{ "url": "https://www.netflix.com", "auditedAt": "2026-07-22T01:56:07.420Z", "mode": "report", "status": "completed", "statusDetail": "Coverage-complete audit of four representative unauthenticated paths. Authenticated browsing, playback, account settings, payment completion, help/media/jobs/shop subdomains, and logged-in cancellation were not covered because they require credentials, a commercial commitment, or use distinct properties.", "page": { "appType": "hybrid", "framework": "Netflix server-rendered acquisition UI with client enhancement", "notes": "The requested URL redirects to /gb/. Raw HTML is content-rich (90% coverage), while client JavaScript enhances forms, consent, and disclosures." }, "evidenceUsed": [ "screenshot", "dom", "layout-metrics", "evaluate-probe", "trace", "har", "discoverability", "headers", "cookies", "trackers", "images", "secrets", "heap-summary", "Lighthouse" ], "guidanceConsulted": [ "dark-mode", "accessibility", "same-document-transitions", "scrollability-affordance-hints", "declarative-dialog-popover-control", "fluid-scaling", "forms", "optimize-image-priority", "identify-inp-causes", "break-up-long-tasks", "html", "security", "privacy", "conditional-async-dependencies", "translator", "validate-input-after-interaction", "deliver-optimized-decorative-images", "webmcp", "manage-recurring-intervals", "light-dismiss-a-dialog", "accessible-error-announcement", "passkeys", "deprioritize-background-fetches" ], "artifacts": [ { "type": "screenshot", "path": "evidence/home-desktop.png", "caption": "Landing page at desktop width; the consent banner overlays the hero.", "condition": "1440x1000", "findingIds": [ "F01", "F02" ] }, { "type": "screenshot", "path": "evidence/home-mobile.png", "caption": "Landing page at mobile width; consent occupies much of the first viewport.", "condition": "360x800", "findingIds": [ "F01", "F05" ] }, { "type": "screenshot", "path": "evidence/home-dark.png", "caption": "Dark preference produces the same fixed dark palette as the default.", "condition": "prefers-color-scheme: dark", "findingIds": [ "F03" ] }, { "type": "screenshot", "path": "evidence/home-forced-colors.png", "caption": "Controls and text remain visible in forced colors.", "condition": "forced-colors: active", "findingIds": [ "F05" ] }, { "type": "screenshot", "path": "evidence/login-desktop.png", "caption": "Authentication surface and consent interruption.", "condition": "1440x1000", "findingIds": [ "F01", "F17" ] }, { "type": "screenshot", "path": "evidence/signup-mobile.png", "caption": "Public signup plan step at narrow width.", "condition": "360x800", "findingIds": [ "F10" ] }, { "type": "screenshot", "path": "evidence/not-found-mobile.png", "caption": "Branded 404 provides a clear route back home.", "condition": "360x800", "findingIds": [] }, { "type": "layout", "path": "evidence/home-mobile-layout.json", "caption": "No horizontal overflow; CLS 0.0015 and two long tasks.", "condition": "360x800", "findingIds": [ "F07" ] }, { "type": "layout", "path": "evidence/login-layout.json", "caption": "Login has no horizontal overflow or layout shift.", "condition": "360x800", "findingIds": [] }, { "type": "layout", "path": "evidence/signup-layout.json", "caption": "Signup has no horizontal overflow or layout shift.", "condition": "360x800", "findingIds": [] }, { "type": "dom", "path": "evidence/home-dom.json", "caption": "Rendered DOM and computed style capture.", "condition": "default", "findingIds": [ "F02", "F22" ] }, { "type": "other", "path": "evidence/recon-evaluate.json", "caption": "Routes, headings, forms, metadata, and platform feature probe.", "condition": "default", "findingIds": [ "F09", "F13", "F14" ] }, { "type": "other", "path": "evidence/preferences-interaction.json", "caption": "Reduced-motion, focus, target-size, and CSS feature probe.", "condition": "mobile, reduced motion", "findingIds": [ "F03", "F04", "F05" ] }, { "type": "other", "path": "evidence/platform-probe.json", "caption": "Script attributes, stylesheet placement, service worker state, and CSS directionality signal.", "condition": "default", "findingIds": [ "F08", "F18" ] }, { "type": "other", "path": "evidence/home-validation.json", "caption": "Empty landing-page submission moved focus without an explicit alert.", "condition": "empty submit", "findingIds": [ "F06" ] }, { "type": "other", "path": "evidence/login-validation.json", "caption": "Empty login submission moved focus without explicit visible or live-region error text.", "condition": "empty submit", "findingIds": [ "F06" ] }, { "type": "other", "path": "evidence/login-probe.json", "caption": "Login form metadata and autocomplete probe.", "condition": "default", "findingIds": [ "F13", "F17" ] }, { "type": "other", "path": "evidence/signup-probe.json", "caption": "Signup metadata and heading probe.", "condition": "default", "findingIds": [ "F13" ] }, { "type": "trace", "path": "evidence/home-trace.json", "caption": "DevTools performance trace for landing-page load.", "condition": "default", "findingIds": [ "F07" ] }, { "type": "trace-summary", "path": "evidence/home-trace-summary.json", "caption": "FCP/LCP and main-thread summary.", "condition": "default", "findingIds": [ "F07" ] }, { "type": "har", "path": "evidence/home.har", "caption": "Landing-page network capture.", "condition": "7 second load", "findingIds": [ "F08", "F16", "F20" ] }, { "type": "har-summary", "path": "evidence/home-summary.json", "caption": "Network weight, dependency, third-party, and hygiene summary.", "condition": "7 second load", "findingIds": [ "F08", "F16", "F19", "F20" ] }, { "type": "lighthouse", "path": "evidence/lighthouse-home.json", "caption": "Lighthouse performance, accessibility, best-practices, SEO, and agentic-browsing report.", "condition": "mobile lab", "findingIds": [ "F07", "F08", "F09", "F10", "F11", "F12" ] }, { "type": "discoverability", "path": "evidence/discoverability", "caption": "Raw HTML versus rendered-content discoverability result.", "condition": "non-JS crawler", "findingIds": [ "F14" ] }, { "type": "screenshot", "path": "evidence/discoverability-rendered.png", "caption": "Rendered browser view.", "condition": "JavaScript enabled", "findingIds": [] }, { "type": "screenshot", "path": "evidence/discoverability-crawler.png", "caption": "Crawler view remains content-rich.", "condition": "JavaScript disabled", "findingIds": [] }, { "type": "other", "path": "evidence/headers.json", "caption": "Security response-header inspection.", "condition": "default", "findingIds": [ "F15" ] }, { "type": "other", "path": "evidence/cookies.json", "caption": "Cookie security and SameSite inspection.", "condition": "default", "findingIds": [ "F15", "F16" ] }, { "type": "other", "path": "evidence/trackers.json", "caption": "Third-party origin inventory.", "condition": "7 second load", "findingIds": [ "F16", "F20" ] }, { "type": "other", "path": "evidence/secrets.json", "caption": "Client-side secret scan found no exposed sensitive secrets.", "condition": "default", "findingIds": [] }, { "type": "other", "path": "evidence/images.json", "caption": "Image dimensions, sizing, formats, and alt inspection.", "condition": "default", "findingIds": [ "F19", "F22" ] }, { "type": "heap", "path": "evidence/heap-baseline.heapsnapshot", "caption": "Baseline readable heap summary.", "condition": "after load", "findingIds": [ "F21" ] }, { "type": "heap", "path": "evidence/heap-post-success.heapsnapshot", "caption": "Heap summary after ten FAQ open/close cycles.", "condition": "10 repeated FAQ cycles", "findingIds": [ "F21" ] }, { "type": "other", "path": "evidence/memory-metrics.json", "caption": "DOM count stayed at 1,088 across ten FAQ cycles; JS heap sample rose about 1.9 MB before GC.", "condition": "10 repeated FAQ cycles", "findingIds": [ "F21" ] } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 58, "blocked": 0, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": true }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "issues", "confidence": "high", "method": "Direct browser evidence and targeted probe as listed", "evidence": "Default and dark-preference screenshots are byte-identical; computed color-scheme is normal rather than light dark.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dark.png", "evidence/preferences-interaction.json" ], "findingIds": [ "F03" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "pass", "confidence": "medium", "method": "Direct visual, DOM, layout, or objective tool evidence", "evidence": "Reduced-motion emulation matched and document.getAnimations() returned zero; CSS contains a reduced-motion rule.", "pathIds": [ "home" ], "artifacts": [ "evidence/preferences-interaction.json" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "pass", "confidence": "medium", "method": "Direct visual, DOM, layout, or objective tool evidence", "evidence": "Forced-colors screenshot preserves readable text, outlines, fields, and all primary controls.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-forced-colors.png" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "issues", "confidence": "high", "method": "Direct browser evidence and targeted probe as listed", "evidence": "CSS inspection found no view-transition rules; the signup and login journey uses ordinary page swaps.", "pathIds": [ "home" ], "artifacts": [ "evidence/preferences-interaction.json", "evidence/signup-mobile.png" ], "findingIds": [ "F04" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-path recon", "evidence": "No scroll-linked animation, parallax, scrollytelling, or entry reveal exists on the representative public pages.", "reason": "No scroll-linked animation, parallax, scrollytelling, or entry reveal exists on the representative public pages." }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "pass", "confidence": "medium", "method": "Direct visual, DOM, layout, or objective tool evidence", "evidence": "Representative controls use ordinary click, focus, native scrolling, and disclosure interactions; no custom pointer-driven gesture was observed.", "pathIds": [ "home" ], "artifacts": [ "evidence/preferences-interaction.json" ] }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-path recon", "evidence": "The tested public pages have no sticky or affixed chrome whose state needs to react to scroll position.", "reason": "The tested public pages have no sticky or affixed chrome whose state needs to react to scroll position." }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-path recon", "evidence": "No tooltip, transient menu, or edge-sensitive popover appears in the representative unauthenticated surfaces.", "reason": "No tooltip, transient menu, or edge-sensitive popover appears in the representative unauthenticated surfaces." }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "pass", "confidence": "medium", "method": "Direct visual, DOM, layout, or objective tool evidence", "evidence": "The hero, focused Sign In control, Get Started action, and numbered/section hierarchy visibly direct attention on desktop and mobile.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/home-mobile.png", "evidence/preferences-interaction.json" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "issues", "confidence": "high", "method": "Direct browser evidence and targeted probe as listed", "evidence": "Desktop and mobile screenshots show the on-load banner covering the hero or form; on 360x800 it consumes roughly the upper quarter of the viewport.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/home-mobile.png", "evidence/login-desktop.png" ], "findingIds": [ "F01" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "issues", "confidence": "high", "method": "Direct browser evidence and targeted probe as listed", "evidence": "The DOM probe found zero dialog, popover, or details elements while screenshots show an overlay and the page contains accordion disclosures.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json", "evidence/home-desktop.png" ], "findingIds": [ "F02" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "pass", "confidence": "medium", "method": "Direct visual, DOM, layout, or objective tool evidence", "evidence": "Outside the consent notice, the page gives the viewport to content and uses restrained chrome with a clear hero and content sections.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "pass", "confidence": "medium", "method": "Direct visual, DOM, layout, or objective tool evidence", "evidence": "Layout captures on home, login, and signup all report 0px horizontal overflow at 360px.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile-layout.json", "evidence/login-layout.json", "evidence/signup-layout.json" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "pass", "confidence": "medium", "method": "Direct visual, DOM, layout, or objective tool evidence", "evidence": "Live CSS inspection found three container rules, and mobile/desktop screenshots show components reflowing rather than simply shrinking.", "pathIds": [ "home" ], "artifacts": [ "evidence/recon-evaluate.json", "evidence/home-desktop.png", "evidence/home-mobile.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "issues", "confidence": "high", "method": "Direct browser evidence and targeted probe as listed", "evidence": "The 360px probe measured Sign In at 77x32, Learn more at 117x40, and footer links around 21px high, although keyboard focus was visible.", "pathIds": [ "home" ], "artifacts": [ "evidence/preferences-interaction.json", "evidence/home-mobile.png" ], "findingIds": [ "F05" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "pass", "confidence": "medium", "method": "Direct visual, DOM, layout, or objective tool evidence", "evidence": "The home H1, price statement, email field, and Get Started button make the offer and next action explicit; login and signup each have a single clear task.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/login-desktop.png", "evidence/signup-mobile.png" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "pass", "confidence": "medium", "method": "Direct visual, DOM, layout, or objective tool evidence", "evidence": "The public pre-commit journey reaches signup plan choice and login without dead ends; the audit intentionally did not create or purchase a real account.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/signup-mobile.png", "evidence/login-desktop.png" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "issues", "confidence": "high", "method": "Direct browser evidence and targeted probe as listed", "evidence": "On landing and login forms, empty submission moved focus to the first field but yielded no role=alert/aria-live message or explicit error text in the probe.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-validation.json", "evidence/login-validation.json" ], "findingIds": [ "F06" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "high", "method": "Direct browser evidence and targeted probe as listed", "evidence": "Lighthouse measured LCP 4.1s, TBT 266ms, max potential FID 452ms, and TTI 16.9s; the trace recorded two long tasks and 114.6ms TBT.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-trace-summary.json", "evidence/home-mobile-layout.json" ], "findingIds": [ "F07" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "pass", "confidence": "medium", "method": "Direct visual, DOM, layout, or objective tool evidence", "evidence": "Observed CLS was 0.0015 on home and 0 on login/signup, with no visible late jump in screenshots.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile-layout.json", "evidence/login-layout.json", "evidence/signup-layout.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "issues", "confidence": "high", "method": "Direct browser evidence and targeted probe as listed", "evidence": "Lighthouse measured LCP 4.1s, TBT 266ms, max potential FID 452ms, and TTI 16.9s; the trace recorded two long tasks and 114.6ms TBT.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-trace-summary.json", "evidence/home-mobile-layout.json" ], "findingIds": [ "F07" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "Direct browser evidence and targeted probe as listed", "evidence": "HAR recorded 2.62MB transferred, including 1.29MB scripts and 680KB fonts. The largest script is 762KB; Lighthouse estimates 729KiB unused JS, and the LCP image lacks fetchpriority=high.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/lighthouse-home.json", "evidence/platform-probe.json" ], "findingIds": [ "F08" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "high", "method": "Direct browser evidence and targeted probe as listed", "evidence": "HAR recorded 2.62MB transferred, including 1.29MB scripts and 680KB fonts. The largest script is 762KB; Lighthouse estimates 729KiB unused JS, and the LCP image lacks fetchpriority=high.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/lighthouse-home.json", "evidence/platform-probe.json" ], "findingIds": [ "F08" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "pass", "confidence": "medium", "method": "Direct visual, DOM, layout, or objective tool evidence", "evidence": "Lighthouse passed button-name, label, link-name, and contrast audits; the forms expose labels and decorative hero imagery is aria-hidden.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/login-probe.json" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "pass", "confidence": "medium", "method": "Direct visual, DOM, layout, or objective tool evidence", "evidence": "Lighthouse color-contrast audit passed, and forced-colors capture keeps content and controls distinct.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-forced-colors.png" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "issues", "confidence": "high", "method": "Direct browser evidence and targeted probe as listed", "evidence": "Lighthouse identifies the “Ready to watch?” H3 immediately following the H1 as an invalid heading-order element.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/recon-evaluate.json" ], "findingIds": [ "F09" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "pass", "confidence": "medium", "method": "Direct visual, DOM, layout, or objective tool evidence", "evidence": "Screenshots show readable type sizes, spacing, line lengths, and no clipping across desktop and 360px layouts.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/home-mobile.png", "evidence/signup-mobile.png" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "issues", "confidence": "high", "method": "Direct browser evidence and targeted probe as listed", "evidence": "Lighthouse found maximum-scale=1.0 in the viewport meta tag on home, login, and signup probes.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/login-probe.json", "evidence/signup-probe.json" ], "findingIds": [ "F10" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "issues", "confidence": "high", "method": "Direct browser evidence and targeted probe as listed", "evidence": "Lighthouse captured “Refused to get unsafe header X-OneTrust-IsBot” from otSDKStub.js.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json" ], "findingIds": [ "F11" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "issues", "confidence": "high", "method": "Direct browser evidence and targeted probe as listed", "evidence": "The image probe found no width/height attributes on four images and two images over twice their display width; doctype and charset are valid and observed CLS is low.", "pathIds": [ "home" ], "artifacts": [ "evidence/images.json", "evidence/home-dom.json" ], "findingIds": [ "F22" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "issues", "confidence": "high", "method": "Direct browser evidence and targeted probe as listed", "evidence": "Lighthouse reports cookie inspector issues and three BFCache failure reasons, led by Cache-Control: no-store on the main resource.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json" ], "findingIds": [ "F12" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "issues", "confidence": "high", "method": "Direct browser evidence and targeted probe as listed", "evidence": "DOM probes show descriptive home metadata, but both /gb/login and /signup have document.title “Netflix”, which does not distinguish their purpose.", "pathIds": [ "home" ], "artifacts": [ "evidence/login-probe.json", "evidence/signup-probe.json" ], "findingIds": [ "F13" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "pass", "confidence": "medium", "method": "Direct visual, DOM, layout, or objective tool evidence", "evidence": "Visible navigation uses real href links and descriptive text; viewport metadata exists, and robots.txt explicitly allows major search and AI crawlers even though generic agents are denied.", "pathIds": [ "home" ], "artifacts": [ "evidence/recon-evaluate.json" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "issues", "confidence": "high", "method": "Direct browser evidence and targeted probe as listed", "evidence": "The home probe found no canonical, no hreflang, no JSON-LD, and only an Open Graph description; /sitemap.xml redirects to NotFound. Raw HTML coverage itself is strong at 90%.", "pathIds": [ "home" ], "artifacts": [ "evidence/recon-evaluate.json", "evidence/discoverability" ], "findingIds": [ "F14" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "issues", "confidence": "high", "method": "Direct browser evidence and targeted probe as listed", "evidence": "The home probe found no canonical, no hreflang, no JSON-LD, and only an Open Graph description; /sitemap.xml redirects to NotFound. Raw HTML coverage itself is strong at 90%.", "pathIds": [ "home" ], "artifacts": [ "evidence/recon-evaluate.json", "evidence/discoverability" ], "findingIds": [ "F14" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "issues", "confidence": "high", "method": "Direct browser evidence and targeted probe as listed", "evidence": "Header inspection found no enforced CSP, Referrer-Policy, or Permissions-Policy. Seven of nine observed cookies lacked Secure, while HSTS, nosniff, and X-Frame-Options were present.", "pathIds": [ "home" ], "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ], "findingIds": [ "F15" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "issues", "confidence": "high", "method": "Direct browser evidence and targeted probe as listed", "evidence": "HAR attributed 52 of 54 requests and 2.53MB to origins other than www.netflix.com, including logging, OneTrust, Google reCAPTCHA, and geolocation; requests occur while the consent banner is still open.", "pathIds": [ "home" ], "artifacts": [ "evidence/home.har", "evidence/home-summary.json", "evidence/trackers.json", "evidence/cookies.json" ], "findingIds": [ "F16" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "issues", "confidence": "high", "method": "Direct browser evidence and targeted probe as listed", "evidence": "Login probe found an email field with autocomplete=email, a password field with no autocomplete value, and no navigator.credentials/passkey signal in loaded scripts; no permission prompt fired on load.", "pathIds": [ "home" ], "artifacts": [ "evidence/login-probe.json", "evidence/login-desktop.png" ], "findingIds": [ "F17" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "high", "method": "Direct browser evidence and targeted probe as listed", "evidence": "Header inspection found no enforced CSP, Referrer-Policy, or Permissions-Policy. Seven of nine observed cookies lacked Secure, while HSTS, nosniff, and X-Frame-Options were present.", "pathIds": [ "home" ], "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ], "findingIds": [ "F15" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "pass", "confidence": "medium", "method": "Direct visual, DOM, layout, or objective tool evidence", "evidence": "Discoverability fetch found 90% rendered-word coverage in raw HTML, with title, H1, and description present and no empty JS shell.", "pathIds": [ "home" ], "artifacts": [ "evidence/discoverability", "evidence/discoverability-crawler.png" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "pass", "confidence": "medium", "method": "Direct visual, DOM, layout, or objective tool evidence", "evidence": "Menus/overlays remained inside narrow and wide viewports, layouts had no overflow, and no broken async state was observed.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile.png", "evidence/login-desktop.png", "evidence/home-mobile-layout.json" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-path recon", "evidence": "The public acquisition and authentication experience is intrinsically online and is not presented as an installable application.", "reason": "The public acquisition and authentication experience is intrinsically online and is not presented as an installable application." }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "pass", "confidence": "medium", "method": "Direct visual, DOM, layout, or objective tool evidence", "evidence": "An unknown route renders a clear branded “Lost your way?” state with a Netflix Home recovery action.", "pathIds": [ "home" ], "artifacts": [ "evidence/not-found-mobile.png" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "issues", "confidence": "high", "method": "Direct browser evidence and targeted probe as listed", "evidence": "The page has html lang=en and uses some logical properties, but CSS inspection counted 389 physical left/right declarations and no explicit dir value.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json", "evidence/recon-evaluate.json" ], "findingIds": [ "F18" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "pass", "confidence": "medium", "method": "Direct visual, DOM, layout, or objective tool evidence", "evidence": "The /gb locale renders UK currency (£5.99), UK phone formatting, English content, and locale-specific subscription copy consistently.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/signup-mobile.png" ] }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-path recon", "evidence": "No event time, date, recurring interval, or time-zone-sensitive value appears in the representative public paths.", "reason": "No event time, date, recurring interval, or time-zone-sensitive value appears in the representative public paths." }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "pass", "confidence": "medium", "method": "Direct visual, DOM, layout, or objective tool evidence", "evidence": "Pricing and cancellation are stated beside the offer, and consent presents Accept and Reject with equal visual weight plus a close action.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/signup-mobile.png" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "issues", "confidence": "high", "method": "Direct browser evidence and targeted probe as listed", "evidence": "On landing and login forms, empty submission moved focus to the first field but yielded no role=alert/aria-live message or explicit error text in the probe.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-validation.json", "evidence/login-validation.json" ], "findingIds": [ "F06" ] }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "issues", "confidence": "high", "method": "Direct browser evidence and targeted probe as listed", "evidence": "Login probe found an email field with autocomplete=email, a password field with no autocomplete value, and no navigator.credentials/passkey signal in loaded scripts; no permission prompt fired on load.", "pathIds": [ "home" ], "artifacts": [ "evidence/login-probe.json", "evidence/login-desktop.png" ], "findingIds": [ "F17" ] }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "pass", "confidence": "medium", "method": "Direct visual, DOM, layout, or objective tool evidence", "evidence": "The tested public flow states price and “Cancel at any time,” provides separate sign-in, and presents the plan benefits before commitment.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/signup-mobile.png" ] }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "issues", "confidence": "high", "method": "Direct browser evidence and targeted probe as listed", "evidence": "Image probe found all four img elements without width/height attributes, two oversized images, and two legacy-format assets; measured CLS remained low.", "pathIds": [ "home" ], "artifacts": [ "evidence/images.json", "evidence/home-summary.json" ], "findingIds": [ "F19" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "issues", "confidence": "high", "method": "Direct browser evidence and targeted probe as listed", "evidence": "HAR measured 2.62MB total, 1.29MB JavaScript and 680KB fonts; 2.53MB came from non-www origins, including consent and reCAPTCHA code before interaction.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/trackers.json" ], "findingIds": [ "F20" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "issues", "confidence": "high", "method": "Direct browser evidence and targeted probe as listed", "evidence": "HAR measured 2.62MB total, 1.29MB JavaScript and 680KB fonts; 2.53MB came from non-www origins, including consent and reCAPTCHA code before interaction.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/trackers.json" ], "findingIds": [ "F20" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-path recon", "evidence": "No declared intent exposes account or subscription actions to autonomous agents; emerging WebMCP capabilities are therefore out of scope for this audit.", "reason": "No declared intent exposes account or subscription actions to autonomous agents; emerging WebMCP capabilities are therefore out of scope for this audit." }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-path recon", "evidence": "The acquisition, login, and signup surfaces have no summarisation or language-model task that would benefit from on-device inference.", "reason": "The acquisition, login, and signup surfaces have no summarisation or language-model task that would benefit from on-device inference." }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "pass", "confidence": "medium", "method": "Direct visual, DOM, layout, or objective tool evidence", "evidence": "After ten FAQ open/close cycles heap self size rose only about 0.4% and DOM element count stayed exactly 1,088, which does not indicate unbounded retained growth.", "pathIds": [ "home" ], "artifacts": [ "evidence/heap-baseline.heapsnapshot", "evidence/heap-post-success.heapsnapshot", "evidence/memory-metrics.json" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "issues", "confidence": "high", "method": "Direct browser evidence and targeted probe as listed", "evidence": "Baseline heap summary contained 686,116 nodes and 40.15MB self size. After ten FAQ cycles it rose only 0.4% to 40.31MB and DOM element count stayed exactly 1,088, so the concern is footprint rather than leakage.", "pathIds": [ "home" ], "artifacts": [ "evidence/heap-baseline.heapsnapshot", "evidence/heap-post-success.heapsnapshot", "evidence/memory-metrics.json" ], "findingIds": [ "F21" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "pass", "confidence": "medium", "method": "Direct visual, DOM, layout, or objective tool evidence", "evidence": "The readable heap summaries show no Detached* constructor among the dominant populations, while DOM count remained stable across repeated disclosure interactions.", "pathIds": [ "home" ], "artifacts": [ "evidence/heap-baseline.heapsnapshot", "evidence/heap-post-success.heapsnapshot", "evidence/memory-metrics.json" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F03" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "issues", "findingIds": [ "F04" ] }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "pass" }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "issues", "findingIds": [ "F01", "F02" ] }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "issues", "findingIds": [ "F05" ] }, { "principleId": "support-core-task-success", "expectation": "default", "status": "issues", "findingIds": [ "F06" ] }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F07", "F08" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F09", "F10" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "issues", "findingIds": [ "F11", "F22", "F12" ] }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F13", "F14" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F15", "F16", "F17" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "pass" }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "issues", "findingIds": [ "F18" ] }, { "principleId": "be-trustworthy", "expectation": "default", "status": "issues", "findingIds": [ "F06", "F17" ] }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F19", "F20" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "not-applicable", "reason": "No declared intent exposes account or subscription actions to autonomous agents; emerging WebMCP capabilities are therefore out of scope for this audit. The acquisition, login, and signup surfaces have no summarisation or language-model task that would benefit from on-device inference." }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "issues", "findingIds": [ "F21" ] } ], "paths": [ { "id": "home", "description": "Public UK landing page, representing acquisition, pricing, FAQ, consent, and the email entry point.", "url": "https://www.netflix.com/gb/", "conditions": [ "desktop 1440x1000", "mobile 360x800", "prefers-color-scheme: dark", "prefers-reduced-motion: reduce", "forced-colors: active", "keyboard focus" ], "result": "issues" }, { "id": "login", "description": "Sign-in form, representing authentication and account access.", "url": "https://www.netflix.com/gb/login", "conditions": [ "desktop 1440x1000", "mobile 360x800", "empty submission" ], "result": "issues" }, { "id": "signup", "description": "First subscription step, representing the public pre-commit signup journey and plan framing.", "url": "https://www.netflix.com/signup", "conditions": [ "mobile 360x800" ], "result": "issues" }, { "id": "not-found", "description": "Unknown route, representing HTTP/navigation recovery.", "url": "https://www.netflix.com/definitely-not-a-real-route-web-uplift", "conditions": [ "mobile 360x800" ], "result": "pass" } ], "findings": [ { "id": "F01", "severity": "high", "principleId": "maximize-content-reduce-noise", "principleCheckId": "no-intrusive-interruptions", "guidanceId": "light-dismiss-a-dialog", "confidence": "high", "summary": "The consent notice obscures core acquisition content on every tested entry surface.", "evidence": "Desktop and mobile screenshots show the on-load banner covering the hero or form; on 360x800 it consumes roughly the upper quarter of the viewport.", "suggestedFix": "Use a compact, non-obscuring consent treatment where legally possible, retain equally prominent accept/reject controls, and provide semantic light dismissal.", "effort": "medium", "artifacts": [ "evidence/home-desktop.png", "evidence/home-mobile.png", "evidence/login-desktop.png" ], "pathId": "home", "url": "https://www.netflix.com/gb/" }, { "id": "F02", "severity": "medium", "principleId": "maximize-content-reduce-noise", "principleCheckId": "semantic-dismissible-primitives", "guidanceId": "declarative-dialog-popover-control", "confidence": "high", "summary": "Consent and FAQ disclosure UI do not use the most appropriate native primitives.", "evidence": "The DOM probe found zero dialog, popover, or details elements while screenshots show an overlay and the page contains accordion disclosures.", "suggestedFix": "Use dialog for a modal consent flow and details/summary for FAQ disclosure, preserving focus management and declarative dismissal.", "effort": "medium", "artifacts": [ "evidence/home-dom.json", "evidence/home-desktop.png" ], "pathId": "home", "url": "https://www.netflix.com/gb/" }, { "id": "F03", "severity": "low", "principleId": "respect-user-preferences", "principleCheckId": "respects-color-scheme", "guidanceId": "dark-mode", "confidence": "high", "summary": "The page is fixed to a dark palette rather than explicitly integrating the user color-scheme preference.", "evidence": "Default and dark-preference screenshots are byte-identical; computed color-scheme is normal rather than light dark.", "suggestedFix": "Declare color-scheme and use prefers-color-scheme or light-dark() for user-preference-aware surfaces, including form controls.", "effort": "small", "artifacts": [ "evidence/home-dark.png", "evidence/preferences-interaction.json" ], "pathId": "home", "url": "https://www.netflix.com/gb/" }, { "id": "F04", "severity": "low", "principleId": "implement-natural-interactions", "principleCheckId": "view-transitions", "guidanceId": "same-document-transitions", "confidence": "high", "summary": "Public state and route changes have no authored View Transition treatment.", "evidence": "CSS inspection found no view-transition rules; the signup and login journey uses ordinary page swaps.", "suggestedFix": "Add restrained same-document or cross-document View Transitions for journey steps, with reduced-motion handling.", "effort": "medium", "artifacts": [ "evidence/preferences-interaction.json", "evidence/signup-mobile.png" ], "pathId": "home", "url": "https://www.netflix.com/gb/" }, { "id": "F05", "severity": "medium", "principleId": "adapt-to-the-form-factor", "principleCheckId": "input-modality-aware", "guidanceId": "accessibility", "confidence": "high", "summary": "Several mobile controls and links fall below a comfortable 44 CSS pixel touch target.", "evidence": "The 360px probe measured Sign In at 77x32, Learn more at 117x40, and footer links around 21px high, although keyboard focus was visible.", "suggestedFix": "Increase interactive hit areas to at least 44x44 CSS pixels using padding or pseudo-element hit regions without crowding the layout.", "effort": "small", "artifacts": [ "evidence/preferences-interaction.json", "evidence/home-mobile.png" ], "pathId": "home", "url": "https://www.netflix.com/gb/" }, { "id": "F06", "severity": "medium", "principleId": "support-core-task-success", "principleCheckId": "clear-system-state-and-recovery", "guidanceId": "accessible-error-announcement", "confidence": "high", "summary": "Empty form submission does not expose clear, inspectable error messaging or an announced recovery state.", "evidence": "On landing and login forms, empty submission moved focus to the first field but yielded no role=alert/aria-live message or explicit error text in the probe.", "suggestedFix": "Validate after interaction, show concise field-level guidance, set aria-invalid, and announce the error summary through an aria-live region.", "effort": "small", "artifacts": [ "evidence/home-validation.json", "evidence/login-validation.json" ], "pathId": "home", "url": "https://www.netflix.com/gb/" }, { "id": "F07", "severity": "high", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "guidanceId": "identify-inp-causes", "confidence": "high", "summary": "Mobile lab loading is outside the good LCP range and interaction readiness is delayed.", "evidence": "Lighthouse measured LCP 4.1s, TBT 266ms, max potential FID 452ms, and TTI 16.9s; the trace recorded two long tasks and 114.6ms TBT.", "suggestedFix": "Prioritise the hero LCP image, break up startup work, and defer consent, analytics, and non-critical application code until after the primary content is usable.", "effort": "large", "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-trace-summary.json", "evidence/home-mobile-layout.json" ], "pathId": "home", "url": "https://www.netflix.com/gb/" }, { "id": "F08", "severity": "medium", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "guidanceId": "optimize-image-priority", "confidence": "high", "summary": "The landing page ships a large startup payload with avoidable unused code and an unprioritised LCP image.", "evidence": "HAR recorded 2.62MB transferred, including 1.29MB scripts and 680KB fonts. The largest script is 762KB; Lighthouse estimates 729KiB unused JS, and the LCP image lacks fetchpriority=high.", "suggestedFix": "Split and conditionally load the acquisition bundle, subset fonts, eliminate duplicate reCAPTCHA loading, defer consent code, and mark the discovered LCP image fetchpriority=high.", "effort": "large", "artifacts": [ "evidence/home-summary.json", "evidence/lighthouse-home.json", "evidence/platform-probe.json" ], "pathId": "home", "url": "https://www.netflix.com/gb/" }, { "id": "F09", "severity": "medium", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "guidanceId": "accessibility", "confidence": "high", "summary": "The landing page heading hierarchy skips from H1 to H3.", "evidence": "Lighthouse identifies the “Ready to watch?” H3 immediately following the H1 as an invalid heading-order element.", "suggestedFix": "Use semantic section headings in sequence, or render instructional copy as a paragraph when it is not a heading.", "effort": "small", "artifacts": [ "evidence/lighthouse-home.json", "evidence/recon-evaluate.json" ], "pathId": "home", "url": "https://www.netflix.com/gb/" }, { "id": "F10", "severity": "high", "principleId": "be-inclusive", "principleCheckId": "zoom-reflow-targets-and-media", "guidanceId": "accessibility", "confidence": "high", "summary": "The viewport declaration prevents effective mobile zoom.", "evidence": "Lighthouse found maximum-scale=1.0 in the viewport meta tag on home, login, and signup probes.", "suggestedFix": "Remove maximum-scale and minimum-scale restrictions; use width=device-width, initial-scale=1 so users can zoom.", "effort": "trivial", "artifacts": [ "evidence/lighthouse-home.json", "evidence/login-probe.json", "evidence/signup-probe.json" ], "pathId": "home", "url": "https://www.netflix.com/gb/" }, { "id": "F11", "severity": "low", "principleId": "follow-best-practices", "principleCheckId": "no-console-errors", "guidanceId": "html", "confidence": "high", "summary": "A third-party consent script logs a browser console error.", "evidence": "Lighthouse captured “Refused to get unsafe header X-OneTrust-IsBot” from otSDKStub.js.", "suggestedFix": "Update or configure the consent SDK so it only reads CORS-exposed headers and does not emit runtime errors.", "effort": "small", "artifacts": [ "evidence/lighthouse-home.json" ], "pathId": "home", "url": "https://www.netflix.com/gb/" }, { "id": "F12", "severity": "medium", "principleId": "follow-best-practices", "principleCheckId": "browser-platform-hygiene", "guidanceId": "html", "confidence": "high", "summary": "The page triggers DevTools issues and cannot use the back/forward cache.", "evidence": "Lighthouse reports cookie inspector issues and three BFCache failure reasons, led by Cache-Control: no-store on the main resource.", "suggestedFix": "Review no-store use for anonymous acquisition pages, isolate truly sensitive responses, and resolve cookie inspector warnings.", "effort": "medium", "artifacts": [ "evidence/lighthouse-home.json" ], "pathId": "home", "url": "https://www.netflix.com/gb/" }, { "id": "F13", "severity": "medium", "principleId": "be-discoverable", "principleCheckId": "title-and-description", "guidanceId": "html", "confidence": "high", "summary": "Login and signup routes use the generic title “Netflix”.", "evidence": "DOM probes show descriptive home metadata, but both /gb/login and /signup have document.title “Netflix”, which does not distinguish their purpose.", "suggestedFix": "Give each public journey step a unique title such as “Sign in | Netflix” or “Choose your plan | Netflix”.", "effort": "trivial", "artifacts": [ "evidence/login-probe.json", "evidence/signup-probe.json" ], "pathId": "home", "url": "https://www.netflix.com/gb/" }, { "id": "F14", "severity": "medium", "principleId": "be-discoverable", "principleCheckId": "canonical-and-indexing-signals", "guidanceId": "html", "confidence": "high", "summary": "Public acquisition pages lack several indexing and sharing signals.", "evidence": "The home probe found no canonical, no hreflang, no JSON-LD, and only an Open Graph description; /sitemap.xml redirects to NotFound. Raw HTML coverage itself is strong at 90%.", "suggestedFix": "Add canonical and locale alternate links, publish a valid sitemap, and provide accurate Open Graph and Organization/WebSite structured metadata.", "effort": "medium", "artifacts": [ "evidence/recon-evaluate.json", "evidence/discoverability" ], "pathId": "home", "url": "https://www.netflix.com/gb/" }, { "id": "F15", "severity": "high", "principleId": "be-private-and-secure", "principleCheckId": "secure-transport-and-headers", "guidanceId": "security", "confidence": "high", "summary": "Active browser security policy coverage is incomplete and many cookies omit Secure.", "evidence": "Header inspection found no enforced CSP, Referrer-Policy, or Permissions-Policy. Seven of nine observed cookies lacked Secure, while HSTS, nosniff, and X-Frame-Options were present.", "suggestedFix": "Move CSP from report-only to a tested enforcing policy, set Referrer-Policy and Permissions-Policy, and apply Secure to every HTTPS cookie.", "effort": "medium", "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ], "pathId": "home", "url": "https://www.netflix.com/gb/" }, { "id": "F16", "severity": "high", "principleId": "be-private-and-secure", "principleCheckId": "data-minimisation-and-third-parties", "guidanceId": "privacy", "confidence": "high", "summary": "Logging, consent, and third-party services create a large pre-choice network footprint.", "evidence": "HAR attributed 52 of 54 requests and 2.53MB to origins other than www.netflix.com, including logging, OneTrust, Google reCAPTCHA, and geolocation; requests occur while the consent banner is still open.", "suggestedFix": "Treat Netflix-owned CDN origins separately from external vendors, then delay non-essential logging, geolocation, and reCAPTCHA until needed or consented; batch essential telemetry.", "effort": "large", "artifacts": [ "evidence/home.har", "evidence/home-summary.json", "evidence/trackers.json", "evidence/cookies.json" ], "pathId": "home", "url": "https://www.netflix.com/gb/" }, { "id": "F17", "severity": "medium", "principleId": "be-private-and-secure", "principleCheckId": "in-context-permissions-and-modern-auth", "guidanceId": "passkeys", "confidence": "high", "summary": "The authentication surface exposes password sign-in without passkey evidence and omits the password autocomplete token.", "evidence": "Login probe found an email field with autocomplete=email, a password field with no autocomplete value, and no navigator.credentials/passkey signal in loaded scripts; no permission prompt fired on load.", "suggestedFix": "Add autocomplete=current-password immediately and offer WebAuthn passkey sign-in or explain the phishing-resistant authentication path.", "effort": "large", "artifacts": [ "evidence/login-probe.json", "evidence/login-desktop.png" ], "pathId": "home", "url": "https://www.netflix.com/gb/" }, { "id": "F18", "severity": "medium", "principleId": "be-internationalised", "principleCheckId": "lang-dir-and-logical-properties", "guidanceId": "translator", "confidence": "high", "summary": "The global service sets language correctly but remains heavily dependent on physical-direction CSS.", "evidence": "The page has html lang=en and uses some logical properties, but CSS inspection counted 389 physical left/right declarations and no explicit dir value.", "suggestedFix": "Set dir at the localized root and migrate layout-critical left/right declarations to inline/block logical properties, testing an RTL locale.", "effort": "large", "artifacts": [ "evidence/platform-probe.json", "evidence/recon-evaluate.json" ], "pathId": "home", "url": "https://www.netflix.com/gb/" }, { "id": "F19", "severity": "low", "principleId": "be-sustainable", "principleCheckId": "optimised-assets", "guidanceId": "deliver-optimized-decorative-images", "confidence": "high", "summary": "Image delivery is mixed: responsive sources exist, but dimensions and some sizing/format choices remain wasteful.", "evidence": "Image probe found all four img elements without width/height attributes, two oversized images, and two legacy-format assets; measured CLS remained low.", "suggestedFix": "Add intrinsic dimensions, tighten responsive candidates, and convert remaining photographic assets to AVIF/WebP where quality and support permit.", "effort": "small", "artifacts": [ "evidence/images.json", "evidence/home-summary.json" ], "pathId": "home", "url": "https://www.netflix.com/gb/" }, { "id": "F20", "severity": "medium", "principleId": "be-sustainable", "principleCheckId": "third-party-and-media-budget", "guidanceId": "deprioritize-background-fetches", "confidence": "high", "summary": "The anonymous landing page uses a disproportionate script, font, and external-service budget.", "evidence": "HAR measured 2.62MB total, 1.29MB JavaScript and 680KB fonts; 2.53MB came from non-www origins, including consent and reCAPTCHA code before interaction.", "suggestedFix": "Adopt an acquisition-page budget, subset variable fonts, delay reCAPTCHA until form intent, and load consent/telemetry work at lower priority.", "effort": "large", "artifacts": [ "evidence/home-summary.json", "evidence/trackers.json" ], "pathId": "home", "url": "https://www.netflix.com/gb/" }, { "id": "F21", "severity": "medium", "principleId": "be-memory-efficient", "principleCheckId": "bounded-footprint", "guidanceId": "manage-recurring-intervals", "confidence": "high", "summary": "The steady-state heap is heavy for a mostly static acquisition page, although repeated FAQ use did not show an unbounded leak.", "evidence": "Baseline heap summary contained 686,116 nodes and 40.15MB self size. After ten FAQ cycles it rose only 0.4% to 40.31MB and DOM element count stayed exactly 1,088, so the concern is footprint rather than leakage.", "suggestedFix": "Reduce the client bundle and object graph loaded for anonymous acquisition; keep the repeated-interaction test in regression coverage.", "effort": "large", "artifacts": [ "evidence/heap-baseline.heapsnapshot", "evidence/heap-post-success.heapsnapshot", "evidence/memory-metrics.json" ], "pathId": "home", "url": "https://www.netflix.com/gb/" }, { "id": "F22", "severity": "low", "principleId": "follow-best-practices", "principleCheckId": "sound-document-and-assets", "guidanceId": "html", "confidence": "high", "summary": "Image markup omits intrinsic dimensions and includes oversized candidates.", "evidence": "The image probe found no width/height attributes on four images and two images over twice their display width; doctype and charset are valid and observed CLS is low.", "suggestedFix": "Emit width and height attributes matching the selected aspect ratio and tune srcset sizes to the actual layout slots.", "effort": "small", "artifacts": [ "evidence/images.json", "evidence/home-dom.json" ], "pathId": "home", "url": "https://www.netflix.com/gb/" } ], "taskList": [ { "id": "T01", "title": "Restore user zoom and increase small mobile hit areas", "priority": 1, "findingIds": [ "F10", "F05" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T02", "title": "Enforce CSP and secure all cookies", "priority": 2, "findingIds": [ "F15" ], "guidanceId": "security", "status": "open" }, { "id": "T03", "title": "Cut startup JavaScript, font, consent, and reCAPTCHA cost", "priority": 3, "findingIds": [ "F07", "F08", "F20" ], "guidanceId": "optimize-image-priority", "status": "open" }, { "id": "T04", "title": "Minimise pre-consent telemetry and external requests", "priority": 4, "findingIds": [ "F16" ], "guidanceId": "privacy", "status": "open" }, { "id": "T05", "title": "Make consent compact and semantic", "priority": 5, "findingIds": [ "F01", "F02" ], "guidanceId": "light-dismiss-a-dialog", "status": "open" }, { "id": "T06", "title": "Add announced, humane form validation", "priority": 6, "findingIds": [ "F06" ], "guidanceId": "accessible-error-announcement", "status": "open" }, { "id": "T07", "title": "Add passkeys and correct sign-in autocomplete", "priority": 7, "findingIds": [ "F17" ], "guidanceId": "passkeys", "status": "open" }, { "id": "T08", "title": "Correct headings and route metadata", "priority": 8, "findingIds": [ "F09", "F13", "F14" ], "guidanceId": "html", "status": "open" }, { "id": "T09", "title": "Resolve console, BFCache, and image markup issues", "priority": 9, "findingIds": [ "F11", "F12", "F22" ], "guidanceId": "html", "status": "open" }, { "id": "T10", "title": "Prepare global CSS for RTL layouts", "priority": 10, "findingIds": [ "F18" ], "guidanceId": "translator", "status": "open" }, { "id": "T11", "title": "Reduce steady-state heap footprint", "priority": 11, "findingIds": [ "F21" ], "guidanceId": "manage-recurring-intervals", "status": "open" }, { "id": "T12", "title": "Integrate color preference and restrained transitions", "priority": 12, "findingIds": [ "F03", "F04" ], "guidanceId": "dark-mode", "status": "open" }, { "id": "T13", "title": "Optimise remaining image candidates", "priority": 13, "findingIds": [ "F19" ], "guidanceId": "deliver-optimized-decorative-images", "status": "open" } ], "budget": { "pathCount": 4, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-22T01-56-07-420Z" }