovery-mobile.png", "caption": "Audit evidence: recovery mobile.", "condition": "viewport: 360x800", "findingIds": [] }, { "type": "other", "path": "evidence/recovery-probe.json", "caption": "Audit evidence: recovery probe.", "findingIds": [] }, { "type": "dom", "path": "evidence/recovery-raw.html", "caption": "Audit evidence: recovery raw.", "findingIds": [] }, { "type": "screenshot", "path": "evidence/registration-discoverability-crawler.png", "caption": "Audit evidence: registration discoverability crawler.", "findingIds": [] }, { "type": "screenshot", "path": "evidence/registration-discoverability-rendered.png", "caption": "Audit evidence: registration discoverability rendered.", "findingIds": [] }, { "type": "discoverability", "path": "evidence/registration-discoverability.json", "caption": "Audit evidence: registration discoverability.", "findingIds": [] }, { "type": "layout", "path": "evidence/registration-layout-mobile.json", "caption": "Audit evidence: registration layout mobile.", "condition": "viewport: 360x800", "findingIds": [] }, { "type": "screenshot", "path": "evidence/registration-mobile.png", "caption": "Audit evidence: registration mobile.", "condition": "viewport: 360x800", "findingIds": [ "F03", "F05", "F10" ] }, { "type": "other", "path": "evidence/registration-probe.json", "caption": "Audit evidence: registration probe.", "findingIds": [] }, { "type": "other", "path": "evidence/robots-headers.txt", "caption": "Audit evidence: robots headers.", "findingIds": [] }, { "type": "other", "path": "evidence/robots.txt", "caption": "Audit evidence: robots.", "findingIds": [ "F13" ] }, { "type": "other", "path": "evidence/sitemap-headers.txt", "caption": "Audit evidence: sitemap headers.", "findingIds": [] }, { "type": "other", "path": "evidence/sitemap.xml", "caption": "Audit evidence: sitemap.", "findingIds": [ "F13" ] }, { "type": "screenshot", "path": "evidence/suspension-dark-mobile.png", "caption": "Audit evidence: suspension dark mobile.", "condition": "viewport: 360x800", "findingIds": [] }, { "type": "other", "path": "evidence/suspension-form-signals.txt", "caption": "Audit evidence: suspension form signals.", "findingIds": [ "F18" ] }, { "type": "layout", "path": "evidence/suspension-layout-mobile.json", "caption": "Audit evidence: suspension layout mobile.", "condition": "viewport: 360x800", "findingIds": [] }, { "type": "screenshot", "path": "evidence/suspension-mobile.png", "caption": "Audit evidence: suspension mobile.", "condition": "viewport: 360x800", "findingIds": [ "F03", "F05", "F18" ] }, { "type": "other", "path": "evidence/suspension-probe.json", "caption": "Audit evidence: suspension probe.", "findingIds": [] }, { "type": "dom", "path": "evidence/suspension-raw.html", "caption": "Audit evidence: suspension raw.", "findingIds": [] } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 58, "blocked": 0, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": true }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "issues", "confidence": "high", "method": "Dark preference screenshot plus computed-style/DOM inspection.", "evidence": "Dark emulation leaves the light palette unchanged and color-scheme is normal.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dark.png", "evidence/home-probe.json" ], "findingIds": [ "F01" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "pass", "confidence": "high", "method": "getAnimations() under prefers-reduced-motion: reduce.", "evidence": "The emulated preference matched and the page reported zero active animations.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-reduced-motion.json" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "issues", "confidence": "high", "method": "Higher-contrast screenshot plus Lighthouse contrast audit.", "evidence": "No preference-specific adaptation was visible and footer text measured 3.73:1.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-high-contrast.png", "evidence/home-lighthouse-details.json" ], "findingIds": [ "F01" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "issues", "confidence": "medium", "method": "Public journey walkthrough and raw feature search.", "evidence": "Registration, sign-in and recovery are document navigations with no View Transition signal.", "pathIds": [ "home", "registration", "recovery" ], "artifacts": [ "evidence/home-desktop.png", "evidence/home-feature-signals.txt" ], "findingIds": [ "F02" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "not-applicable", "confidence": "high", "method": "Recon and rendered/source inspection established that the targeted interaction or content type is absent.", "evidence": "The audited templates contain no parallax, scrollytelling, carousel or scroll-linked animation to implement.", "reason": "The audited templates contain no parallax, scrollytelling, carousel or scroll-linked animation to implement." }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "not-applicable", "confidence": "high", "method": "Recon and rendered/source inspection established that the targeted interaction or content type is absent.", "evidence": "The public templates expose links/forms but no swipe, pull, drag, snap-carousel or gesture-driven surface.", "reason": "The public templates expose links/forms but no swipe, pull, drag, snap-carousel or gesture-driven surface." }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "not-applicable", "confidence": "high", "method": "Recon and rendered/source inspection established that the targeted interaction or content type is absent.", "evidence": "The public pages have no sticky/affixed navigation chrome whose state needs to react to scroll position.", "reason": "The public pages have no sticky/affixed navigation chrome whose state needs to react to scroll position." }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "not-applicable", "confidence": "high", "method": "Recon and rendered/source inspection established that the targeted interaction or content type is absent.", "evidence": "No tooltip or anchored menu interaction was present on the representative public paths.", "reason": "No tooltip or anchored menu interaction was present on the representative public paths." }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "pass", "confidence": "medium", "method": "First-viewport screenshots and primary-link walkthrough.", "evidence": "Large registration and access cards clearly identify the two primary directions, with explicit recovery and assistance links.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "issues", "confidence": "high", "method": "Desktop/mobile screenshots on load.", "evidence": "Chat and cookie layers obscure primary content and controls without user request.", "pathIds": [ "home", "registration", "suspension" ], "artifacts": [ "evidence/home-desktop.png", "evidence/home-mobile.png", "evidence/registration-mobile.png", "evidence/suspension-mobile.png" ], "findingIds": [ "F03" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "issues", "confidence": "high", "method": "DOM role and action-element probe.", "evidence": "Seven custom dialog-role divs are unlabeled and assistance is a javascript: pseudo-link.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-probe.json", "evidence/home-lighthouse-details.json" ], "findingIds": [ "F04" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "issues", "confidence": "high", "method": "Visual viewport review across templates.", "evidence": "Persistent cookie/chat chrome consumes and overlaps scarce mobile content space.", "pathIds": [ "home", "registration", "suspension" ], "artifacts": [ "evidence/home-mobile.png", "evidence/registration-mobile.png", "evidence/suspension-mobile.png" ], "findingIds": [ "F03" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "pass", "confidence": "high", "method": "360px screenshots and document width probe.", "evidence": "The home and registration probes report scrollWidth equal to innerWidth (360px), with no horizontal overflow.", "pathIds": [ "home", "registration" ], "artifacts": [ "evidence/home-mobile.png", "evidence/home-probe.json" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "issues", "confidence": "high", "method": "Narrow screenshots and CSS/source feature inspection.", "evidence": "The registration chooser remains a cramped three-column component and no container-query signal was found.", "pathIds": [ "registration", "suspension" ], "artifacts": [ "evidence/registration-mobile.png", "evidence/suspension-mobile.png", "evidence/home-feature-signals.txt" ], "findingIds": [ "F05" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "pass", "confidence": "medium", "method": "Programmatic focus probe and rendered control measurement.", "evidence": "The first focusable links show browser focus outlines and the primary CTA controls render around 50px high.", "pathIds": [ "home", "registration" ], "artifacts": [ "evidence/home-probe.json", "evidence/home-lighthouse-details.json" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "pass", "confidence": "high", "method": "First viewport and heading/action inspection.", "evidence": "The heading explains PosteID and the two primary calls to action are clearly Registration and Access.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "pass", "confidence": "medium", "method": "Public flow navigation to registration and recovery entry points without submitting identity data.", "evidence": "The registration and recovery entry pages load and present the expected next choice; authenticated/identity submission was deliberately not performed.", "pathIds": [ "home", "registration", "recovery" ], "artifacts": [ "evidence/registration-mobile.png", "evidence/recovery-mobile.png" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "issues", "confidence": "high", "method": "Linked alternative/error route walkthrough.", "evidence": "The prominently linked accessible version fails with a bare 403 and offers no retry, back link or support recovery.", "pathIds": [ "accessible" ], "artifacts": [ "evidence/accessible-mobile.png" ], "findingIds": [ "F17" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "high", "method": "Lighthouse mobile navigation plus DevTools trace.", "evidence": "Lighthouse LCP was 6.9s and FCP 5.2s, outside good thresholds.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-lighthouse-summary.json", "evidence/home-trace-summary.json" ], "findingIds": [ "F06" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "pass", "confidence": "high", "method": "Lighthouse CLS and trace/layout observation.", "evidence": "Lighthouse measured CLS 0 for the tested load.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-lighthouse-summary.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "pass", "confidence": "high", "method": "Lighthouse TBT and trace long-task summary.", "evidence": "TBT was 32ms and the trace observed no tasks over 50ms.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-lighthouse-summary.json", "evidence/home-trace-summary.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "Lighthouse network/dependency diagnostics.", "evidence": "94 requests and 962 KiB include render-blocking, cache, font and modern HTTP opportunities.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-lighthouse-details.json", "evidence/home-lighthouse-summary.json" ], "findingIds": [ "F06" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "high", "method": "Lighthouse code-efficiency diagnostics.", "evidence": "The page has estimated unused/minifiable/legacy JS and CSS savings totalling hundreds of KiB.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-lighthouse-summary.json", "evidence/home-lighthouse-details.json" ], "findingIds": [ "F07" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "issues", "confidence": "high", "method": "Lighthouse accessibility plus DOM/image inspection.", "evidence": "No main landmark, multiple missing image alternatives and unlabeled dialog roles were found.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-lighthouse-details.json", "evidence/home-probe.json", "evidence/home-images.json" ], "findingIds": [ "F08" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "issues", "confidence": "high", "method": "Lighthouse computed contrast audit.", "evidence": "Footer text is 3.73:1 against its background and links rely on color alone.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-lighthouse-details.json" ], "findingIds": [ "F01", "F10" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "issues", "confidence": "high", "method": "Heading/landmark probe and Lighthouse tab-order audit.", "evidence": "The DOM has empty headings/no main landmark and major links use positive tabindex 2–39.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-probe.json", "evidence/home-lighthouse-details.json" ], "findingIds": [ "F08", "F09" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "issues", "confidence": "high", "method": "Mobile visual review and Lighthouse contrast audit.", "evidence": "Registration choice copy is cramped and fixed overlays cover readable/actionable content.", "pathIds": [ "registration", "home" ], "artifacts": [ "evidence/registration-mobile.png", "evidence/home-mobile.png", "evidence/home-lighthouse-details.json" ], "findingIds": [ "F10" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "issues", "confidence": "high", "method": "Lighthouse viewport audit and narrow screenshots.", "evidence": "The served viewport contains user-scalable=no/user-scalable=0, preventing user zoom.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-lighthouse-details.json", "evidence/home-mobile.png" ], "findingIds": [ "F09" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "issues", "confidence": "high", "method": "Lighthouse console audit.", "evidence": "Two resources return 404: the OpenID acrlevel endpoint and favicon.ico.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-lighthouse-details.json" ], "findingIds": [ "F11" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "issues", "confidence": "high", "method": "Doctype/charset probe and images primitive.", "evidence": "Doctype/UTF-8 are present, but all 18 images lack explicit dimensions and multiple image loads are broken or under-specified.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-probe.json", "evidence/home-images.json" ], "findingIds": [ "F11" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "issues", "confidence": "medium", "method": "Lighthouse best-practices/Issues-panel diagnostics.", "evidence": "Best Practices scored 0.69 and inspector issues, third-party cookie issues and legacy JS were reported.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-lighthouse-summary.json", "evidence/home-lighthouse-details.json" ], "findingIds": [ "F11" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "issues", "confidence": "high", "method": "DOM metadata probe and Lighthouse SEO audit.", "evidence": "A descriptive title exists but meta description is absent.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-probe.json", "evidence/home-lighthouse-summary.json" ], "findingIds": [ "F12" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "issues", "confidence": "high", "method": "Link/viewport probe, robots request and Lighthouse SEO.", "evidence": "The assistance action uses javascript:void(0), and robots.txt returns an application 404 page.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-lighthouse-details.json", "evidence/robots.txt" ], "findingIds": [ "F13" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "issues", "confidence": "high", "method": "Raw HTTP requests plus head metadata inspection.", "evidence": "robots.txt and sitemap.xml return 404 and the page exposes no canonical URL.", "pathIds": [ "home" ], "artifacts": [ "evidence/robots.txt", "evidence/sitemap.xml", "evidence/home-probe.json" ], "findingIds": [ "F13" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "issues", "confidence": "medium", "method": "Head/JSON-LD/Open Graph probe.", "evidence": "This public organization/service landing page has no JSON-LD or Open Graph metadata.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-probe.json" ], "findingIds": [ "F12" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "issues", "confidence": "high", "method": "Successful main-document response header capture.", "evidence": "HTTPS/HSTS/nosniff/SAMEORIGIN are present, but CSP is absent and BACKEND lacks Secure/HttpOnly/SameSite.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-response-headers.txt" ], "findingIds": [ "F14" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "issues", "confidence": "high", "method": "Tracker capture, Lighthouse cookie audit and visible policy text.", "evidence": "Seven third-party origins and five third-party cookies conflict with the technical-cookie-only statement.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-trackers.json", "evidence/home-lighthouse-details.json", "evidence/home-desktop.png" ], "findingIds": [ "F15" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "issues", "confidence": "medium", "method": "Public auth copy and raw feature search.", "evidence": "The surface explicitly supports password recovery but exposes no passkey/WebAuthn affordance or code signal.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/home-feature-signals.txt" ], "findingIds": [ "F16" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "high", "method": "Successful response header inspection.", "evidence": "HSTS and SAMEORIGIN are present, but CSP/frame-ancestors, Referrer-Policy and Permissions-Policy are absent.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-response-headers.txt" ], "findingIds": [ "F14" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "pass", "confidence": "high", "method": "Successful raw HTML fetch compared with rendered content.", "evidence": "The 44,446-byte server HTML contains the headings, notices and primary links without requiring JavaScript.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-raw.html" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "issues", "confidence": "high", "method": "Mobile screenshots and linked-route walkthrough.", "evidence": "Fixed overlays cut off controls and the accessible route degrades to a bare 403 page.", "pathIds": [ "home", "registration", "suspension", "accessible" ], "artifacts": [ "evidence/home-mobile.png", "evidence/registration-mobile.png", "evidence/suspension-mobile.png", "evidence/accessible-mobile.png" ], "findingIds": [ "F03", "F17" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "not-applicable", "confidence": "high", "method": "Site-type and manifest/service-worker recon.", "evidence": "PosteID is a security-sensitive identity service whose core authentication and account changes are intrinsically online; an offline/installable app is not appropriate for these audited public flows.", "reason": "PosteID is a security-sensitive identity service whose core authentication and account changes are intrinsically online; an offline/installable app is not appropriate for these audited public flows." }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "issues", "confidence": "high", "method": "Direct navigation to the prominently linked accessible route.", "evidence": "The route returns bare 403 content with no branded recovery action.", "pathIds": [ "accessible" ], "artifacts": [ "evidence/accessible-mobile.png" ], "findingIds": [ "F17" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "pass", "confidence": "high", "method": "DOM language/direction probe.", "evidence": "The Italian pages declare html lang=\"it\" and use the correct default LTR reading direction.", "pathIds": [ "home", "registration", "recovery" ], "artifacts": [ "evidence/home-probe.json" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "not-applicable", "confidence": "high", "method": "Recon and rendered/source inspection established that the targeted interaction or content type is absent.", "evidence": "The audited public Italian-only templates do not render user-specific dates, currencies, durations or calendar data requiring locale formatting.", "reason": "The audited public Italian-only templates do not render user-specific dates, currencies, durations or calendar data requiring locale formatting." }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "not-applicable", "confidence": "high", "method": "Recon and rendered/source inspection established that the targeted interaction or content type is absent.", "evidence": "The audited public templates contain no scheduled events, stored timestamps or recurring time-zone-sensitive data.", "reason": "The audited public templates contain no scheduled events, stored timestamps or recurring time-zone-sensitive data." }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "issues", "confidence": "high", "method": "Visible cookie statement compared with network/tracker evidence.", "evidence": "The claim that only technical cookies are used conflicts with observed Adobe/Demdex/Everest tracking and third-party cookies.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/home-trackers.json", "evidence/home-lighthouse-details.json" ], "findingIds": [ "F15" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "issues", "confidence": "high", "method": "Raw form markup inspection.", "evidence": "Sensitive forms omit required, aria-invalid and aria-live validation semantics.", "pathIds": [ "suspension", "recovery" ], "artifacts": [ "evidence/suspension-form-signals.txt", "evidence/recovery-form-signals.txt" ], "findingIds": [ "F18" ] }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "issues", "confidence": "high", "method": "Raw suspension/recovery form markup inspection.", "evidence": "Username and related account fields expose no autocomplete tokens.", "pathIds": [ "suspension", "recovery" ], "artifacts": [ "evidence/suspension-form-signals.txt", "evidence/recovery-form-signals.txt" ], "findingIds": [ "F18" ] }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "pass", "confidence": "medium", "method": "Public account-management entry screenshot and copy review.", "evidence": "The suspension page clearly warns about the effect, links reversal, and asks for confirmation of the suspension code before submission.", "pathIds": [ "suspension" ], "artifacts": [ "evidence/suspension-mobile.png" ] }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "issues", "confidence": "high", "method": "Images primitive and Lighthouse image diagnostics.", "evidence": "All 18 images are PNG/GIF, dimensions are absent and below-fold images are eager.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-images.json", "evidence/home-lighthouse-details.json" ], "findingIds": [ "F19" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "issues", "confidence": "high", "method": "Lighthouse diagnostics and tracker capture.", "evidence": "A mostly static landing page loads 94 requests, 41 scripts and seven third-party origins.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-lighthouse-details.json", "evidence/home-trackers.json" ], "findingIds": [ "F07", "F19" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "issues", "confidence": "high", "method": "Third-party and total-transfer diagnostics.", "evidence": "Five third-party cookies, seven third-party origins and 962 KiB are disproportionate for the static public surface.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-trackers.json", "evidence/home-lighthouse-details.json" ], "findingIds": [ "F15", "F19" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "not-applicable", "confidence": "high", "method": "Site-purpose and public capability recon.", "evidence": "This identity and credential-management service exposes security-sensitive actions; no developer intent to permit agent execution was declared, so an agent tool surface is not assumed safe or applicable.", "reason": "This identity and credential-management service exposes security-sensitive actions; no developer intent to permit agent execution was declared, so an agent tool surface is not assumed safe or applicable." }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "high", "method": "Task and content-type recon.", "evidence": "The representative identity registration, recovery and suspension tasks do not have an evident summarisation or language-model use case.", "reason": "The representative identity registration, recovery and suspension tasks do not have an evident summarisation or language-model use case." }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "pass", "confidence": "medium", "method": "Heap baseline and post snapshot after ten assistance open/close attempts.", "evidence": "Post-interaction totals were lower than baseline (7.26 MB/133,107 nodes vs 9.63 MB/166,733 nodes), with no retained-growth signal.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-heap-comparison.json" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "pass", "confidence": "medium", "method": "Heap summary totals compared with page complexity.", "evidence": "The baseline self-size was 9.63 MB for the loaded landing page, proportionate to the observed UI.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-heap-comparison.json" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "pass", "confidence": "medium", "method": "Before/after heap constructor/totals comparison around repeated dialog interaction.", "evidence": "No Detached* constructor population was reported and aggregate heap/node totals did not grow.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-heap-comparison.json" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F01" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "issues", "findingIds": [ "F02" ] }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "pass" }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "issues", "findingIds": [ "F03", "F04" ] }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "issues", "findingIds": [ "F05" ] }, { "principleId": "support-core-task-success", "expectation": "default", "status": "issues", "findingIds": [ "F17" ] }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F06", "F07" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F08", "F01", "F10", "F09" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "issues", "findingIds": [ "F11" ] }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F12", "F13" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F14", "F15", "F16" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "issues", "findingIds": [ "F03", "F17" ] }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "pass" }, { "principleId": "be-trustworthy", "expectation": "default", "status": "issues", "findingIds": [ "F15", "F18" ] }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F19", "F07", "F15" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "not-applicable", "reason": "All registered checks were judged not applicable for this site and scope." }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "pass" } ], "paths": [ { "id": "home", "description": "Public landing page, primary registration/access choices, service notice and assistance entry.", "url": "https://posteid.poste.it/", "conditions": [ "desktop 1440x1000", "mobile 360x800", "prefers-color-scheme: dark", "prefers-contrast: more", "prefers-reduced-motion: reduce", "keyboard focus", "raw HTML/no JavaScript", "performance/network/security/memory" ], "result": "issues" }, { "id": "registration", "description": "Primary identity-registration method chooser and responsive component archetype.", "url": "https://posteid.poste.it/identificazione/identificazione.shtml", "conditions": [ "mobile 360x800", "raw HTML" ], "result": "issues" }, { "id": "recovery", "description": "Credential recovery entry and recovery-state archetype.", "url": "https://posteid.poste.it/recuperocredenziali.shtml", "conditions": [ "mobile 360x800", "raw HTML/form inspection" ], "result": "issues" }, { "id": "suspension", "description": "Sensitive account suspension form and input-assistance archetype.", "url": "https://posteid.poste.it/sospensione.shtml", "conditions": [ "mobile 360x800", "prefers-color-scheme: dark", "raw HTML/form inspection" ], "result": "issues" }, { "id": "accessible", "description": "Prominently linked alternative accessible-version route.", "url": "https://posteid.poste.it/accessibile/index.shtml", "conditions": [ "mobile 360x800" ], "result": "failed" } ], "findings": [ { "id": "F01", "severity": "medium", "confidence": "high", "summary": "The interface does not adapt to dark or higher-contrast preferences.", "evidence": "The dark-mode and prefers-contrast screenshots retain the same hard-coded white/grey/yellow palette; the DOM reports color-scheme: normal, and Lighthouse also found 3.73:1 footer contrast.", "artifacts": [ "evidence/home-dark.png", "evidence/home-high-contrast.png", "evidence/home-lighthouse-details.json" ], "suggestedFix": "Declare color-scheme and use prefers-color-scheme/light-dark() tokens; add tested high-contrast/forced-colors styles for text, controls and icons.", "effort": "medium", "pathId": "home", "url": "https://posteid.poste.it/", "principleId": "respect-user-preferences", "principleCheckId": "respects-color-scheme", "guidanceId": "dark-mode", "guidanceCategory": "user-experience" }, { "id": "F02", "severity": "low", "confidence": "high", "summary": "Page and state changes are abrupt and use no modern transition mechanism.", "evidence": "Raw HTML/CSS feature search found no view-transition signal, while the primary registration, sign-in and recovery actions navigate between separate documents.", "artifacts": [ "evidence/home-raw.html", "evidence/home-desktop.png" ], "suggestedFix": "Add opt-in cross-document View Transitions with a reduced-motion fallback for related public journeys.", "effort": "medium", "pathId": "home", "url": "https://posteid.poste.it/", "principleId": "implement-natural-interactions", "principleCheckId": "view-transitions", "guidanceId": "same-document-transitions", "guidanceCategory": "animation" }, { "id": "F03", "severity": "high", "confidence": "high", "summary": "Fixed cookie and chat UI obscures primary content, especially on mobile.", "evidence": "Mobile screenshots show the cookie strip and chat launcher covering registration choices and form controls; the desktop screenshot shows the chat prompt covering the sign-in card.", "artifacts": [ "evidence/home-mobile.png", "evidence/registration-mobile.png", "evidence/suspension-mobile.png", "evidence/home-desktop.png" ], "suggestedFix": "Remove the redundant technical-cookie banner or make it compact and dismissible; defer chat until requested and reserve non-overlapping space.", "effort": "medium", "pathId": "home", "url": "https://posteid.poste.it/", "principleId": "maximize-content-reduce-noise", "principleCheckId": "no-intrusive-interruptions", "guidanceId": "light-dismiss-a-dialog", "guidanceCategory": "user-experience" }, { "id": "F04", "severity": "medium", "confidence": "high", "summary": "Overlay UI is implemented as unlabeled custom dialog divs.", "evidence": "The DOM probe found seven [role=dialog]/dialog nodes, all custom DIV dialogs without aria-label; the assistance action is an href=\"javascript:void(0)\" trigger.", "artifacts": [ "evidence/home-probe.json", "evidence/home-lighthouse-details.json" ], "suggestedFix": "Use native dialog/popover primitives, label each surface, provide declarative light-dismiss, restore focus, and use a button for actions.", "effort": "medium", "pathId": "home", "url": "https://posteid.poste.it/", "principleId": "maximize-content-reduce-noise", "principleCheckId": "semantic-dismissible-primitives", "guidanceId": "declarative-dialog-popover-control", "guidanceCategory": "html" }, { "id": "F05", "severity": "high", "confidence": "high", "summary": "Several mobile templates reflow poorly even without horizontal scrolling.", "evidence": "At 360px the registration options are squeezed into three narrow columns, broken-image fallback text collides with content, and the suspension form is covered by persistent chrome.", "artifacts": [ "evidence/registration-mobile.png", "evidence/suspension-mobile.png" ], "suggestedFix": "Recompose the option cards into a one-column/sensible grid at narrow container sizes and test each component with container queries.", "effort": "medium", "pathId": "home", "url": "https://posteid.poste.it/", "principleId": "adapt-to-the-form-factor", "principleCheckId": "component-level-responsiveness", "guidanceId": "size-aware-styling", "guidanceCategory": "css" }, { "id": "F06", "severity": "high", "confidence": "high", "summary": "The public landing page has slow paint and inefficient delivery.", "evidence": "Lighthouse measured LCP 6.9s and FCP 5.2s, with 94 requests/962 KiB; it estimated 3.1s render-blocking savings, 665 KiB cache savings and flagged modern HTTP/font delivery issues.", "artifacts": [ "evidence/home-lighthouse-summary.json", "evidence/home-lighthouse-details.json", "evidence/home-trace-summary.json" ], "suggestedFix": "Shorten the critical dependency chain, set durable cache policy for versioned assets, preload only the LCP-critical asset, use font-display, and modernize HTTP delivery.", "effort": "large", "pathId": "home", "url": "https://posteid.poste.it/", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "guidanceId": "optimize-image-priority", "guidanceCategory": "performance" }, { "id": "F07", "severity": "medium", "confidence": "high", "summary": "The page ships substantial unused, legacy and unminified client code.", "evidence": "Lighthouse estimated 105 KiB unused JS, 77 KiB unused CSS, 28 KiB minifiable JS, 13 KiB minifiable CSS and 22 KiB legacy-JS savings; diagnostics counted 41 scripts and 20 stylesheets.", "artifacts": [ "evidence/home-lighthouse-summary.json", "evidence/home-lighthouse-details.json" ], "suggestedFix": "Remove unused bundles, split conditional assistance/analytics code, deduplicate styles and serve modern minified builds.", "effort": "medium", "pathId": "home", "url": "https://posteid.poste.it/", "principleId": "be-fast-and-stable", "principleCheckId": "trim-unused-and-duplicate-code", "guidanceId": "identify-heavy-scripts", "guidanceCategory": "performance" }, { "id": "F08", "severity": "high", "confidence": "high", "summary": "Core semantics and accessible names are incomplete.", "evidence": "Lighthouse accessibility scored 0.71, found no main landmark and seven images without alt attributes; the page probe also shows empty headings and unlabeled dialogs.", "artifacts": [ "evidence/home-lighthouse-summary.json", "evidence/home-lighthouse-details.json", "evidence/home-probe.json" ], "suggestedFix": "Add a single main landmark, remove empty headings, label every dialog/control, and give meaningful images alt text or decorative images alt=\"\".", "effort": "medium", "pathId": "home", "url": "https://posteid.poste.it/", "principleId": "be-inclusive", "principleCheckId": "names-roles-labels", "guidanceId": "accessibility", "guidanceCategory": "accessibility" }, { "id": "F09", "severity": "high", "confidence": "high", "summary": "Keyboard order and zoom are overridden.", "evidence": "Lighthouse found positive tabindex values from 2 through 39 on major links and a viewport declaration containing user-scalable=no/user-scalable=0.", "artifacts": [ "evidence/home-lighthouse-details.json" ], "suggestedFix": "Remove positive tabindex values and rely on DOM order; remove user-scalable restrictions so browser zoom remains available.", "effort": "medium", "pathId": "home", "url": "https://posteid.poste.it/", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "guidanceId": "accessibility", "guidanceCategory": "accessibility" }, { "id": "F10", "severity": "medium", "confidence": "high", "summary": "Some text and controls are hard to perceive or read.", "evidence": "Lighthouse found 3.73:1 footer contrast and links distinguished by color alone; mobile registration text is cramped into narrow columns while overlays cover adjacent content.", "artifacts": [ "evidence/home-lighthouse-details.json", "evidence/registration-mobile.png", "evidence/home-mobile.png" ], "suggestedFix": "Use AA-compliant tokens, non-color link cues, and comfortable line lengths/spacing; stack dense card content on narrow screens.", "effort": "medium", "pathId": "home", "url": "https://posteid.poste.it/", "principleId": "be-inclusive", "principleCheckId": "legible-text", "guidanceId": "improve-text-layout-and-legibility", "guidanceCategory": "accessibility" }, { "id": "F11", "severity": "medium", "confidence": "high", "summary": "The page loads with network console errors and fragile image markup.", "evidence": "Lighthouse recorded 404s for /federation/openid/acrlevel and /favicon.ico; the images primitive found all 18 images lack explicit dimensions, 13 lack alt, seven below-fold images are not lazy, and all are legacy formats.", "artifacts": [ "evidence/home-lighthouse-details.json", "evidence/home-images.json" ], "suggestedFix": "Fix the failed endpoints, provide a favicon, add image dimensions, lazy-load below-fold images and modernize suitable assets.", "effort": "medium", "pathId": "home", "url": "https://posteid.poste.it/", "principleId": "follow-best-practices", "principleCheckId": "no-console-errors", "guidanceId": "html", "guidanceCategory": "html" }, { "id": "F12", "severity": "medium", "confidence": "high", "summary": "Public pages lack basic descriptive and share metadata.", "evidence": "The page has a title but no meta description, canonical, Open Graph tags, hreflang or JSON-LD; Lighthouse SEO scored 0.73.", "artifacts": [ "evidence/home-probe.json", "evidence/home-lighthouse-summary.json" ], "suggestedFix": "Add a unique description and canonical URL, then provide accurate Open Graph and Organization/WebSite structured metadata for the public landing page.", "effort": "medium", "pathId": "home", "url": "https://posteid.poste.it/", "principleId": "be-discoverable", "principleCheckId": "title-and-description", "guidanceId": "html", "guidanceCategory": "html" }, { "id": "F13", "severity": "medium", "confidence": "high", "summary": "Indexing signals are incomplete and one action is not crawlable.", "evidence": "robots.txt and sitemap.xml both returned HTTP 404 application error pages; no canonical is present, and the assistance link uses javascript:void(0).", "artifacts": [ "evidence/robots.txt", "evidence/sitemap.xml", "evidence/home-lighthouse-details.json" ], "suggestedFix": "Publish valid robots.txt and sitemap.xml, add canonical links, and replace pseudo-links with buttons or real href destinations.", "effort": "medium", "pathId": "home", "url": "https://posteid.poste.it/", "principleId": "be-discoverable", "principleCheckId": "canonical-and-indexing-signals", "guidanceId": "html", "guidanceCategory": "html" }, { "id": "F14", "severity": "high", "confidence": "high", "summary": "Browser-enforced security policy is incomplete and one routing cookie is weak.", "evidence": "The successful 200 response has HSTS, nosniff and SAMEORIGIN but no CSP, Referrer-Policy or Permissions-Policy; BACKEND is set without Secure, HttpOnly or SameSite.", "artifacts": [ "evidence/home-response-headers.txt" ], "suggestedFix": "Deploy a nonce/hash-based CSP with frame-ancestors, a strict Referrer-Policy and minimal Permissions-Policy; harden or remove the BACKEND cookie.", "effort": "medium", "pathId": "home", "url": "https://posteid.poste.it/", "principleId": "be-private-and-secure", "principleCheckId": "secure-transport-and-headers", "guidanceId": "security", "guidanceCategory": "security" }, { "id": "F15", "severity": "high", "confidence": "high", "summary": "The stated technical-cookie-only posture conflicts with active third-party tracking.", "evidence": "The visible banner says only technical cookies are used, yet Lighthouse found five third-party cookies and the tracker capture contacted seven third-party origins including Adobe/Demdex/Everest endpoints.", "artifacts": [ "evidence/home-desktop.png", "evidence/home-trackers.json", "evidence/home-lighthouse-details.json" ], "suggestedFix": "Align the claim and behavior: remove nonessential tracking by default or obtain valid, granular consent before loading it; minimize and batch analytics.", "effort": "medium", "pathId": "home", "url": "https://posteid.poste.it/", "principleId": "be-private-and-secure", "principleCheckId": "data-minimisation-and-third-parties", "guidanceId": "privacy", "guidanceCategory": "privacy" }, { "id": "F16", "severity": "medium", "confidence": "medium", "summary": "The public authentication proposition appears password-only.", "evidence": "The landing page offers username/password recovery and the captured HTML contains no WebAuthn/passkey feature signal on the public auth entry surface.", "artifacts": [ "evidence/home-desktop.png", "evidence/home-feature-signals.txt" ], "suggestedFix": "Offer passkeys/WebAuthn alongside account recovery, with clear registration, authentication, reauthentication and management flows.", "effort": "large", "pathId": "home", "url": "https://posteid.poste.it/", "principleId": "be-private-and-secure", "principleCheckId": "in-context-permissions-and-modern-auth", "guidanceId": "passkeys", "guidanceCategory": "identity" }, { "id": "F17", "severity": "high", "confidence": "high", "summary": "A prominently linked accessibility route returns a bare 403 page.", "evidence": "Opening “Versione accessibile” produced a browser-rendered 403 Forbidden page with no site navigation or recovery path.", "artifacts": [ "evidence/accessible-mobile.png" ], "suggestedFix": "Serve the route reliably or remove the dead alternative; make the primary experience accessible and provide a useful branded 4xx recovery state.", "effort": "medium", "pathId": "accessible", "url": "https://posteid.poste.it/accessibile/index.shtml", "principleId": "be-resilient", "principleCheckId": "network-and-http-failure-states", "guidanceId": "persistent-toast-notifications", "guidanceCategory": "user-experience" }, { "id": "F18", "severity": "high", "confidence": "high", "summary": "Sensitive account forms omit input assistance and accessible validation hooks.", "evidence": "Raw suspension and recovery markup contains unlabeled-by-attribute inputs without autocomplete, required, aria-invalid or aria-live signals; the suspension form handles username and secret suspension codes.", "artifacts": [ "evidence/suspension-form-signals.txt", "evidence/recovery-form-signals.txt", "evidence/suspension-mobile.png" ], "suggestedFix": "Add correct autocomplete tokens, explicit labels/required semantics, and validate after interaction with synchronized :user-invalid, aria-invalid and announced error summaries.", "effort": "medium", "pathId": "suspension", "url": "https://posteid.poste.it/sospensione.shtml", "principleId": "be-trustworthy", "principleCheckId": "humane-error-handling", "guidanceId": "forms", "guidanceCategory": "forms" }, { "id": "F19", "severity": "medium", "confidence": "high", "summary": "Asset and third-party budgets are disproportionate for a mostly static landing page.", "evidence": "The page transfers 962 KiB across 94 requests; all 18 images use PNG/GIF, seven below-fold images are eager, and seven third-party origins are contacted.", "artifacts": [ "evidence/home-images.json", "evidence/home-trackers.json", "evidence/home-lighthouse-details.json" ], "suggestedFix": "Set a page-weight/third-party budget, defer chat and analytics, lazy-load below-fold imagery, and use appropriately sized modern image formats.", "effort": "medium", "pathId": "home", "url": "https://posteid.poste.it/", "principleId": "be-sustainable", "principleCheckId": "optimised-assets", "guidanceId": "deliver-optimized-decorative-images", "guidanceCategory": "performance" } ], "taskList": [ { "id": "T01", "title": "Remove or defer obstructive cookie/chat chrome", "priority": 1, "findingIds": [ "F03", "F05" ], "guidanceId": "light-dismiss-a-dialog", "status": "open" }, { "id": "T02", "title": "Correct the cookie claim and block nonessential trackers until consent", "priority": 2, "findingIds": [ "F15" ], "guidanceId": "privacy", "status": "open" }, { "id": "T03", "title": "Restore semantic structure, keyboard order and zoom", "priority": 3, "findingIds": [ "F08", "F09", "F10" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T04", "title": "Fix the accessible/error route and provide recoverable 4xx states", "priority": 4, "findingIds": [ "F17" ], "guidanceId": "persistent-toast-notifications", "status": "open" }, { "id": "T05", "title": "Improve LCP and critical resource delivery", "priority": 5, "findingIds": [ "F06", "F07" ], "guidanceId": "optimize-image-priority", "status": "open" }, { "id": "T06", "title": "Harden CSP, policy headers and the routing cookie", "priority": 6, "findingIds": [ "F14" ], "guidanceId": "security", "status": "open" }, { "id": "T07", "title": "Make account forms assistive and humanely validated", "priority": 7, "findingIds": [ "F18" ], "guidanceId": "forms", "status": "open" }, { "id": "T08", "title": "Reflow registration/account components for narrow containers", "priority": 8, "findingIds": [ "F05" ], "guidanceId": "size-aware-styling", "status": "open" }, { "id": "T09", "title": "Add metadata, canonical, robots and sitemap signals", "priority": 9, "findingIds": [ "F12", "F13" ], "guidanceId": "html", "status": "open" }, { "id": "T10", "title": "Optimize images and enforce asset/third-party budgets", "priority": 10, "findingIds": [ "F11", "F19" ], "guidanceId": "deliver-optimized-decorative-images", "status": "open" }, { "id": "T11", "title": "Add preference-aware color themes and contrast", "priority": 11, "findingIds": [ "F01" ], "guidanceId": "dark-mode", "status": "open" }, { "id": "T12", "title": "Offer passkeys alongside password recovery", "priority": 12, "findingIds": [ "F16" ], "guidanceId": "passkeys", "status": "open" }, { "id": "T13", "title": "Adopt semantic overlays and optional page transitions", "priority": 13, "findingIds": [ "F02", "F04" ], "guidanceId": "declarative-dialog-popover-control", "status": "open" } ], "budget": { "pathCount": 5, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-26T15-50-37-958Z" }