{ "url": "https://www.facebook.com", "auditedAt": "2026-07-28T06:05:00.000Z", "mode": "report", "status": "blocked", "statusDetail": "The unauthenticated login, registration, and recovery entry surfaces were inspected, but Facebook content and authenticated product journeys require an account. No test credentials were supplied, so checks requiring those journeys are blocked and this is not a completed audit.", "page": { "appType": "hybrid", "framework": "Meta internal client runtime", "notes": "Public login/consent shell with authenticated social application behind an account wall." }, "evidenceUsed": [ "screenshot", "dom", "evaluate-probe", "layout-metrics", "discoverability", "trace", "har", "headers", "cookies", "trackers", "images", "secrets", "heap-summary", "lighthouse", "Modern Web Guidance search/list" ], "guidanceConsulted": [ "dark-mode", "light-dismiss-a-dialog", "fluid-scaling", "accessibility", "performance", "identify-heavy-scripts", "html", "stabilize-reactive-state", "security", "optimize-image-priority", "autofill-sign-in-form" ], "artifacts": [ { "type": "other", "path": "evidence/cookies.json", "caption": "cookies.json" }, { "type": "screenshot", "path": "evidence/dark.png", "caption": "dark.png" }, { "type": "screenshot", "path": "evidence/desktop.png", "caption": "desktop.png" }, { "type": "screenshot", "path": "evidence/discoverability-crawler.png", "caption": "discoverability-crawler.png" }, { "type": "screenshot", "path": "evidence/discoverability-rendered.png", "caption": "discoverability-rendered.png" }, { "type": "discoverability", "path": "evidence/discoverability.json", "caption": "discoverability.json" }, { "type": "dom", "path": "evidence/dom.json", "caption": "dom.json" }, { "type": "other", "path": "evidence/guidance-catalog.json", "caption": "guidance-catalog.json" }, { "type": "other", "path": "evidence/guidance-direct-ids.txt", "caption": "guidance-direct-ids.txt" }, { "type": "other", "path": "evidence/guidance-mapped-index.json", "caption": "guidance-mapped-index.json" }, { "type": "other", "path": "evidence/guidance-search-adapt-to-the-form-factor.json", "caption": "guidance-search-adapt-to-the-form-factor.json" }, { "type": "other", "path": "evidence/guidance-search-be-agent-ready.json", "caption": "guidance-search-be-agent-ready.json" }, { "type": "other", "path": "evidence/guidance-search-be-discoverable.json", "caption": "guidance-search-be-discoverable.json" }, { "type": "other", "path": "evidence/guidance-search-be-fast-and-stable.json", "caption": "guidance-search-be-fast-and-stable.json" }, { "type": "other", "path": "evidence/guidance-search-be-inclusive.json", "caption": "guidance-search-be-inclusive.json" }, { "type": "other", "path": "evidence/guidance-search-be-internationalised.json", "caption": "guidance-search-be-internationalised.json" }, { "type": "other", "path": "evidence/guidance-search-be-memory-efficient.json", "caption": "guidance-search-be-memory-efficient.json" }, { "type": "other", "path": "evidence/guidance-search-be-private-and-secure.json", "caption": "guidance-search-be-private-and-secure.json" }, { "type": "other", "path": "evidence/guidance-search-be-resilient.json", "caption": "guidance-search-be-resilient.json" }, { "type": "other", "path": "evidence/guidance-search-be-sustainable.json", "caption": "guidance-search-be-sustainable.json" }, { "type": "other", "path": "evidence/guidance-search-be-trustworthy.json", "caption": "guidance-search-be-trustworthy.json" }, { "type": "other", "path": "evidence/guidance-search-follow-best-practices.json", "caption": "guidance-search-follow-best-practices.json" }, { "type": "other", "path": "evidence/guidance-search-implement-natural-interactions.json", "caption": "guidance-search-implement-natural-interactions.json" }, { "type": "other", "path": "evidence/guidance-search-maximize-content-reduce-noise.json", "caption": "guidance-search-maximize-content-reduce-noise.json" }, { "type": "other", "path": "evidence/guidance-search-provide-guided-navigation.json", "caption": "guidance-search-provide-guided-navigation.json" }, { "type": "other", "path": "evidence/guidance-search-respect-user-preferences.json", "caption": "guidance-search-respect-user-preferences.json" }, { "type": "other", "path": "evidence/guidance-search-support-core-task-success.json", "caption": "guidance-search-support-core-task-success.json" }, { "type": "other", "path": "evidence/headers.json", "caption": "headers.json" }, { "type": "heap", "path": "evidence/heap-baseline", "caption": "heap-baseline" }, { "type": "heap", "path": "evidence/heap-post", "caption": "heap-post" }, { "type": "screenshot", "path": "evidence/high-contrast.png", "caption": "high-contrast.png" }, { "type": "other", "path": "evidence/images.json", "caption": "images.json" }, { "type": "layout", "path": "evidence/layout-mobile.json", "caption": "layout-mobile.json" }, { "type": "lighthouse", "path": "evidence/lighthouse.json", "caption": "lighthouse.json" }, { "type": "screenshot", "path": "evidence/login-dismissed.png", "caption": "login-dismissed.png" }, { "type": "screenshot", "path": "evidence/login-no-consent.png", "caption": "login-no-consent.png" }, { "type": "screenshot", "path": "evidence/mobile.png", "caption": "mobile.png" }, { "type": "har-summary", "path": "evidence/network-summary.json", "caption": "network-summary.json" }, { "type": "har", "path": "evidence/network.har", "caption": "network.har" }, { "type": "other", "path": "evidence/page-probe.json", "caption": "page-probe.json" }, { "type": "trace", "path": "evidence/perf", "caption": "perf" }, { "type": "trace-summary", "path": "evidence/perf-summary.json", "caption": "perf-summary.json" }, { "type": "screenshot", "path": "evidence/recovery-dismissed.png", "caption": "recovery-dismissed.png" }, { "type": "screenshot", "path": "evidence/recovery.png", "caption": "recovery.png" }, { "type": "other", "path": "evidence/reduced-motion.json", "caption": "reduced-motion.json" }, { "type": "screenshot", "path": "evidence/registration-dismissed.png", "caption": "registration-dismissed.png" }, { "type": "screenshot", "path": "evidence/registration.png", "caption": "registration.png" }, { "type": "other", "path": "evidence/robots.json", "caption": "robots.json" }, { "type": "other", "path": "evidence/secrets.json", "caption": "secrets.json" }, { "type": "other", "path": "evidence/sitemap.json", "caption": "sitemap.json" }, { "type": "other", "path": "evidence/trackers.json", "caption": "trackers.json" }, { "type": "other", "path": "evidence/ui-probe.json", "caption": "ui-probe.json" } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 41, "blocked": 17, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": false }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "issues", "confidence": "high", "method": "Screenshot + DOM/evaluate/Lighthouse evidence", "evidence": "Dark-emulation screenshot remained a hard-coded white dialog and grey backdrop; computed color-scheme was normal.", "pathIds": [ "login-public", "registration-public", "recovery-public" ], "findingIds": [ "F01" ], "artifacts": [ "evidence/dark.png" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "pass", "confidence": "high", "method": "Screenshot + DOM/evaluate/Lighthouse evidence", "evidence": "Reduced-motion emulation was active and getAnimations() returned no running animations on the public entry state.", "pathIds": [ "login-public", "registration-public", "recovery-public" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "pass", "confidence": "high", "method": "Screenshot + DOM/evaluate/Lighthouse evidence", "evidence": "The prefers-contrast: more screenshot retained readable text and visible controls.", "pathIds": [ "login-public", "registration-public", "recovery-public" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "blocked", "confidence": "high", "method": "Attempted route/interaction inspection; authentication prerequisite prevented execution", "evidence": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "reason": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "pathIds": [ "login-public", "registration-public", "recovery-public" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "blocked", "confidence": "high", "method": "Attempted route/interaction inspection; authentication prerequisite prevented execution", "evidence": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "reason": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "pathIds": [ "login-public", "registration-public", "recovery-public" ] }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "blocked", "confidence": "high", "method": "Attempted route/interaction inspection; authentication prerequisite prevented execution", "evidence": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "reason": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "pathIds": [ "login-public", "registration-public", "recovery-public" ] }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "blocked", "confidence": "high", "method": "Attempted route/interaction inspection; authentication prerequisite prevented execution", "evidence": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "reason": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "pathIds": [ "login-public", "registration-public", "recovery-public" ] }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "blocked", "confidence": "high", "method": "Attempted route/interaction inspection; authentication prerequisite prevented execution", "evidence": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "reason": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "pathIds": [ "login-public", "registration-public", "recovery-public" ] }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "blocked", "confidence": "high", "method": "Attempted route/interaction inspection; authentication prerequisite prevented execution", "evidence": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "reason": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "pathIds": [ "login-public", "registration-public", "recovery-public" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "issues", "confidence": "high", "method": "Screenshot + DOM/evaluate/Lighthouse evidence", "evidence": "Desktop, registration, recovery, and mobile screenshots all opened with a modal cookie wall covering the primary content.", "pathIds": [ "login-public", "registration-public", "recovery-public" ], "findingIds": [ "F02" ], "artifacts": [ "evidence/desktop.png" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "pass", "confidence": "high", "method": "Screenshot + DOM/evaluate/Lighthouse evidence", "evidence": "DOM reported role=dialog, aria-modal=true, and equally prominent Allow/Decline controls.", "pathIds": [ "login-public", "registration-public", "recovery-public" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "issues", "confidence": "high", "method": "Screenshot + DOM/evaluate/Lighthouse evidence", "evidence": "At 360x800 the cookie dialog consumes most of the viewport and pushes the login task behind non-task explanatory cards.", "pathIds": [ "login-public", "registration-public", "recovery-public" ], "findingIds": [ "F02" ], "artifacts": [ "evidence/desktop.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "issues", "confidence": "high", "method": "Screenshot + DOM/evaluate/Lighthouse evidence", "evidence": "Mobile layout reported no viewport meta and rendered a 980 CSS-pixel layout scaled to 360 physical pixels; text and controls are miniaturised.", "pathIds": [ "login-public", "registration-public", "recovery-public" ], "findingIds": [ "F03" ], "artifacts": [ "evidence/mobile.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "blocked", "confidence": "high", "method": "Attempted route/interaction inspection; authentication prerequisite prevented execution", "evidence": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "reason": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "pathIds": [ "login-public", "registration-public", "recovery-public" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "issues", "confidence": "high", "method": "Screenshot + DOM/evaluate/Lighthouse evidence", "evidence": "Programmatic focus probes reported outline:none and box-shadow:none for login inputs, links, and role=button controls; many footer links are only 17px high.", "pathIds": [ "login-public", "registration-public", "recovery-public" ], "findingIds": [ "F07" ], "artifacts": [ "evidence/lighthouse.json" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "issues", "confidence": "high", "method": "Screenshot + DOM/evaluate/Lighthouse evidence", "evidence": "The underlying login purpose is clear, but the first-load modal obscures it on every tested route.", "pathIds": [ "login-public", "registration-public", "recovery-public" ], "findingIds": [ "F02" ], "artifacts": [ "evidence/desktop.png" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "blocked", "confidence": "high", "method": "Attempted route/interaction inspection; authentication prerequisite prevented execution", "evidence": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "reason": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "pathIds": [ "login-public", "registration-public", "recovery-public" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "blocked", "confidence": "high", "method": "Attempted route/interaction inspection; authentication prerequisite prevented execution", "evidence": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "reason": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "pathIds": [ "login-public", "registration-public", "recovery-public" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "high", "method": "Trace + Lighthouse", "evidence": "Trace measured LCP/FCP 2.80s; mobile Lighthouse measured LCP 6.3s and Speed Index 7.9s.", "pathIds": [ "login-public", "registration-public", "recovery-public" ], "findingIds": [ "F05" ], "artifacts": [ "evidence/perf-summary.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "pass", "confidence": "high", "method": "Screenshot + DOM/evaluate/Lighthouse evidence", "evidence": "Mobile layout observer measured CLS 0.043 and Lighthouse measured 0.022, both within the good range.", "pathIds": [ "login-public", "registration-public", "recovery-public" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "issues", "confidence": "high", "method": "Trace + Lighthouse", "evidence": "Trace recorded two long tasks, longest 144.65ms, and 166.54ms total blocking time on the desktop load.", "pathIds": [ "login-public", "registration-public", "recovery-public" ], "findingIds": [ "F05" ], "artifacts": [ "evidence/perf-summary.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "HAR + tracker probe", "evidence": "HAR recorded 40 requests and 2,051,856 transferred bytes for the login/consent surface.", "pathIds": [ "login-public", "registration-public", "recovery-public" ], "findingIds": [ "F06" ], "artifacts": [ "evidence/network-summary.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "high", "method": "Screenshot + DOM/evaluate/Lighthouse evidence", "evidence": "HAR recorded 24 scripts transferring 1,325,452 bytes for a small unauthenticated login/consent surface.", "pathIds": [ "login-public", "registration-public", "recovery-public" ], "findingIds": [ "F06" ], "artifacts": [ "evidence/network-summary.json" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "issues", "confidence": "high", "method": "Screenshot + DOM/evaluate/Lighthouse evidence", "evidence": "Lighthouse accessibility found missing labels and required ARIA attributes; the image audit found four cookie-card images without alt text.", "pathIds": [ "login-public", "registration-public", "recovery-public" ], "findingIds": [ "F07" ], "artifacts": [ "evidence/lighthouse.json" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "issues", "confidence": "high", "method": "Screenshot + DOM/evaluate/Lighthouse evidence", "evidence": "Lighthouse color-contrast audit failed on the mobile login route.", "pathIds": [ "login-public", "registration-public", "recovery-public" ], "findingIds": [ "F07" ], "artifacts": [ "evidence/lighthouse.json" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "issues", "confidence": "high", "method": "Screenshot + DOM/evaluate/Lighthouse evidence", "evidence": "No h1 was present, and the focus probe found no visible outline or box shadow on focused login controls and links.", "pathIds": [ "login-public", "registration-public", "recovery-public" ], "findingIds": [ "F07" ], "artifacts": [ "evidence/lighthouse.json" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "pass", "confidence": "high", "method": "Screenshot + DOM/evaluate/Lighthouse evidence", "evidence": "Desktop screenshot showed readable body text with comfortable line lengths inside the consent dialog.", "pathIds": [ "login-public", "registration-public", "recovery-public" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "issues", "confidence": "high", "method": "Screenshot + DOM/evaluate/Lighthouse evidence", "evidence": "No viewport meta was present on desktop; mobile Lighthouse also failed its viewport scaling audit.", "pathIds": [ "login-public", "registration-public", "recovery-public" ], "findingIds": [ "F03" ], "artifacts": [ "evidence/mobile.png" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "issues", "confidence": "high", "method": "Screenshot + DOM/evaluate/Lighthouse evidence", "evidence": "Lighthouse reported browser console errors.", "pathIds": [ "login-public", "registration-public", "recovery-public" ], "findingIds": [ "F12" ], "artifacts": [ "evidence/lighthouse.json" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "issues", "confidence": "high", "method": "Screenshot + DOM/evaluate/Lighthouse evidence", "evidence": "Doctype and UTF-8 were valid, but all four images lacked a complete width/height pair and used PNG without responsive sources.", "pathIds": [ "login-public", "registration-public", "recovery-public" ], "findingIds": [ "F11" ], "artifacts": [ "evidence/images.json" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "issues", "confidence": "high", "method": "Screenshot + DOM/evaluate/Lighthouse evidence", "evidence": "Lighthouse reported a deprecated API, missing source maps, four BFCache failure reasons, and console errors.", "pathIds": [ "login-public", "registration-public", "recovery-public" ], "findingIds": [ "F12" ], "artifacts": [ "evidence/lighthouse.json" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "issues", "confidence": "high", "method": "Screenshot + DOM/evaluate/Lighthouse evidence", "evidence": "The title is only “Facebook”; no meta description was present.", "pathIds": [ "login-public", "registration-public", "recovery-public" ], "findingIds": [ "F08" ], "artifacts": [ "evidence/page-probe.json" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "issues", "confidence": "high", "method": "Screenshot + DOM/evaluate/Lighthouse evidence", "evidence": "Links had real hrefs, but the page omitted the viewport meta and robots.txt disallowed User-agent: *.", "pathIds": [ "login-public", "registration-public", "recovery-public" ], "findingIds": [ "F03" ], "artifacts": [ "evidence/mobile.png" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "issues", "confidence": "high", "method": "Discoverability + DOM/robots probes", "evidence": "The response succeeded and exposed a canonical, but robots.txt disallowed all generic crawlers and /sitemap.xml returned an HTML unavailable state.", "pathIds": [ "login-public", "registration-public", "recovery-public" ], "findingIds": [ "F09" ], "artifacts": [ "evidence/discoverability.json" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "issues", "confidence": "high", "method": "Screenshot + DOM/evaluate/Lighthouse evidence", "evidence": "The probe found no Open Graph metadata and no description on the entry page.", "pathIds": [ "login-public", "registration-public", "recovery-public" ], "findingIds": [ "F08" ], "artifacts": [ "evidence/page-probe.json" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "pass", "confidence": "high", "method": "Headers/cookies/secrets probes", "evidence": "HTTPS, CSP, HSTS, nosniff, X-Frame-Options DENY, and Permissions-Policy were present; no cookies or exposed secrets were observed before consent.", "pathIds": [ "login-public", "registration-public", "recovery-public" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "pass", "confidence": "high", "method": "Screenshot + DOM/evaluate/Lighthouse evidence", "evidence": "Before consent, cookies reported zero cookies and trackers reported no known tracker domains; only Meta-controlled delivery origins were observed.", "pathIds": [ "login-public", "registration-public", "recovery-public" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "pass", "confidence": "high", "method": "Screenshot + DOM/evaluate/Lighthouse evidence", "evidence": "No permission prompt appeared on load, and the username input advertised autocomplete=\"username webauthn\".", "pathIds": [ "login-public", "registration-public", "recovery-public" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "high", "method": "Headers/cookies/secrets probes", "evidence": "Headers probe found no Referrer-Policy and CSP style-src included unsafe-inline.", "pathIds": [ "login-public", "registration-public", "recovery-public" ], "findingIds": [ "F10" ], "artifacts": [ "evidence/headers.json" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "issues", "confidence": "high", "method": "Discoverability + DOM/robots probes", "evidence": "Discoverability measured only 1% raw-to-rendered content coverage and classified the page as a JS shell.", "pathIds": [ "login-public", "registration-public", "recovery-public" ], "findingIds": [ "F09" ], "artifacts": [ "evidence/discoverability.json" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "blocked", "confidence": "high", "method": "Attempted route/interaction inspection; authentication prerequisite prevented execution", "evidence": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "reason": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "pathIds": [ "login-public", "registration-public", "recovery-public" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "not-applicable", "confidence": "high", "method": "Screenshot + DOM/evaluate/Lighthouse evidence", "evidence": "Facebook is an intrinsically connected social service; installability/offline operation was not treated as required for this unauthenticated web entry surface.", "reason": "Facebook is an intrinsically connected social service; installability/offline operation was not treated as required for this unauthenticated web entry surface." }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "blocked", "confidence": "high", "method": "Attempted route/interaction inspection; authentication prerequisite prevented execution", "evidence": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "reason": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "pathIds": [ "login-public", "registration-public", "recovery-public" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "pass", "confidence": "high", "method": "Screenshot + DOM/evaluate/Lighthouse evidence", "evidence": "The entry document declared lang=en and dir=ltr, and exposed multiple language choices.", "pathIds": [ "login-public", "registration-public", "recovery-public" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "blocked", "confidence": "high", "method": "Attempted route/interaction inspection; authentication prerequisite prevented execution", "evidence": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "reason": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "pathIds": [ "login-public", "registration-public", "recovery-public" ] }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "blocked", "confidence": "high", "method": "Attempted route/interaction inspection; authentication prerequisite prevented execution", "evidence": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "reason": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "pathIds": [ "login-public", "registration-public", "recovery-public" ] }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "pass", "confidence": "high", "method": "Screenshot + DOM/evaluate/Lighthouse evidence", "evidence": "Consent choices were presented side by side with direct “Decline optional cookies” and “Allow all cookies” labels.", "pathIds": [ "login-public", "registration-public", "recovery-public" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "blocked", "confidence": "high", "method": "Attempted route/interaction inspection; authentication prerequisite prevented execution", "evidence": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "reason": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "pathIds": [ "login-public", "registration-public", "recovery-public" ] }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "issues", "confidence": "high", "method": "Screenshot + DOM/evaluate/Lighthouse evidence", "evidence": "Username used username webauthn, but the password field had an empty autocomplete token rather than current-password.", "pathIds": [ "login-public", "registration-public", "recovery-public" ], "findingIds": [ "F15" ], "artifacts": [ "evidence/page-probe.json" ] }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "blocked", "confidence": "high", "method": "Attempted route/interaction inspection; authentication prerequisite prevented execution", "evidence": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "reason": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "pathIds": [ "login-public", "registration-public", "recovery-public" ] }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "issues", "confidence": "high", "method": "Screenshot + DOM/evaluate/Lighthouse evidence", "evidence": "All four below-fold cookie-card images were PNG, lacked srcset, lacked lazy loading, and lacked complete dimensions.", "pathIds": [ "login-public", "registration-public", "recovery-public" ], "findingIds": [ "F11" ], "artifacts": [ "evidence/images.json" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "issues", "confidence": "high", "method": "HAR + tracker probe", "evidence": "The small public entry surface transferred 2.05MB, including 1.33MB across 24 scripts.", "pathIds": [ "login-public", "registration-public", "recovery-public" ], "findingIds": [ "F06" ], "artifacts": [ "evidence/network-summary.json" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "pass", "confidence": "high", "method": "HAR + tracker probe", "evidence": "No autoplay media was observed and the network capture contained no known tracker domain before consent.", "pathIds": [ "login-public", "registration-public", "recovery-public" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "not-applicable", "confidence": "high", "method": "Screenshot + DOM/evaluate/Lighthouse evidence", "evidence": "Facebook explicitly blocks GPTBot, ClaudeBot, PerplexityBot, Google-Extended, and User-agent: * in robots.txt; agent access is therefore intentionally out of scope, not an accidental omission.", "reason": "Facebook explicitly blocks GPTBot, ClaudeBot, PerplexityBot, Google-Extended, and User-agent: * in robots.txt; agent access is therefore intentionally out of scope, not an accidental omission." }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "high", "method": "Screenshot + DOM/evaluate/Lighthouse evidence", "evidence": "No agent-facing or on-device inference task is exposed on the unauthenticated login surface, and the site explicitly blocks agent crawling.", "reason": "No agent-facing or on-device inference task is exposed on the unauthenticated login surface, and the site explicitly blocks agent crawling." }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "blocked", "confidence": "high", "method": "Attempted route/interaction inspection; authentication prerequisite prevented execution", "evidence": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "reason": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "pathIds": [ "login-public", "registration-public", "recovery-public" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "issues", "confidence": "medium", "method": "Heap baseline/post summaries", "evidence": "A static login/consent page retained about 43.8MB self size across roughly 860k to 877k heap nodes, disproportionate to the visible task.", "pathIds": [ "login-public", "registration-public", "recovery-public" ], "findingIds": [ "F13" ], "artifacts": [ "evidence/heap-baseline" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "blocked", "confidence": "high", "method": "Attempted route/interaction inspection; authentication prerequisite prevented execution", "evidence": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "reason": "The public entry point is an authentication wall and no test account was provided, so the authenticated interaction or state required by this check could not be exercised.", "pathIds": [ "login-public", "registration-public", "recovery-public" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F01" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "incomplete", "reason": "One or more checks were blocked by the authentication wall." }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "incomplete", "reason": "One or more checks were blocked by the authentication wall." }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "issues", "findingIds": [ "F02" ] }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "issues", "findingIds": [ "F03", "F07" ] }, { "principleId": "support-core-task-success", "expectation": "default", "status": "issues", "findingIds": [ "F02" ] }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F05", "F06" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F07", "F03" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "issues", "findingIds": [ "F12", "F11" ] }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F08", "F03", "F09" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F10" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "issues", "findingIds": [ "F09" ] }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "incomplete", "reason": "One or more checks were blocked by the authentication wall." }, { "principleId": "be-trustworthy", "expectation": "default", "status": "issues", "findingIds": [ "F15" ] }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F11", "F06" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "not-applicable", "reason": "Facebook explicitly blocks GPTBot, ClaudeBot, PerplexityBot, Google-Extended, and User-agent: * in robots.txt; agent access is therefore intentionally out of scope, not an accidental omission. No agent-facing or on-device inference task is exposed on the unauthenticated login surface, and the site explicitly blocks agent crawling." }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "issues", "findingIds": [ "F13" ] } ], "paths": [ { "id": "login-public", "description": "Public entry/login and consent surface, representing the unauthenticated homepage and primary entry task.", "url": "https://www.facebook.com/", "conditions": [ "desktop", "360x800 mobile", "prefers-color-scheme: dark", "prefers-contrast: more", "prefers-reduced-motion: reduce", "keyboard focus probe" ], "result": "issues" }, { "id": "registration-public", "description": "Registration route, representing account creation; cookie modal inspected, completion not attempted because it creates an account.", "url": "https://www.facebook.com/reg/", "conditions": [ "desktop", "first visit" ], "result": "issues" }, { "id": "recovery-public", "description": "Password recovery route, representing account recovery; cookie modal inspected, identity-dependent continuation not attempted.", "url": "https://www.facebook.com/recover/initiate/", "conditions": [ "desktop", "first visit" ], "result": "issues" }, { "id": "authenticated-product", "description": "Feed, profile, messaging, media, settings, commerce, and long-lived authenticated journeys were not covered because no test account was provided.", "url": "https://www.facebook.com/", "conditions": [ "authentication required" ], "result": "failed" } ], "findings": [ { "id": "F01", "severity": "medium", "confidence": "high", "pathId": "login-public", "url": "https://www.facebook.com/", "principleId": "respect-user-preferences", "principleCheckId": "respects-color-scheme", "guidanceId": "dark-mode", "guidanceCategory": "user-experience", "summary": "The public entry surface does not honor dark color preference.", "evidence": "Dark-emulation screenshot remained a hard-coded white dialog and grey backdrop; computed color-scheme was normal.", "suggestedFix": "Declare color-scheme: light dark and theme surfaces with prefers-color-scheme or light-dark().", "artifacts": [ "evidence/dark.png" ], "effort": "medium" }, { "id": "F02", "severity": "high", "confidence": "high", "pathId": "login-public", "url": "https://www.facebook.com/", "principleId": "maximize-content-reduce-noise", "principleCheckId": "no-intrusive-interruptions", "guidanceId": "light-dismiss-a-dialog", "guidanceCategory": "user-experience", "summary": "A first-load cookie wall obscures every tested primary route, especially on mobile.", "evidence": "Desktop, registration, recovery, and mobile screenshots all opened with a modal cookie wall covering the primary content.", "suggestedFix": "Use a compact consent surface that preserves access to the primary task, keeps equal consent choices, and avoids loading explanatory cards into the initial modal.", "artifacts": [ "evidence/desktop.png", "evidence/mobile.png", "evidence/registration.png", "evidence/recovery.png" ], "effort": "medium" }, { "id": "F03", "severity": "high", "confidence": "high", "pathId": "login-public", "url": "https://www.facebook.com/", "principleId": "adapt-to-the-form-factor", "principleCheckId": "responsive-no-horizontal-scroll", "guidanceId": "fluid-scaling", "guidanceCategory": "user-experience", "summary": "The mobile experience is a scaled 980px desktop layout and zoom/reflow support is compromised.", "evidence": "Mobile layout reported no viewport meta and rendered a 980 CSS-pixel layout scaled to 360 physical pixels; text and controls are miniaturised.", "suggestedFix": "Add a standard device-width viewport, preserve user scaling, and reflow the login and consent UI at narrow widths.", "artifacts": [ "evidence/mobile.png", "evidence/layout-mobile.json" ], "effort": "medium" }, { "id": "F05", "severity": "high", "confidence": "high", "pathId": "login-public", "url": "https://www.facebook.com/", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "guidanceId": "performance", "guidanceCategory": "user-experience", "summary": "The entry surface paints too slowly and performs avoidable main-thread work.", "evidence": "Trace measured LCP/FCP 2.80s; mobile Lighthouse measured LCP 6.3s and Speed Index 7.9s.", "suggestedFix": "Reduce critical JS, prioritize the LCP content, and split/defer long tasks so the login task paints within the good LCP range.", "artifacts": [ "evidence/perf-summary.json", "evidence/lighthouse.json" ], "effort": "medium" }, { "id": "F06", "severity": "high", "confidence": "high", "pathId": "login-public", "url": "https://www.facebook.com/", "principleId": "be-fast-and-stable", "principleCheckId": "trim-unused-and-duplicate-code", "guidanceId": "identify-heavy-scripts", "guidanceCategory": "user-experience", "summary": "The unauthenticated login/consent surface ships 2.05MB, dominated by 1.33MB across 24 scripts.", "evidence": "HAR recorded 24 scripts transferring 1,325,452 bytes for a small unauthenticated login/consent surface.", "suggestedFix": "Create a minimal unauthenticated bundle; defer consent-detail and authenticated-product code until requested.", "artifacts": [ "evidence/network-summary.json", "evidence/network.har" ], "effort": "medium" }, { "id": "F07", "severity": "high", "confidence": "high", "pathId": "login-public", "url": "https://www.facebook.com/", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "guidanceId": "accessibility", "guidanceCategory": "user-experience", "summary": "Accessibility checks found contrast, labelling, ARIA, heading, focus visibility, and target-size gaps.", "evidence": "No h1 was present, and the focus probe found no visible outline or box shadow on focused login controls and links.", "suggestedFix": "Use semantic headings and controls, preserve visible :focus-visible styles, fix labels/ARIA, add meaningful alt text, and verify contrast.", "artifacts": [ "evidence/lighthouse.json", "evidence/ui-probe.json", "evidence/images.json" ], "effort": "medium" }, { "id": "F08", "severity": "medium", "confidence": "high", "pathId": "login-public", "url": "https://www.facebook.com/", "principleId": "be-discoverable", "principleCheckId": "title-and-description", "guidanceId": "html", "guidanceCategory": "user-experience", "summary": "The entry page has generic and incomplete search/share metadata.", "evidence": "The title is only “Facebook”; no meta description was present.", "suggestedFix": "Add a descriptive title, meta description, and accurate Open Graph metadata for the public entry page.", "artifacts": [ "evidence/page-probe.json" ], "effort": "medium" }, { "id": "F09", "severity": "high", "confidence": "high", "pathId": "login-public", "url": "https://www.facebook.com/", "principleId": "be-resilient", "principleCheckId": "progressive-enhancement", "guidanceId": "stabilize-reactive-state", "guidanceCategory": "user-experience", "summary": "Non-JavaScript clients receive almost none of the visible login content.", "evidence": "Discoverability measured only 1% raw-to-rendered content coverage and classified the page as a JS shell.", "suggestedFix": "Server-render the essential login purpose, fields, recovery/signup links, and consent choices so the core entry task survives without JavaScript.", "artifacts": [ "evidence/discoverability.json", "evidence/discoverability-rendered.png", "evidence/discoverability-crawler.png", "evidence/robots.json" ], "effort": "medium" }, { "id": "F10", "severity": "medium", "confidence": "high", "pathId": "login-public", "url": "https://www.facebook.com/", "principleId": "be-private-and-secure", "principleCheckId": "defensive-browser-policies", "guidanceId": "security", "guidanceCategory": "user-experience", "summary": "Defense-in-depth headers are incomplete.", "evidence": "Headers probe found no Referrer-Policy and CSP style-src included unsafe-inline.", "suggestedFix": "Set an explicit strict-origin-when-cross-origin or stricter Referrer-Policy and continue reducing unsafe-inline style dependencies with hashes/nonces.", "artifacts": [ "evidence/headers.json" ], "effort": "medium" }, { "id": "F11", "severity": "medium", "confidence": "high", "pathId": "login-public", "url": "https://www.facebook.com/", "principleId": "follow-best-practices", "principleCheckId": "sound-document-and-assets", "guidanceId": "optimize-image-priority", "guidanceCategory": "user-experience", "summary": "Cookie-dialog images lack dimensions, alternatives, responsive sources, lazy loading, and modern formats.", "evidence": "Doctype and UTF-8 were valid, but all four images lacked a complete width/height pair and used PNG without responsive sources.", "suggestedFix": "Add width and height, appropriate alt or empty alt, lazy loading below fold, srcset/sizes, and AVIF/WebP variants.", "artifacts": [ "evidence/images.json" ], "effort": "medium" }, { "id": "F12", "severity": "medium", "confidence": "high", "pathId": "login-public", "url": "https://www.facebook.com/", "principleId": "follow-best-practices", "principleCheckId": "browser-platform-hygiene", "guidanceId": "html", "guidanceCategory": "user-experience", "summary": "Lighthouse found console errors, deprecated API use, missing source maps, and BFCache blockers.", "evidence": "Lighthouse reported a deprecated API, missing source maps, four BFCache failure reasons, and console errors.", "suggestedFix": "Remove console/runtime errors and deprecated APIs, ship valid source maps, and resolve BFCache blockers.", "artifacts": [ "evidence/lighthouse.json" ], "effort": "medium" }, { "id": "F13", "severity": "medium", "confidence": "high", "pathId": "login-public", "url": "https://www.facebook.com/", "principleId": "be-memory-efficient", "principleCheckId": "bounded-footprint", "guidanceId": "performance", "guidanceCategory": "user-experience", "summary": "The retained heap footprint is large for the visible public task.", "evidence": "A static login/consent page retained about 43.8MB self size across roughly 860k to 877k heap nodes, disproportionate to the visible task.", "suggestedFix": "Profile dominators and remove unauthenticated code/data not needed by login or consent; remeasure in one controlled session.", "artifacts": [ "evidence/heap-baseline", "evidence/heap-post" ], "effort": "medium" }, { "id": "F15", "severity": "medium", "confidence": "high", "pathId": "login-public", "url": "https://www.facebook.com/", "principleId": "be-trustworthy", "principleCheckId": "trustworthy-input-assistance", "guidanceId": "autofill-sign-in-form", "guidanceCategory": "user-experience", "summary": "The password field omits the current-password autocomplete token.", "evidence": "Username used username webauthn, but the password field had an empty autocomplete token rather than current-password.", "suggestedFix": "Set autocomplete=\"current-password\" on the password field while retaining username webauthn on the identifier field.", "artifacts": [ "evidence/page-probe.json" ], "effort": "trivial" } ], "taskList": [ { "id": "T01", "title": "Use a compact consent surface that preserves access to the primary task, keeps equal consent choices, and avoids loading explanatory cards into the initial modal.", "priority": 1, "findingIds": [ "F02" ], "guidanceId": "light-dismiss-a-dialog", "status": "open" }, { "id": "T02", "title": "Add a standard device-width viewport, preserve user scaling, and reflow the login and consent UI at narrow widths.", "priority": 2, "findingIds": [ "F03" ], "guidanceId": "fluid-scaling", "status": "open" }, { "id": "T03", "title": "Reduce critical JS, prioritize the LCP content, and split/defer long tasks so the login task paints within the good LCP range.", "priority": 3, "findingIds": [ "F05" ], "guidanceId": "performance", "status": "open" }, { "id": "T04", "title": "Create a minimal unauthenticated bundle; defer consent-detail and authenticated-product code until requested.", "priority": 4, "findingIds": [ "F06" ], "guidanceId": "identify-heavy-scripts", "status": "open" }, { "id": "T05", "title": "Use semantic headings and controls, preserve visible :focus-visible styles, fix labels/ARIA, add meaningful alt text, and verify contrast.", "priority": 5, "findingIds": [ "F07" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T06", "title": "Server-render the essential login purpose, fields, recovery/signup links, and consent choices so the core entry task survives without JavaScript.", "priority": 6, "findingIds": [ "F09" ], "guidanceId": "stabilize-reactive-state", "status": "open" }, { "id": "T07", "title": "Declare color-scheme: light dark and theme surfaces with prefers-color-scheme or light-dark().", "priority": 7, "findingIds": [ "F01" ], "guidanceId": "dark-mode", "status": "open" }, { "id": "T08", "title": "Add a descriptive title, meta description, and accurate Open Graph metadata for the public entry page.", "priority": 8, "findingIds": [ "F08" ], "guidanceId": "html", "status": "open" }, { "id": "T09", "title": "Set an explicit strict-origin-when-cross-origin or stricter Referrer-Policy and continue reducing unsafe-inline style dependencies with hashes/nonces.", "priority": 9, "findingIds": [ "F10" ], "guidanceId": "security", "status": "open" }, { "id": "T10", "title": "Add width and height, appropriate alt or empty alt, lazy loading below fold, srcset/sizes, and AVIF/WebP variants.", "priority": 10, "findingIds": [ "F11" ], "guidanceId": "optimize-image-priority", "status": "open" }, { "id": "T11", "title": "Remove console/runtime errors and deprecated APIs, ship valid source maps, and resolve BFCache blockers.", "priority": 11, "findingIds": [ "F12" ], "guidanceId": "html", "status": "open" }, { "id": "T12", "title": "Profile dominators and remove unauthenticated code/data not needed by login or consent; remeasure in one controlled session.", "priority": 12, "findingIds": [ "F13" ], "guidanceId": "performance", "status": "open" }, { "id": "T13", "title": "Set autocomplete=\"current-password\" on the password field while retaining username webauthn on the identifier field.", "priority": 13, "findingIds": [ "F15" ], "guidanceId": "autofill-sign-in-form", "status": "open" } ], "budget": { "pathCount": 4, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-28T05-58-39-006Z" }