{ "url": "https://noor.moe.gov.sa", "auditedAt": "2026-07-22T15:40:16.306Z", "mode": "report", "status": "completed", "statusDetail": "Coverage-complete audit of the public landing page and authentication gateway. The authenticated application and external identity-provider content are excluded because credentials were not supplied.", "page": { "appType": "mpa", "framework": "ASP.NET Web Forms with Bootstrap/jQuery", "notes": "Arabic Ministry of Education landing page redirects from / through /Noor/login.aspx to /Noor/EduWaveLanding/Home.aspx; authentication gateway is a separate public template." }, "evidenceUsed": [ "screenshot", "dom", "layout-metrics", "evaluate-probe", "discoverability", "trace", "har", "headers", "cookies", "trackers", "secrets", "images", "heap-summary", "lighthouse", "curl" ], "guidanceConsulted": [ "size-aware-styling", "fluid-scaling", "css-layout", "css", "interest-triggered-tooltips", "forms", "summarizer", "language-model", "translator", "agentic-javascript-tools", "agentic-forms", "webmcp", "search-hidden-content", "accessibility", "passkey-management", "interactive-content-reveal", "schedule-tasks-by-priority", "break-up-long-tasks", "performance", "visually-stable-font-fallbacks", "visually-stable-mixed-fonts", "optimize-preload-priority", "html", "improve-text-layout-and-legibility", "precise-text-alignment", "accessible-error-announcement", "pull-to-reveal", "highlight-text-ranges", "support-global-calendar-systems", "calculate-event-differentials", "capture-location-agnostic-data", "coordinate-global-events", "calculate-with-intrinsic-sizes", "identify-heavy-scripts", "move-dom-element-without-losing-state", "detect-initial-visibility-state", "sequence-distributed-events", "faster-spa-view-transitions", "full-session-analytics", "privacy", "security", "dark-mode", "passkey-conditional-create", "passkey-authentication", "batch-analytics-events", "physics-based-easing", "stabilize-reactive-state", "resilient-context-menus-and-nested-dropdowns", "animate-to-from-top-layer", "deprioritize-background-fetches", "efficient-background-processing", "deliver-optimized-decorative-images", "resolution-optimized-pseudo-elements", "validate-input-after-interaction", "required-field-feedback", "component-specific-light-dark-theme", "autofill-payment-form", "autofill-address-form", "autofill-sign-up-form", "language-detection", "scroll-snap-realtime-feedback", "scroll-snap-state-sync", "stack-drill-down", "carousel-slide-effects", "scroll-entry-exit-effects", "directional-navigation-transitions", "same-document-transitions", "cross-document-transitions", "persistent-app-tours", "declarative-dialog-popover-control", "persistent-top-layer-ui", "defer-rendering-heavy-content", "light-dismiss-a-dialog", "position-aware-tooltips", "persistent-toast-notifications", "carousel-snap-highlights", "scrollability-affordance-hints", "scroll-position-aware-elements", "adapt-scrollbar-to-contrast-preferences", "passkey-reauthentication", "optimize-image-priority" ], "artifacts": [ { "type": "screenshot", "path": "evidence/auth-handoff.png", "caption": "auth handoff", "findingIds": [] }, { "type": "other", "path": "evidence/cookies.json", "caption": "cookies", "findingIds": [ "F23", "F24" ] }, { "type": "discoverability", "path": "evidence/discoverability", "caption": "discoverability", "findingIds": [ "F26" ] }, { "type": "screenshot", "path": "evidence/discoverability-crawler.png", "caption": "discoverability crawler", "findingIds": [] }, { "type": "screenshot", "path": "evidence/discoverability-rendered.png", "caption": "discoverability rendered", "findingIds": [] }, { "type": "other", "path": "evidence/headers.json", "caption": "headers", "findingIds": [ "F23", "F25" ] }, { "type": "heap", "path": "evidence/heap-baseline.json", "caption": "heap baseline", "findingIds": [] }, { "type": "heap", "path": "evidence/heap-post-menu.json", "caption": "heap post menu", "findingIds": [] }, { "type": "screenshot", "path": "evidence/home-dark.png", "caption": "home dark", "findingIds": [ "F01" ] }, { "type": "screenshot", "path": "evidence/home-desktop.png", "caption": "home desktop", "findingIds": [ "F01" ] }, { "type": "dom", "path": "evidence/home-dom.json", "caption": "home dom", "findingIds": [ "F05" ] }, { "type": "screenshot", "path": "evidence/home-forced-colors.png", "caption": "home forced colors", "findingIds": [] }, { "type": "layout", "path": "evidence/home-layout-mobile.json", "caption": "home layout mobile", "findingIds": [] }, { "type": "screenshot", "path": "evidence/home-mobile.png", "caption": "home mobile", "findingIds": [ "F09" ] }, { "type": "har-summary", "path": "evidence/home-summary.json", "caption": "home summary", "findingIds": [ "F13", "F14", "F17", "F24", "F29", "F30", "F31" ] }, { "type": "trace-summary", "path": "evidence/home-trace-summary.json", "caption": "home trace summary", "findingIds": [ "F12" ] }, { "type": "trace", "path": "evidence/home-trace.json", "caption": "home trace", "findingIds": [] }, { "type": "har", "path": "evidence/home.har", "caption": "home", "findingIds": [ "F13" ] }, { "type": "other", "path": "evidence/images.json", "caption": "images", "findingIds": [ "F15", "F18", "F29" ] }, { "type": "lighthouse", "path": "evidence/lighthouse-summary.json", "caption": "lighthouse summary", "findingIds": [ "F12", "F14", "F15", "F16", "F17", "F20", "F27", "F30" ] }, { "type": "lighthouse", "path": "evidence/lighthouse.json", "caption": "lighthouse", "findingIds": [ "F12" ] }, { "type": "screenshot", "path": "evidence/login-desktop.png", "caption": "login desktop", "findingIds": [] }, { "type": "dom", "path": "evidence/login-dom.json", "caption": "login dom", "findingIds": [] }, { "type": "layout", "path": "evidence/login-layout-mobile.json", "caption": "login layout mobile", "findingIds": [] }, { "type": "screenshot", "path": "evidence/login-mobile.png", "caption": "login mobile", "findingIds": [] }, { "type": "other", "path": "evidence/login-probe.json", "caption": "login probe", "findingIds": [ "F19", "F26" ] }, { "type": "other", "path": "evidence/memory-metrics.json", "caption": "memory metrics", "findingIds": [] }, { "type": "other", "path": "evidence/mobile-ui-probe.json", "caption": "mobile ui probe", "findingIds": [ "F06", "F08", "F09", "F11" ] }, { "type": "other", "path": "evidence/page-probe.json", "caption": "page probe", "findingIds": [ "F03", "F04", "F07", "F08", "F10", "F15", "F16", "F19", "F20", "F21", "F22", "F26", "F28" ] }, { "type": "other", "path": "evidence/platform-probe.json", "caption": "platform probe", "findingIds": [ "F22", "F28" ] }, { "type": "other", "path": "evidence/reduced-motion-probe.json", "caption": "reduced motion probe", "findingIds": [ "F02" ] }, { "type": "other", "path": "evidence/robots.txt", "caption": "robots", "findingIds": [ "F20", "F21", "F27" ] }, { "type": "other", "path": "evidence/secrets.json", "caption": "secrets", "findingIds": [] }, { "type": "other", "path": "evidence/sitemap.xml", "caption": "sitemap", "findingIds": [ "F21", "F27" ] }, { "type": "other", "path": "evidence/trackers.json", "caption": "trackers", "findingIds": [ "F24", "F31" ] } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 58, "blocked": 0, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": true }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "issues", "confidence": "high", "method": "Targeted browser evidence and guidance-backed review across landing/login paths", "evidence": "Desktop screenshots under light and prefers-color-scheme: dark are pixel-identical; the page remains a white/light surface.", "pathIds": [ "landing" ], "artifacts": [ "evidence/home-desktop.png", "evidence/home-dark.png" ], "findingIds": [ "F01" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "issues", "confidence": "high", "method": "Targeted browser evidence and guidance-backed review across landing/login paths", "evidence": "With prefers-reduced-motion: reduce active, the probe found two fadeInBottom animations lasting 1.75s and 2s plus two ride=carousel components.", "pathIds": [ "landing" ], "artifacts": [ "evidence/reduced-motion-probe.json" ], "findingIds": [ "F02" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "pass", "confidence": "high", "method": "Direct multi-modal inspection of representative landing and login surfaces", "evidence": "Forced-colors screenshot preserves readable text, controls, and page structure.", "pathIds": [ "landing", "login" ], "artifacts": [ "evidence/home-forced-colors.png" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "issues", "confidence": "high", "method": "Targeted browser evidence and guidance-backed review across landing/login paths", "evidence": "The DOM probe shows primary navigation as javascript:__doPostBack links and no authored transition evidence; route changes replace the document abruptly.", "pathIds": [ "landing" ], "artifacts": [ "evidence/page-probe.json" ], "findingIds": [ "F03" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "issues", "confidence": "high", "method": "Targeted browser evidence and guidance-backed review across landing/login paths", "evidence": "The page probe found zero scroll timelines; all observed motion is conventional keyframe/carousel behavior.", "pathIds": [ "landing" ], "artifacts": [ "evidence/page-probe.json" ], "findingIds": [ "F04" ] }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "issues", "confidence": "high", "method": "Targeted browser evidence and guidance-backed review across landing/login paths", "evidence": "DOM and CSS inspection found Bootstrap carousel/navigation code, no scroll timeline, and no scroll-snap or native gesture evidence on the primary surfaces.", "pathIds": [ "landing" ], "artifacts": [ "evidence/home-dom.json" ], "findingIds": [ "F05" ] }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "issues", "confidence": "high", "method": "Targeted browser evidence and guidance-backed review across landing/login paths", "evidence": "The mobile probe identifies a position-fixed header, while source inspection found no scroll-state container query or progress treatment.", "pathIds": [ "landing" ], "artifacts": [ "evidence/mobile-ui-probe.json" ], "findingIds": [ "F06" ] }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement after representative-path recon", "evidence": "No tooltip, popover, or edge-positioned menu is exposed on the two representative public surfaces.", "reason": "No tooltip, popover, or edge-positioned menu is exposed on the two representative public surfaces." }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "issues", "confidence": "high", "method": "Targeted browser evidence and guidance-backed review across landing/login paths", "evidence": "Primary section links are javascript postbacks, and no authored view transition/highlight cue was found in the DOM/CSS probe.", "pathIds": [ "landing" ], "artifacts": [ "evidence/page-probe.json" ], "findingIds": [ "F07" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "pass", "confidence": "high", "method": "Direct multi-modal inspection of representative landing and login surfaces", "evidence": "Desktop/mobile load screenshots show content immediately with no blocking interstitial.", "pathIds": [ "landing", "login" ], "artifacts": [ "evidence/home-desktop.png" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "issues", "confidence": "high", "method": "Targeted browser evidence and guidance-backed review across landing/login paths", "evidence": "DOM inspection found zero dialog, popover, or details elements while the mobile UI includes a collapsible menu and a 400px settings panel.", "pathIds": [ "landing" ], "artifacts": [ "evidence/page-probe.json", "evidence/mobile-ui-probe.json" ], "findingIds": [ "F08" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "pass", "confidence": "high", "method": "Direct multi-modal inspection of representative landing and login surfaces", "evidence": "Landing and login screenshots devote the central viewport to announcement, service explanation, and authentication choices.", "pathIds": [ "landing", "login" ], "artifacts": [ "evidence/home-desktop.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "issues", "confidence": "high", "method": "Targeted browser evidence and guidance-backed review across landing/login paths", "evidence": "The mobile screenshot shows the Arabic announcement cut off on both sides. body overflow-x:hidden masks overflow, so layout metrics report no scrollbar while content is still lost.", "pathIds": [ "landing" ], "artifacts": [ "evidence/home-mobile.png", "evidence/mobile-ui-probe.json" ], "findingIds": [ "F09" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "issues", "confidence": "high", "method": "Targeted browser evidence and guidance-backed review across landing/login paths", "evidence": "The page probe found zero container queries, while the same navigation/settings components are placed in constrained mobile containers.", "pathIds": [ "landing" ], "artifacts": [ "evidence/page-probe.json" ], "findingIds": [ "F10" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "issues", "confidence": "high", "method": "Targeted browser evidence and guidance-backed review across landing/login paths", "evidence": "The 360px probe measured the login button at 42.9px high, footer links at 34.7px, and social-icon links around 22-28px.", "pathIds": [ "landing" ], "artifacts": [ "evidence/mobile-ui-probe.json" ], "findingIds": [ "F11" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "pass", "confidence": "high", "method": "Direct multi-modal inspection of representative landing and login surfaces", "evidence": "Landing prominently labels sign-in; login page clearly offers the two national/unified identity choices.", "pathIds": [ "landing", "login" ], "artifacts": [ "evidence/login-desktop.png" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "pass", "confidence": "high", "method": "Direct multi-modal inspection of representative landing and login surfaces", "evidence": "The representative sign-in handoff was activated and navigated away from the inspected document to the selected identity provider; further completion requires user credentials.", "pathIds": [ "landing", "login" ], "artifacts": [ "evidence/login-desktop.png" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement after representative-path recon", "evidence": "The reachable public flow is a choice of external SSO providers and exposes no loading, empty, editable, or recoverable partial-completion state to exercise.", "reason": "The reachable public flow is a choice of external SSO providers and exposes no loading, empty, editable, or recoverable partial-completion state to exercise." }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "high", "method": "Targeted browser evidence and guidance-backed review across landing/login paths", "evidence": "Lighthouse measured LCP 13.3s, FCP 3.8s, Speed Index 5.2s, and performance 0.64; the independent trace measured LCP 3.71s on an unthrottled run.", "pathIds": [ "landing" ], "artifacts": [ "evidence/lighthouse.json", "evidence/lighthouse-summary.json", "evidence/home-trace-summary.json" ], "findingIds": [ "F12" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "pass", "confidence": "high", "method": "Direct multi-modal inspection of representative landing and login surfaces", "evidence": "Landing CLS was 0.0029 and login CLS 0.0828 at 360px, both below the 0.1 good threshold.", "pathIds": [ "landing", "login" ], "artifacts": [ "evidence/home-layout-mobile.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "pass", "confidence": "high", "method": "Direct multi-modal inspection of representative landing and login surfaces", "evidence": "Trace and layout observers recorded no long tasks and 0ms total blocking time; Lighthouse TBT was 10ms.", "pathIds": [ "landing", "login" ], "artifacts": [ "evidence/home-trace-summary.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "Targeted browser evidence and guidance-backed review across landing/login paths", "evidence": "HAR recorded 46 requests and 2,043,486 transferred bytes, seven very-high-priority stylesheets, three parser-blocking legacy scripts, redirects, and four large advertisement/hero images without cache headers.", "pathIds": [ "landing" ], "artifacts": [ "evidence/home.har", "evidence/home-summary.json" ], "findingIds": [ "F13" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "high", "method": "Targeted browser evidence and guidance-backed review across landing/login paths", "evidence": "Lighthouse estimates 117KiB unused JavaScript and 84KiB unused CSS; Font Awesome JS alone transfers 410,531 bytes in the HAR.", "pathIds": [ "landing" ], "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-summary.json" ], "findingIds": [ "F14" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "issues", "confidence": "high", "method": "Targeted browser evidence and guidance-backed review across landing/login paths", "evidence": "The images primitive found two images without alt; Lighthouse image-alt failed on footer imagery, and the link inventory contains multiple image/icon links with empty text.", "pathIds": [ "landing" ], "artifacts": [ "evidence/images.json", "evidence/lighthouse-summary.json", "evidence/page-probe.json" ], "findingIds": [ "F15" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "pass", "confidence": "high", "method": "Direct multi-modal inspection of representative landing and login surfaces", "evidence": "Lighthouse color-contrast audit passed and forced-colors capture remains legible.", "pathIds": [ "landing", "login" ], "artifacts": [ "evidence/lighthouse-summary.json" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "issues", "confidence": "high", "method": "Targeted browser evidence and guidance-backed review across landing/login paths", "evidence": "The DOM probe reports empty html lang/dir and no main landmark; the H1 is empty. Lighthouse failed html-has-lang and heading-order on seven H6 elements.", "pathIds": [ "landing" ], "artifacts": [ "evidence/page-probe.json", "evidence/lighthouse-summary.json" ], "findingIds": [ "F16" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "pass", "confidence": "high", "method": "Direct multi-modal inspection of representative landing and login surfaces", "evidence": "Desktop landing and both login captures use readable Arabic type, line spacing, and clear alignment; clipping is separately recorded under responsive reflow.", "pathIds": [ "landing", "login" ], "artifacts": [ "evidence/login-desktop.png" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "pass", "confidence": "high", "method": "Direct multi-modal inspection of representative landing and login surfaces", "evidence": "Both pages reflow to 360px without a document scrollbar and viewport scaling is not disabled; undersized targets are separately recorded under input modality.", "pathIds": [ "landing", "login" ], "artifacts": [ "evidence/login-mobile.png" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "issues", "confidence": "high", "method": "Targeted browser evidence and guidance-backed review across landing/login paths", "evidence": "HAR and Lighthouse console evidence report net::ERR_SSL_VERSION_OR_CIPHER_MISMATCH for rocket-loader.min.js.", "pathIds": [ "landing" ], "artifacts": [ "evidence/home-summary.json", "evidence/lighthouse-summary.json" ], "findingIds": [ "F17" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "issues", "confidence": "high", "method": "Targeted browser evidence and guidance-backed review across landing/login paths", "evidence": "The images primitive found 14 of 18 images without dimensions, 13 below-fold images not lazy-loaded, 15 legacy-format images, and six raster images without srcset.", "pathIds": [ "landing" ], "artifacts": [ "evidence/images.json" ], "findingIds": [ "F18" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "issues", "confidence": "high", "method": "Targeted browser evidence and guidance-backed review across landing/login paths", "evidence": "The DOM probe lists most navigation and login actions as javascript:__doPostBack or javascript:;, preventing normal URL semantics and graceful browser behavior.", "pathIds": [ "landing" ], "artifacts": [ "evidence/page-probe.json", "evidence/login-probe.json" ], "findingIds": [ "F19" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "pass", "confidence": "high", "method": "Direct multi-modal inspection of representative landing and login surfaces", "evidence": "DOM/discoverability evidence confirms descriptive title and meta description in raw and rendered HTML.", "pathIds": [ "landing", "login" ], "artifacts": [ "evidence/discoverability" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "issues", "confidence": "high", "method": "Targeted browser evidence and guidance-backed review across landing/login paths", "evidence": "Most internal links are javascript postbacks. Lighthouse reports 359 robots.txt errors because /robots.txt redirects to and serves an HTML page.", "pathIds": [ "landing" ], "artifacts": [ "evidence/page-probe.json", "evidence/robots.txt", "evidence/lighthouse-summary.json" ], "findingIds": [ "F20" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "issues", "confidence": "high", "method": "Targeted browser evidence and guidance-backed review across landing/login paths", "evidence": "The landing canonical points to Login.aspx?ref=noor; /robots.txt and /sitemap.xml both redirect into login HTML instead of serving their formats.", "pathIds": [ "landing" ], "artifacts": [ "evidence/page-probe.json", "evidence/robots.txt", "evidence/sitemap.xml" ], "findingIds": [ "F21" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "issues", "confidence": "high", "method": "Targeted browser evidence and guidance-backed review across landing/login paths", "evidence": "og:url, og:image, and twitter:image use https:/ with one slash; no JSON-LD was found despite the page representing a government education organization/service.", "pathIds": [ "landing" ], "artifacts": [ "evidence/page-probe.json", "evidence/platform-probe.json" ], "findingIds": [ "F22" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "issues", "confidence": "high", "method": "Targeted browser evidence and guidance-backed review across landing/login paths", "evidence": "Headers primitive found no CSP or HSTS. Cookie audit found six of seven cookies without Secure, including ASPSESSIONIDSQASRDDQ without HttpOnly, and most use SameSite=None.", "pathIds": [ "landing" ], "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ], "findingIds": [ "F23" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "issues", "confidence": "high", "method": "Targeted browser evidence and guidance-backed review across landing/login paths", "evidence": "Tracker scan found seven third-party origins including Google Analytics; HAR attributes 1,291,653 of 2,043,486 bytes to third parties and shows 400-day GA cookies.", "pathIds": [ "landing" ], "artifacts": [ "evidence/trackers.json", "evidence/cookies.json", "evidence/home-summary.json" ], "findingIds": [ "F24" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "pass", "confidence": "high", "method": "Direct multi-modal inspection of representative landing and login surfaces", "evidence": "No permission prompt appeared on load; the login page offers national identity and unified SSO rather than an exposed password-only form.", "pathIds": [ "landing", "login" ], "artifacts": [ "evidence/login-desktop.png" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "high", "method": "Targeted browser evidence and guidance-backed review across landing/login paths", "evidence": "Headers evidence reports missing clickjacking protection, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy in addition to CSP/HSTS.", "pathIds": [ "landing" ], "artifacts": [ "evidence/headers.json" ], "findingIds": [ "F25" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "issues", "confidence": "high", "method": "Targeted browser evidence and guidance-backed review across landing/login paths", "evidence": "Although raw HTML contains content, the DOM shows the core navigation and authentication controls as javascript:__doPostBack links.", "pathIds": [ "landing" ], "artifacts": [ "evidence/discoverability", "evidence/page-probe.json", "evidence/login-probe.json" ], "findingIds": [ "F26" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "pass", "confidence": "high", "method": "Direct multi-modal inspection of representative landing and login surfaces", "evidence": "Mobile menu repeated 10 times without DOM growth or a broken state; both narrow captures retain usable controls.", "pathIds": [ "landing", "login" ], "artifacts": [ "evidence/memory-metrics.json" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement after representative-path recon", "evidence": "The public landing/sign-in gateway is intrinsically online and is not presented as an installable application.", "reason": "The public landing/sign-in gateway is intrinsically online and is not presented as an installable application." }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "issues", "confidence": "high", "method": "Targeted browser evidence and guidance-backed review across landing/login paths", "evidence": "Direct requests for robots.txt and sitemap.xml both return 302 redirects into login/landing HTML; Lighthouse parses the HTML as 359 robots errors.", "pathIds": [ "landing" ], "artifacts": [ "evidence/robots.txt", "evidence/sitemap.xml", "evidence/lighthouse-summary.json" ], "findingIds": [ "F27" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "issues", "confidence": "high", "method": "Targeted browser evidence and guidance-backed review across landing/login paths", "evidence": "Landing html has no lang or dir. CSS inspection counted 9 logical-property occurrences versus 1,443 physical left/right declarations.", "pathIds": [ "landing" ], "artifacts": [ "evidence/page-probe.json", "evidence/platform-probe.json" ], "findingIds": [ "F28" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement after representative-path recon", "evidence": "The representative public pages show no dates, currencies, locale-sensitive numbers, or user-entered locale data.", "reason": "The representative public pages show no dates, currencies, locale-sensitive numbers, or user-entered locale data." }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement after representative-path recon", "evidence": "The representative public pages expose no scheduled events or time-zone-sensitive values.", "reason": "The representative public pages expose no scheduled events or time-zone-sensitive values." }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "pass", "confidence": "high", "method": "Direct multi-modal inspection of representative landing and login surfaces", "evidence": "No consent wall, confirmshaming, disguised advertising, forced continuity, or preselected commercial choice appeared on landing/login.", "pathIds": [ "landing", "login" ], "artifacts": [ "evidence/login-desktop.png" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement after representative-path recon", "evidence": "The reachable sign-in page has no authored input fields; authentication is handed to external SSO providers.", "reason": "The reachable sign-in page has no authored input fields; authentication is handed to external SSO providers." }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement after representative-path recon", "evidence": "The reachable sign-in page contains no address, payment, account, or text inputs requiring autocomplete.", "reason": "The reachable sign-in page contains no address, payment, account, or text inputs requiring autocomplete." }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement after representative-path recon", "evidence": "No commercial, subscription, cancellation, or account-management flow is publicly reachable without authentication.", "reason": "No commercial, subscription, cancellation, or account-management flow is publicly reachable without authentication." }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "issues", "confidence": "high", "method": "Targeted browser evidence and guidance-backed review across landing/login paths", "evidence": "HAR transfers 661KB of images and 506KB of fonts; image inspection found 15 legacy-format files, six missing responsive sources, and three oversized images.", "pathIds": [ "landing" ], "artifacts": [ "evidence/home-summary.json", "evidence/images.json" ], "findingIds": [ "F29" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "issues", "confidence": "high", "method": "Targeted browser evidence and guidance-backed review across landing/login paths", "evidence": "The page loads Google Analytics, AppDynamics, Font Awesome JS and a failing Rocket Loader; Lighthouse identifies 117KiB unused JS and 84KiB unused CSS.", "pathIds": [ "landing" ], "artifacts": [ "evidence/home-summary.json", "evidence/lighthouse-summary.json" ], "findingIds": [ "F30" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "issues", "confidence": "high", "method": "Targeted browser evidence and guidance-backed review across landing/login paths", "evidence": "HAR reports 13 third-party requests and 1.29MB third-party transfer, about 63% of the total; trackers include GTM/GA and AppDynamics.", "pathIds": [ "landing" ], "artifacts": [ "evidence/home-summary.json", "evidence/trackers.json" ], "findingIds": [ "F31" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement after representative-path recon", "evidence": "This conventional public information/sign-in gateway declares no agent-facing intent; the emerging WebMCP opportunity is out of scope.", "reason": "This conventional public information/sign-in gateway declares no agent-facing intent; the emerging WebMCP opportunity is out of scope." }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement after representative-path recon", "evidence": "The public landing/sign-in tasks do not require summarization or language-model inference.", "reason": "The public landing/sign-in tasks do not require summarization or language-model inference." }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "pass", "confidence": "high", "method": "Direct multi-modal inspection of representative landing and login surfaces", "evidence": "After 10 menu open/close cycles, heap self-size rose only 220,725 bytes (1.3%) and DOM nodes remained 353; this does not indicate unbounded retention.", "pathIds": [ "landing", "login" ], "artifacts": [ "evidence/heap-post-menu.json" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "pass", "confidence": "high", "method": "Direct multi-modal inspection of representative landing and login surfaces", "evidence": "Baseline heap self-size was 16.7MB with 353 live DOM elements, proportionate for this page.", "pathIds": [ "landing", "login" ], "artifacts": [ "evidence/heap-baseline.json" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "pass", "confidence": "high", "method": "Direct multi-modal inspection of representative landing and login surfaces", "evidence": "Baseline/post constructor summaries show no Detached* population and DOM nodes remained 353 after 10 cycles.", "pathIds": [ "landing", "login" ], "artifacts": [ "evidence/heap-post-menu.json" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F01", "F02" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "issues", "findingIds": [ "F03", "F04", "F05" ] }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "issues", "findingIds": [ "F06", "F07" ] }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "issues", "findingIds": [ "F08" ] }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "issues", "findingIds": [ "F09", "F10", "F11" ] }, { "principleId": "support-core-task-success", "expectation": "default", "status": "pass", "findingIds": [] }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F12", "F13", "F14" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F15", "F16" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "issues", "findingIds": [ "F17", "F18", "F19" ] }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F20", "F21", "F22" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F23", "F24", "F25" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "issues", "findingIds": [ "F26", "F27" ] }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "issues", "findingIds": [ "F28" ] }, { "principleId": "be-trustworthy", "expectation": "default", "status": "pass", "findingIds": [] }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F29", "F30", "F31" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "not-applicable", "reason": "This conventional public information/sign-in gateway declares no agent-facing intent; the emerging WebMCP opportunity is out of scope. The public landing/sign-in tasks do not require summarization or language-model inference.", "findingIds": [] }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "pass", "findingIds": [] } ], "paths": [ { "id": "landing", "description": "Public landing and content archetype: audited purpose, navigation, responsive rendering, preferences, crawlability, performance, security, sustainability, and memory; represents the publicly reachable informational sections.", "url": "https://noor.moe.gov.sa/Noor/EduWaveLanding/Home.aspx", "conditions": [ "1440x1000", "360x800", "prefers-color-scheme: dark", "prefers-reduced-motion: reduce", "forced-colors: active", "JavaScript-disabled crawler view" ], "result": "issues" }, { "id": "login", "description": "Primary sign-in journey and authentication template: audited SSO choice, narrow reflow, semantic structure, and handoff behavior up to the external identity-provider boundary.", "url": "https://noor.moe.gov.sa/Noor/Login.aspx?ref=noor", "conditions": [ "1440x1000", "360x800", "identity-provider handoff attempt" ], "result": "issues" }, { "id": "excluded-authenticated", "description": "Authenticated Noor application and identity-provider account steps were not covered because no credentials were supplied; this is outside the public-site audit boundary, not an unexecuted registered check.", "url": "https://noor.moe.gov.sa/Noor/Login.aspx?ref=noor", "conditions": [ "authentication required" ], "result": "skipped" } ], "findings": [ { "id": "F01", "severity": "medium", "confidence": "high", "principleId": "respect-user-preferences", "principleCheckId": "respects-color-scheme", "pathId": "landing", "url": "https://noor.moe.gov.sa", "summary": "The landing page ignores the system dark-color preference.", "evidence": "Desktop screenshots under light and prefers-color-scheme: dark are pixel-identical; the page remains a white/light surface.", "suggestedFix": "Declare color-scheme and derive surfaces/text from prefers-color-scheme or light-dark(), while preserving the existing manual theme control.", "guidanceId": "dark-mode", "guidanceCategory": "user-experience", "artifacts": [ "evidence/home-desktop.png", "evidence/home-dark.png" ], "effort": "small" }, { "id": "F02", "severity": "medium", "confidence": "high", "principleId": "respect-user-preferences", "principleCheckId": "respects-reduced-motion", "pathId": "landing", "url": "https://noor.moe.gov.sa", "summary": "Reduced-motion users still receive entrance motion and auto-advancing carousels.", "evidence": "With prefers-reduced-motion: reduce active, the probe found two fadeInBottom animations lasting 1.75s and 2s plus two ride=carousel components.", "suggestedFix": "Disable non-essential keyframes and auto-advance inside a prefers-reduced-motion: reduce query; retain manual carousel controls.", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "artifacts": [ "evidence/reduced-motion-probe.json" ], "effort": "small" }, { "id": "F03", "severity": "low", "confidence": "high", "principleId": "implement-natural-interactions", "principleCheckId": "view-transitions", "pathId": "landing", "url": "https://noor.moe.gov.sa", "summary": "Navigation relies on abrupt ASP.NET postbacks with no transition continuity.", "evidence": "The DOM probe shows primary navigation as javascript:__doPostBack links and no authored transition evidence; route changes replace the document abruptly.", "suggestedFix": "Use real URLs and progressive cross-document View Transitions, with a no-motion fallback.", "guidanceId": "same-document-transitions", "guidanceCategory": "user-experience", "artifacts": [ "evidence/page-probe.json" ], "effort": "medium" }, { "id": "F04", "severity": "low", "confidence": "high", "principleId": "implement-natural-interactions", "principleCheckId": "scroll-driven-animations", "pathId": "landing", "url": "https://noor.moe.gov.sa", "summary": "Scroll-related presentation does not use declarative scroll timelines.", "evidence": "The page probe found zero scroll timelines; all observed motion is conventional keyframe/carousel behavior.", "suggestedFix": "Where scroll-linked effects are retained, implement them with CSS animation-timeline rather than JavaScript scroll work.", "guidanceId": "performance", "guidanceCategory": "performance", "artifacts": [ "evidence/page-probe.json" ], "effort": "small" }, { "id": "F05", "severity": "low", "confidence": "high", "principleId": "implement-natural-interactions", "principleCheckId": "physical-gestures", "pathId": "landing", "url": "https://noor.moe.gov.sa", "summary": "Carousel and mobile navigation use legacy framework behavior rather than platform-native interaction patterns.", "evidence": "DOM and CSS inspection found Bootstrap carousel/navigation code, no scroll timeline, and no scroll-snap or native gesture evidence on the primary surfaces.", "suggestedFix": "Use scroll-snap/overscroll behavior and native controls for swipeable content, preserving keyboard controls.", "guidanceId": "css-layout", "guidanceCategory": "css", "artifacts": [ "evidence/home-dom.json" ], "effort": "medium" }, { "id": "F06", "severity": "low", "confidence": "high", "principleId": "provide-guided-navigation", "principleCheckId": "scroll-state-aware-chrome", "pathId": "landing", "url": "https://noor.moe.gov.sa", "summary": "The fixed header does not adapt to scroll position.", "evidence": "The mobile probe identifies a position-fixed header, while source inspection found no scroll-state container query or progress treatment.", "suggestedFix": "Use a scroll-state query or restrained sticky-header state to reduce chrome after scrolling.", "guidanceId": "size-aware-styling", "guidanceCategory": "css", "artifacts": [ "evidence/mobile-ui-probe.json" ], "effort": "small" }, { "id": "F07", "severity": "low", "confidence": "high", "principleId": "provide-guided-navigation", "principleCheckId": "directs-attention", "pathId": "landing", "url": "https://noor.moe.gov.sa", "summary": "Postback navigation provides no focus or visual continuity cue.", "evidence": "Primary section links are javascript postbacks, and no authored view transition/highlight cue was found in the DOM/CSS probe.", "suggestedFix": "Move focus to the new page heading and use directional transitions or target highlighting after navigation.", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "artifacts": [ "evidence/page-probe.json" ], "effort": "small" }, { "id": "F08", "severity": "medium", "confidence": "high", "principleId": "maximize-content-reduce-noise", "principleCheckId": "semantic-dismissible-primitives", "pathId": "landing", "url": "https://noor.moe.gov.sa", "summary": "The collapsible navigation and settings panel are custom/Bootstrap div structures rather than modern semantic disclosure primitives.", "evidence": "DOM inspection found zero dialog, popover, or details elements while the mobile UI includes a collapsible menu and a 400px settings panel.", "suggestedFix": "Use popover/details for transient disclosure with declarative light-dismiss and explicit accessible names.", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "artifacts": [ "evidence/page-probe.json", "evidence/mobile-ui-probe.json" ], "effort": "medium" }, { "id": "F09", "severity": "high", "confidence": "high", "principleId": "adapt-to-the-form-factor", "principleCheckId": "responsive-no-horizontal-scroll", "pathId": "landing", "url": "https://noor.moe.gov.sa", "summary": "The hero is visibly cropped on a 360px viewport.", "evidence": "The mobile screenshot shows the Arabic announcement cut off on both sides. body overflow-x:hidden masks overflow, so layout metrics report no scrollbar while content is still lost.", "suggestedFix": "Make the hero media intrinsically responsive with max-inline-size:100%, object-fit, and an uncropped mobile source/layout; do not hide overflow to conceal loss.", "guidanceId": "css-layout", "guidanceCategory": "css", "artifacts": [ "evidence/home-mobile.png", "evidence/mobile-ui-probe.json" ], "effort": "medium" }, { "id": "F10", "severity": "low", "confidence": "high", "principleId": "adapt-to-the-form-factor", "principleCheckId": "component-level-responsiveness", "pathId": "landing", "url": "https://noor.moe.gov.sa", "summary": "Components rely on global breakpoints rather than container-aware adaptation.", "evidence": "The page probe found zero container queries, while the same navigation/settings components are placed in constrained mobile containers.", "suggestedFix": "Introduce container-type and focused @container rules for reusable cards, header, and settings UI.", "guidanceId": "size-aware-styling", "guidanceCategory": "css", "artifacts": [ "evidence/page-probe.json" ], "effort": "medium" }, { "id": "F11", "severity": "medium", "confidence": "high", "principleId": "adapt-to-the-form-factor", "principleCheckId": "input-modality-aware", "pathId": "landing", "url": "https://noor.moe.gov.sa", "summary": "Several interactive targets are smaller than the recommended touch area.", "evidence": "The 360px probe measured the login button at 42.9px high, footer links at 34.7px, and social-icon links around 22-28px.", "suggestedFix": "Give all interactive targets at least a 44px hit area, preserving visible keyboard focus and spacing adjacent targets.", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "artifacts": [ "evidence/mobile-ui-probe.json" ], "effort": "small" }, { "id": "F12", "severity": "high", "confidence": "high", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "pathId": "landing", "url": "https://noor.moe.gov.sa", "summary": "Largest Contentful Paint is very slow in the mobile Lighthouse run.", "evidence": "Lighthouse measured LCP 13.3s, FCP 3.8s, Speed Index 5.2s, and performance 0.64; the independent trace measured LCP 3.71s on an unthrottled run.", "suggestedFix": "Prioritize the LCP asset, reduce redirects/render blockers, and defer non-critical scripts and below-fold media.", "guidanceId": "performance", "guidanceCategory": "performance", "artifacts": [ "evidence/lighthouse.json", "evidence/lighthouse-summary.json", "evidence/home-trace-summary.json" ], "effort": "large" }, { "id": "F13", "severity": "medium", "confidence": "high", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "pathId": "landing", "url": "https://noor.moe.gov.sa", "summary": "The 2.04MB load has a long render-blocking and poorly cached dependency path.", "evidence": "HAR recorded 46 requests and 2,043,486 transferred bytes, seven very-high-priority stylesheets, three parser-blocking legacy scripts, redirects, and four large advertisement/hero images without cache headers.", "suggestedFix": "Inline only critical CSS, defer scripts, remove redirect hops, preload the actual LCP asset, and set durable immutable caching on versioned media.", "guidanceId": "performance", "guidanceCategory": "performance", "artifacts": [ "evidence/home.har", "evidence/home-summary.json" ], "effort": "large" }, { "id": "F14", "severity": "medium", "confidence": "high", "principleId": "be-fast-and-stable", "principleCheckId": "trim-unused-and-duplicate-code", "pathId": "landing", "url": "https://noor.moe.gov.sa", "summary": "The page ships substantial unused CSS and JavaScript.", "evidence": "Lighthouse estimates 117KiB unused JavaScript and 84KiB unused CSS; Font Awesome JS alone transfers 410,531 bytes in the HAR.", "suggestedFix": "Tree-shake or replace Font Awesome, split route CSS, and load analytics/monitoring only when justified.", "guidanceId": "performance", "guidanceCategory": "performance", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-summary.json" ], "effort": "medium" }, { "id": "F15", "severity": "high", "confidence": "high", "principleId": "be-inclusive", "principleCheckId": "names-roles-labels", "pathId": "landing", "url": "https://noor.moe.gov.sa", "summary": "Meaningful images and links lack accessible alternatives.", "evidence": "The images primitive found two images without alt; Lighthouse image-alt failed on footer imagery, and the link inventory contains multiple image/icon links with empty text.", "suggestedFix": "Add accurate alt text or empty alt for decorative images, and accessible names for icon/image links.", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "artifacts": [ "evidence/images.json", "evidence/lighthouse-summary.json", "evidence/page-probe.json" ], "effort": "small" }, { "id": "F16", "severity": "high", "confidence": "high", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "pathId": "landing", "url": "https://noor.moe.gov.sa", "summary": "The landing page lacks a document language and has broken heading/landmark structure.", "evidence": "The DOM probe reports empty html lang/dir and no main landmark; the H1 is empty. Lighthouse failed html-has-lang and heading-order on seven H6 elements.", "suggestedFix": "Set html lang=\"ar\" dir=\"rtl\", provide one meaningful H1 and main landmark, and use sequential headings based on document structure.", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "artifacts": [ "evidence/page-probe.json", "evidence/lighthouse-summary.json" ], "effort": "small" }, { "id": "F17", "severity": "medium", "confidence": "high", "principleId": "follow-best-practices", "principleCheckId": "no-console-errors", "pathId": "landing", "url": "https://noor.moe.gov.sa", "summary": "A third-party Cloudflare script fails during page load.", "evidence": "HAR and Lighthouse console evidence report net::ERR_SSL_VERSION_OR_CIPHER_MISMATCH for rocket-loader.min.js.", "suggestedFix": "Remove the stale loader or serve a compatible, necessary version; keep production console/network errors at zero.", "guidanceId": "performance", "guidanceCategory": "performance", "artifacts": [ "evidence/home-summary.json", "evidence/lighthouse-summary.json" ], "effort": "small" }, { "id": "F18", "severity": "medium", "confidence": "high", "principleId": "follow-best-practices", "principleCheckId": "sound-document-and-assets", "pathId": "landing", "url": "https://noor.moe.gov.sa", "summary": "Image delivery lacks basic sizing and responsive hygiene.", "evidence": "The images primitive found 14 of 18 images without dimensions, 13 below-fold images not lazy-loaded, 15 legacy-format images, and six raster images without srcset.", "suggestedFix": "Add width/height, responsive srcset/sizes, lazy loading below the fold, and modern image formats.", "guidanceId": "optimize-image-priority", "guidanceCategory": "performance", "artifacts": [ "evidence/images.json" ], "effort": "medium" }, { "id": "F19", "severity": "medium", "confidence": "high", "principleId": "follow-best-practices", "principleCheckId": "browser-platform-hygiene", "pathId": "landing", "url": "https://noor.moe.gov.sa", "summary": "Core links depend on javascript: URLs and legacy postback wiring.", "evidence": "The DOM probe lists most navigation and login actions as javascript:__doPostBack or javascript:;, preventing normal URL semantics and graceful browser behavior.", "suggestedFix": "Render real href destinations and progressively enhance actions; retain standard open/copy/bookmark/history behavior.", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "artifacts": [ "evidence/page-probe.json", "evidence/login-probe.json" ], "effort": "large" }, { "id": "F20", "severity": "high", "confidence": "high", "principleId": "be-discoverable", "principleCheckId": "crawlable-and-mobile-friendly", "pathId": "landing", "url": "https://noor.moe.gov.sa", "summary": "Core internal links are not crawler-friendly and robots.txt is invalid.", "evidence": "Most internal links are javascript postbacks. Lighthouse reports 359 robots.txt errors because /robots.txt redirects to and serves an HTML page.", "suggestedFix": "Serve a valid text/plain robots.txt and use real href URLs for all navigable destinations.", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "artifacts": [ "evidence/page-probe.json", "evidence/robots.txt", "evidence/lighthouse-summary.json" ], "effort": "medium" }, { "id": "F21", "severity": "medium", "confidence": "high", "principleId": "be-discoverable", "principleCheckId": "canonical-and-indexing-signals", "pathId": "landing", "url": "https://noor.moe.gov.sa", "summary": "Indexing signals disagree with the public landing page.", "evidence": "The landing canonical points to Login.aspx?ref=noor; /robots.txt and /sitemap.xml both redirect into login HTML instead of serving their formats.", "suggestedFix": "Set a self-consistent canonical for the landing page and serve a valid sitemap/robots policy with successful content-type/status responses.", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "artifacts": [ "evidence/page-probe.json", "evidence/robots.txt", "evidence/sitemap.xml" ], "effort": "small" }, { "id": "F22", "severity": "medium", "confidence": "high", "principleId": "be-discoverable", "principleCheckId": "structured-and-shareable-metadata", "pathId": "landing", "url": "https://noor.moe.gov.sa", "summary": "Social metadata contains malformed URLs and no structured entity data.", "evidence": "og:url, og:image, and twitter:image use https:/ with one slash; no JSON-LD was found despite the page representing a government education organization/service.", "suggestedFix": "Correct absolute social URLs and add JSON-LD accurately describing the organization/service and visible page content.", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "artifacts": [ "evidence/page-probe.json", "evidence/platform-probe.json" ], "effort": "small" }, { "id": "F23", "severity": "critical", "confidence": "high", "principleId": "be-private-and-secure", "principleCheckId": "secure-transport-and-headers", "pathId": "landing", "url": "https://noor.moe.gov.sa", "summary": "The final document lacks core security headers and sets insecure session/tracking cookies.", "evidence": "Headers primitive found no CSP or HSTS. Cookie audit found six of seven cookies without Secure, including ASPSESSIONIDSQASRDDQ without HttpOnly, and most use SameSite=None.", "suggestedFix": "Set Secure, HttpOnly, and appropriate SameSite on session cookies; deploy HSTS and a nonce/hash-based CSP after compatibility testing.", "guidanceId": "security", "guidanceCategory": "security", "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ], "effort": "medium" }, { "id": "F24", "severity": "medium", "confidence": "high", "principleId": "be-private-and-secure", "principleCheckId": "data-minimisation-and-third-parties", "pathId": "landing", "url": "https://noor.moe.gov.sa", "summary": "Third-party analytics and monitoring dominate the transfer budget.", "evidence": "Tracker scan found seven third-party origins including Google Analytics; HAR attributes 1,291,653 of 2,043,486 bytes to third parties and shows 400-day GA cookies.", "suggestedFix": "Minimize and consent-gate analytics, shorten retention, self-host necessary assets, and remove monitoring code without demonstrated user value.", "guidanceId": "privacy", "guidanceCategory": "privacy", "artifacts": [ "evidence/trackers.json", "evidence/cookies.json", "evidence/home-summary.json" ], "effort": "medium" }, { "id": "F25", "severity": "high", "confidence": "high", "principleId": "be-private-and-secure", "principleCheckId": "defensive-browser-policies", "pathId": "landing", "url": "https://noor.moe.gov.sa", "summary": "Browser-enforced defensive policies are absent on the final page.", "evidence": "Headers evidence reports missing clickjacking protection, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy in addition to CSP/HSTS.", "suggestedFix": "Set frame-ancestors or X-Frame-Options, nosniff, strict-origin-when-cross-origin, and a least-privilege Permissions-Policy.", "guidanceId": "security", "guidanceCategory": "security", "artifacts": [ "evidence/headers.json" ], "effort": "small" }, { "id": "F26", "severity": "high", "confidence": "high", "principleId": "be-resilient", "principleCheckId": "progressive-enhancement", "pathId": "landing", "url": "https://noor.moe.gov.sa", "summary": "Primary navigation and sign-in actions do not work as links without JavaScript.", "evidence": "Although raw HTML contains content, the DOM shows the core navigation and authentication controls as javascript:__doPostBack links.", "suggestedFix": "Serve real URLs and forms first, then enhance postback/navigation behavior with JavaScript.", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "artifacts": [ "evidence/discoverability", "evidence/page-probe.json", "evidence/login-probe.json" ], "effort": "large" }, { "id": "F27", "severity": "medium", "confidence": "high", "principleId": "be-resilient", "principleCheckId": "network-and-http-failure-states", "pathId": "landing", "url": "https://noor.moe.gov.sa", "summary": "Machine-readable and missing routes are redirected into HTML rather than returning intentional failure/resource states.", "evidence": "Direct requests for robots.txt and sitemap.xml both return 302 redirects into login/landing HTML; Lighthouse parses the HTML as 359 robots errors.", "suggestedFix": "Return correct status codes and content types, and provide a useful 404/network recovery page rather than blanket redirects.", "guidanceId": "performance", "guidanceCategory": "performance", "artifacts": [ "evidence/robots.txt", "evidence/sitemap.xml", "evidence/lighthouse-summary.json" ], "effort": "medium" }, { "id": "F28", "severity": "high", "confidence": "high", "principleId": "be-internationalised", "principleCheckId": "lang-dir-and-logical-properties", "pathId": "landing", "url": "https://noor.moe.gov.sa", "summary": "The Arabic landing page does not declare language/direction and overwhelmingly uses physical CSS.", "evidence": "Landing html has no lang or dir. CSS inspection counted 9 logical-property occurrences versus 1,443 physical left/right declarations.", "suggestedFix": "Declare ar/rtl and migrate layout to logical properties so translation and bidi variants preserve reading order.", "guidanceId": "css-layout", "guidanceCategory": "css", "artifacts": [ "evidence/page-probe.json", "evidence/platform-probe.json" ], "effort": "large" }, { "id": "F29", "severity": "medium", "confidence": "high", "principleId": "be-sustainable", "principleCheckId": "optimised-assets", "pathId": "landing", "url": "https://noor.moe.gov.sa", "summary": "Media is delivered inefficiently for a mostly informational landing page.", "evidence": "HAR transfers 661KB of images and 506KB of fonts; image inspection found 15 legacy-format files, six missing responsive sources, and three oversized images.", "suggestedFix": "Use AVIF/WebP where suitable, responsive images, subset fonts, and remove duplicate logo/media downloads.", "guidanceId": "optimize-image-priority", "guidanceCategory": "performance", "artifacts": [ "evidence/home-summary.json", "evidence/images.json" ], "effort": "medium" }, { "id": "F30", "severity": "medium", "confidence": "high", "principleId": "be-sustainable", "principleCheckId": "no-wasteful-work", "pathId": "landing", "url": "https://noor.moe.gov.sa", "summary": "Non-essential analytics, monitoring, and unused framework code create avoidable work.", "evidence": "The page loads Google Analytics, AppDynamics, Font Awesome JS and a failing Rocket Loader; Lighthouse identifies 117KiB unused JS and 84KiB unused CSS.", "suggestedFix": "Remove unused libraries and defer/minimize analytics and monitoring until user value or consent requires them.", "guidanceId": "performance", "guidanceCategory": "performance", "artifacts": [ "evidence/home-summary.json", "evidence/lighthouse-summary.json" ], "effort": "medium" }, { "id": "F31", "severity": "medium", "confidence": "high", "principleId": "be-sustainable", "principleCheckId": "third-party-and-media-budget", "pathId": "landing", "url": "https://noor.moe.gov.sa", "summary": "Third-party resources consume a disproportionate share of a simple landing page.", "evidence": "HAR reports 13 third-party requests and 1.29MB third-party transfer, about 63% of the total; trackers include GTM/GA and AppDynamics.", "suggestedFix": "Adopt a third-party budget, self-host essential assets, and eliminate or defer third parties that do not support the core task.", "guidanceId": "privacy", "guidanceCategory": "privacy", "artifacts": [ "evidence/home-summary.json", "evidence/trackers.json" ], "effort": "medium" } ], "taskList": [ { "id": "T01", "title": "Secure the final document and all session cookies", "priority": 1, "findingIds": [ "F23", "F25" ], "guidanceId": "security", "status": "open" }, { "id": "T02", "title": "Repair mobile hero reflow and touch-target sizing", "priority": 2, "findingIds": [ "F09", "F11" ], "guidanceId": "css-layout", "status": "open" }, { "id": "T03", "title": "Reduce LCP by prioritizing the hero and removing blocking/unused payload", "priority": 3, "findingIds": [ "F12", "F13", "F14", "F18", "F29", "F30", "F31" ], "guidanceId": "performance", "status": "open" }, { "id": "T04", "title": "Restore Arabic document semantics, landmarks, headings, and accessible alternatives", "priority": 4, "findingIds": [ "F15", "F16", "F28" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T05", "title": "Replace javascript postbacks with real URLs and progressive forms", "priority": 5, "findingIds": [ "F03", "F07", "F19", "F20", "F26" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T06", "title": "Serve valid robots/sitemap and correct canonical/social metadata", "priority": 6, "findingIds": [ "F20", "F21", "F22" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T07", "title": "Honor dark mode and reduced motion automatically", "priority": 7, "findingIds": [ "F01", "F02" ], "guidanceId": "dark-mode", "status": "open" }, { "id": "T08", "title": "Minimize third-party tracking and monitoring", "priority": 8, "findingIds": [ "F24", "F30", "F31" ], "guidanceId": "privacy", "status": "open" }, { "id": "T09", "title": "Modernize navigation, disclosure, and component responsiveness", "priority": 9, "findingIds": [ "F04", "F05", "F06", "F08", "F10" ], "guidanceId": "size-aware-styling", "status": "open" }, { "id": "T10", "title": "Remove failing third-party loader and return intentional HTTP failure states", "priority": 10, "findingIds": [ "F17", "F27" ], "guidanceId": "performance", "status": "open" } ], "budget": { "pathCount": 2, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-22T15-40-16-306Z" }