{ "url": "https://visa.mofa.gov.sa", "auditedAt": "2026-07-22T21:27:09.990Z", "mode": "report", "status": "completed", "statusDetail": "Coverage-complete model audit of five representative public paths. Excluded: authenticated post-login workflows, real application submission requiring identity/data, PDF contents, and the external ksavisa.sa site.", "page": { "appType": "mpa", "framework": "Server-rendered MPA with jQuery 3.6, Bootstrap, Select2, and AppDynamics", "notes": "Arabic government visa portal. Core public content is server-rendered. No local target config was loaded." }, "evidenceUsed": [ "screenshot", "dom", "layout-metrics", "evaluate-probe", "axe-core", "lighthouse", "trace", "har", "discoverability", "headers", "cookies", "trackers", "images", "secrets", "heap-summary", "curl robots/sitemap", "Modern Web Guidance 0.0.172" ], "guidanceConsulted": [ "dark-mode", "component-specific-light-dark-theme", "accessibility", "adapt-scrollbar-to-contrast-preferences", "same-document-transitions", "cross-document-transitions", "group-element-transitions", "faster-spa-view-transitions", "scrollytelling", "parallax-scroll-effects", "scroll-entry-exit-effects", "carousel-slide-effects", "physics-based-easing", "individual-transform-properties", "animate-element-entry-exit", "animate-to-from-top-layer", "animate-to-intrinsic-sizes", "dynamic-sibling-animations", "interactive-content-reveal", "pull-to-reveal", "swipe-to-remove", "shrinking-header-on-scroll", "scroll-progress-indicator", "scroll-position-aware-elements", "scroll-snap-realtime-feedback", "scroll-snap-state-sync", "scroll-target-on-load", "soft-edge-content-fade", "scrollability-affordance-hints", "anchor-positioning-tab-underline", "position-aware-tooltips", "interest-triggered-tooltips", "interest-triggered-action-previews", "directional-navigation-transitions", "carousel-snap-highlights", "navigation-drawer", "stack-drill-down", "persistent-app-tours", "persistent-toast-notifications", "light-dismiss-a-dialog", "platform-controls-dismiss-dialog", "declarative-dialog-popover-control", "animated-select-picker", "branded-select-styling", "brand-consistent-forms", "custom-select-picker-layouts", "rich-media-picker", "complex-shapes", "shaped-cutouts", "overflow-clipping-control", "visually-texture-content", "apply-webgl-shaders", "interactive-content-in-3d-scenes", "highlight-text-ranges", "prevent-text-wrapping", "customize-scrollbar-color-and-thickness", "export-html-media-from-canvas", "fluid-scaling", "calculate-with-intrinsic-sizes", "css-layout", "size-aware-styling", "content-based-styling", "child-state-based-styling", "design-token-reactivity", "dynamic-sibling-styling", "form-fields-automatically-fit-contents", "improve-text-layout-and-legibility", "forms", "accessible-error-announcement", "required-field-feedback", "validate-input-after-interaction", "identify-inp-causes", "schedule-tasks-by-priority", "optimize-preload-priority", "improve-next-page-load-performance", "interactions-in-complex-layouts", "performance", "visually-stable-font-fallbacks", "break-up-long-tasks", "identify-heavy-scripts", "optimize-script-priority", "defer-rendering-heavy-content", "defer-work-until-scroll-ends", "optimize-image-priority", "conditional-async-dependencies", "expose-canvas-content-to-browser-features", "move-dom-element-without-losing-state", "precise-text-alignment", "visually-stable-mixed-fonts", "css", "html", "reduce-style-repetition", "security", "privacy", "batch-analytics-events", "full-session-analytics", "calculate-total-foreground-time", "passkeys", "passkey-registration", "passkey-authentication", "passkey-reauthentication", "passkey-conditional-create", "passkey-management", "flicker-free-client-side-ab-testing", "consistent-cross-document-transitions", "stabilize-reactive-state", "resilient-context-menus-and-nested-dropdowns", "persistent-top-layer-ui", "detect-initial-visibility-state", "sequence-distributed-events", "translator", "language-detection", "support-global-calendar-systems", "capture-location-agnostic-data", "format-human-readable-durations", "manage-recurring-intervals", "calculate-event-differentials", "coordinate-global-events", "model-partial-time-concepts", "search-hidden-content", "select-menu-interaction", "style-parent-with-has", "autofill-address-form", "autofill-payment-form", "autofill-sign-in-form", "autofill-sign-up-form", "autofill-highlight-inputs", "deliver-optimized-decorative-images", "resolution-optimized-pseudo-elements", "deprioritize-background-fetches", "efficient-background-processing", "webmcp", "agentic-forms", "agentic-javascript-tools", "language-model", "summarizer" ], "artifacts": [ { "type": "screenshot", "path": "evidence/desktop.png", "caption": "desktop", "findingIds": [ "F06", "F26" ] }, { "type": "screenshot", "path": "evidence/mobile.png", "caption": "mobile", "findingIds": [ "F06", "F26" ] }, { "type": "screenshot", "path": "evidence/dark.png", "caption": "dark", "findingIds": [ "F01" ] }, { "type": "screenshot", "path": "evidence/contrast.png", "caption": "contrast", "findingIds": [] }, { "type": "screenshot", "path": "evidence/services-visitors.png", "caption": "services visitors", "findingIds": [ "F04", "F08", "F09" ] }, { "type": "screenshot", "path": "evidence/login-individuals.png", "caption": "login individuals", "findingIds": [ "F08", "F28" ] }, { "type": "screenshot", "path": "evidence/support-mobile.png", "caption": "support mobile", "findingIds": [ "F08" ] }, { "type": "screenshot", "path": "evidence/404-mobile.png", "caption": "404 mobile", "findingIds": [] }, { "type": "layout", "path": "evidence/layout-mobile.json", "caption": "layout mobile", "findingIds": [ "F17" ] }, { "type": "layout", "path": "evidence/layout-support-mobile.json", "caption": "layout support mobile", "findingIds": [ "F17" ] }, { "type": "dom", "path": "evidence/dom.json", "caption": "dom", "findingIds": [] }, { "type": "other", "path": "evidence/probe.json", "caption": "probe", "findingIds": [ "F05", "F07", "F12", "F14", "F18", "F19", "F20", "F21", "F22", "F25", "F28" ] }, { "type": "other", "path": "evidence/platform-probe.json", "caption": "platform probe", "findingIds": [ "F01", "F03", "F04", "F05", "F09", "F10", "F16", "F17", "F25" ] }, { "type": "other", "path": "evidence/reduced-motion.json", "caption": "reduced motion", "findingIds": [ "F02" ] }, { "type": "other", "path": "evidence/axe.json", "caption": "axe", "findingIds": [ "F07", "F14", "F15", "F16", "F27" ] }, { "type": "other", "path": "evidence/form-invalid.json", "caption": "form invalid", "findingIds": [ "F27" ] }, { "type": "other", "path": "evidence/headers.json", "caption": "headers", "findingIds": [ "F23", "F24" ] }, { "type": "other", "path": "evidence/cookies.json", "caption": "cookies", "findingIds": [ "F23", "F24" ] }, { "type": "other", "path": "evidence/trackers.json", "caption": "trackers", "findingIds": [] }, { "type": "other", "path": "evidence/images.json", "caption": "images", "findingIds": [ "F18", "F29" ] }, { "type": "other", "path": "evidence/secrets.json", "caption": "secrets", "findingIds": [] }, { "type": "har", "path": "evidence/network.har", "caption": "network", "findingIds": [] }, { "type": "har-summary", "path": "evidence/network-summary.json", "caption": "network summary", "findingIds": [ "F12", "F13" ] }, { "type": "trace", "path": "evidence/load-trace.json", "caption": "load trace", "findingIds": [] }, { "type": "trace-summary", "path": "evidence/load-trace-summary.json", "caption": "load trace summary", "findingIds": [ "F11" ] }, { "type": "lighthouse", "path": "evidence/lighthouse.json", "caption": "lighthouse", "findingIds": [ "F11", "F13", "F18", "F19", "F20" ] }, { "type": "lighthouse", "path": "evidence/lighthouse-summary.json", "caption": "lighthouse summary", "findingIds": [] }, { "type": "discoverability", "path": "evidence/discoverability.json", "caption": "discoverability", "findingIds": [] }, { "type": "screenshot", "path": "evidence/discoverability-rendered.png", "caption": "discoverability rendered", "findingIds": [] }, { "type": "screenshot", "path": "evidence/discoverability-crawler.png", "caption": "discoverability crawler", "findingIds": [] }, { "type": "discoverability", "path": "evidence/discoverability-services.json", "caption": "discoverability services", "findingIds": [] }, { "type": "screenshot", "path": "evidence/discoverability-services-rendered.png", "caption": "discoverability services rendered", "findingIds": [] }, { "type": "screenshot", "path": "evidence/discoverability-services-crawler.png", "caption": "discoverability services crawler", "findingIds": [] }, { "type": "discoverability", "path": "evidence/discoverability-login.json", "caption": "discoverability login", "findingIds": [] }, { "type": "screenshot", "path": "evidence/discoverability-login-rendered.png", "caption": "discoverability login rendered", "findingIds": [] }, { "type": "screenshot", "path": "evidence/discoverability-login-crawler.png", "caption": "discoverability login crawler", "findingIds": [] }, { "type": "heap", "path": "evidence/heap-baseline.heapsnapshot", "caption": "heap baseline", "findingIds": [] }, { "type": "heap", "path": "evidence/heap-post.heapsnapshot", "caption": "heap post", "findingIds": [] }, { "type": "other", "path": "evidence/listener-growth.json", "caption": "listener growth", "findingIds": [] }, { "type": "other", "path": "evidence/robots.txt", "caption": "robots", "findingIds": [ "F20", "F21" ] }, { "type": "other", "path": "evidence/sitemap.xml", "caption": "sitemap", "findingIds": [ "F21" ] } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 58, "blocked": 0, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": true }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "issues", "confidence": "high", "method": "Targeted visual/CDP/tool evidence described in the linked finding", "evidence": "The dark-preference screenshot is visually indistinguishable from the light rendering, and the CSS probe found no prefers-color-scheme rule.", "pathIds": [ "home" ], "artifacts": [ "evidence/dark.png", "evidence/platform-probe.json" ], "findingIds": [ "F01" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "issues", "confidence": "high", "method": "Targeted visual/CDP/tool evidence described in the linked finding", "evidence": "The reduced-motion probe matched prefers-reduced-motion: reduce but still found a running animation with duration 10000 ms.", "pathIds": [ "home" ], "artifacts": [ "evidence/reduced-motion.json" ], "findingIds": [ "F02" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM/evaluate probe, or objective tool result on representative paths", "evidence": "Forced-colors screenshot preserves visible text, controls, borders, and page hierarchy.", "pathIds": [ "home" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "issues", "confidence": "high", "method": "Targeted visual/CDP/tool evidence described in the linked finding", "evidence": "The CSS probe found no view-transition usage across the inspected MPA routes.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ], "findingIds": [ "F03" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM/evaluate probe, or objective tool result on representative paths", "evidence": "No scroll-linked animation is present; CSS probe found neither scroll handlers as a UI technique nor animation-timeline, so there is no main-thread scroll animation anti-pattern on inspected paths.", "pathIds": [ "home" ] }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM/evaluate probe, or objective tool result on representative paths", "evidence": "Inspected routes use native scrolling and links; CSS/DOM probe found no custom pointer gesture system that fights platform behavior.", "pathIds": [ "home" ] }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "issues", "confidence": "high", "method": "Targeted visual/CDP/tool evidence described in the linked finding", "evidence": "The CSS probe found no scroll-state/container or scroll-timeline support while screenshots show persistent multi-row header/banner chrome.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json", "evidence/services-visitors.png" ], "findingIds": [ "F04" ] }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "issues", "confidence": "high", "method": "Targeted visual/CDP/tool evidence described in the linked finding", "evidence": "The DOM contains tooltip links and Bootstrap scripts, while the CSS probe found no anchor-name or position-anchor usage.", "pathIds": [ "home" ], "artifacts": [ "evidence/probe.json", "evidence/platform-probe.json" ], "findingIds": [ "F05" ] }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM/evaluate probe, or objective tool result on representative paths", "evidence": "Service listing visually marks the active visitor-services tab and pairs each card with a clear heading and action.", "pathIds": [ "home" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "issues", "confidence": "high", "method": "Targeted visual/CDP/tool evidence described in the linked finding", "evidence": "Desktop and mobile load screenshots show a centered promotional modal plus a bottom consent banner covering most of the first viewport.", "pathIds": [ "home" ], "artifacts": [ "evidence/desktop.png", "evidence/mobile.png" ], "findingIds": [ "F06" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "issues", "confidence": "high", "method": "Targeted visual/CDP/tool evidence described in the linked finding", "evidence": "DOM evidence found div.modal elements with role=dialog; axe reports the visible dialog has no accessible name.", "pathIds": [ "home" ], "artifacts": [ "evidence/probe.json", "evidence/axe.json" ], "findingIds": [ "F07" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "issues", "confidence": "high", "method": "Targeted visual/CDP/tool evidence described in the linked finding", "evidence": "Service, login, and support screenshots show the KSA Visa banner and bottom consent layer consuming substantial viewport area.", "pathIds": [ "home" ], "artifacts": [ "evidence/services-visitors.png", "evidence/login-individuals.png", "evidence/support-mobile.png" ], "findingIds": [ "F08" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM/evaluate probe, or objective tool result on representative paths", "evidence": "Layout metrics on home and support at 360 px report horizontalOverflowPx 0 with viewport meta present.", "pathIds": [ "home" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "issues", "confidence": "high", "method": "Targeted visual/CDP/tool evidence described in the linked finding", "evidence": "The CSS probe found no @container rules despite card/form components being reused in different page regions.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json", "evidence/services-visitors.png" ], "findingIds": [ "F09" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "issues", "confidence": "high", "method": "Targeted visual/CDP/tool evidence described in the linked finding", "evidence": "The active-control probe reports outline-style none for sampled links/fields and multiple controls at 12–41 px in one dimension.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ], "findingIds": [ "F10" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM/evaluate probe, or objective tool result on representative paths", "evidence": "Home, service-listing, login, and support screenshots present explicit Arabic headings and task-specific actions.", "pathIds": [ "home" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM/evaluate probe, or objective tool result on representative paths", "evidence": "Visitor service cards expose direct “Apply” actions and login offers both national SSO and account routes without an observed dead end before credential handoff.", "pathIds": [ "home" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM/evaluate probe, or objective tool result on representative paths", "evidence": "Empty form submission exposes required-state messages and the invalid-route screenshot presents a clear 404 explanation and recovery instruction.", "pathIds": [ "home" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "high", "method": "Targeted visual/CDP/tool evidence described in the linked finding", "evidence": "Lighthouse measured LCP 5.5 s (performance 0.73); the independent trace measured LCP 4075.66 ms and FCP 3573.56 ms.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/load-trace-summary.json" ], "findingIds": [ "F11" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM/evaluate probe, or objective tool result on representative paths", "evidence": "Layout observer measured CLS 0 on mobile home/support; Lighthouse CLS was 0.058, within the good range.", "pathIds": [ "home" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM/evaluate probe, or objective tool result on representative paths", "evidence": "Trace found one 68.24 ms long task and only 18.24 ms TBT; Lighthouse measured 0 ms TBT.", "pathIds": [ "home" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "Targeted visual/CDP/tool evidence described in the linked finding", "evidence": "HAR reports 8 parser-inserted high-priority stylesheets, synchronous classic scripts, an uncompressed 56 KB document, and missing cache headers on major assets.", "pathIds": [ "home" ], "artifacts": [ "evidence/network-summary.json", "evidence/probe.json" ], "findingIds": [ "F12" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "high", "method": "Targeted visual/CDP/tool evidence described in the linked finding", "evidence": "Lighthouse estimates 55 KiB of unused CSS; HAR shows 9 stylesheets and 12 scripts for a small landing page.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/network-summary.json" ], "findingIds": [ "F13" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "issues", "confidence": "high", "method": "Targeted visual/CDP/tool evidence described in the linked finding", "evidence": "Axe reports critical label/select-name/image-alt failures, unnamed tooltip links, and an unnamed launch dialog.", "pathIds": [ "home" ], "artifacts": [ "evidence/axe.json", "evidence/probe.json" ], "findingIds": [ "F14" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "issues", "confidence": "high", "method": "Targeted visual/CDP/tool evidence described in the linked finding", "evidence": "Axe measured ratios of 4.34:1 and 3.38:1 for normal-sized text, below the required 4.5:1.", "pathIds": [ "home" ], "artifacts": [ "evidence/axe.json" ], "findingIds": [ "F15" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "issues", "confidence": "high", "method": "Targeted visual/CDP/tool evidence described in the linked finding", "evidence": "Axe reports invalid heading order and content outside landmarks; the focus probe found no visible outline on sampled controls.", "pathIds": [ "home" ], "artifacts": [ "evidence/axe.json", "evidence/platform-probe.json" ], "findingIds": [ "F16" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM/evaluate probe, or objective tool result on representative paths", "evidence": "Representative desktop/mobile screenshots show readable Arabic text without clipping or horizontal overflow.", "pathIds": [ "home" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "issues", "confidence": "high", "method": "Targeted visual/CDP/tool evidence described in the linked finding", "evidence": "Mobile layouts have no horizontal overflow, but the modality probe measured links and help icons as small as 12×12 px and key controls below 44 px high.", "pathIds": [ "home" ], "artifacts": [ "evidence/layout-mobile.json", "evidence/layout-support-mobile.json", "evidence/platform-probe.json" ], "findingIds": [ "F17" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM/evaluate probe, or objective tool result on representative paths", "evidence": "Lighthouse errors-in-console audit scored 1 and the page completed all CDP probes without an uncaught exception.", "pathIds": [ "home" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "issues", "confidence": "high", "method": "Targeted visual/CDP/tool evidence described in the linked finding", "evidence": "DOM/Lighthouse report no HTML doctype; the image audit found all 6 images missing explicit width and height.", "pathIds": [ "home" ], "artifacts": [ "evidence/probe.json", "evidence/lighthouse.json", "evidence/images.json" ], "findingIds": [ "F18" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM/evaluate probe, or objective tool result on representative paths", "evidence": "Lighthouse deprecations audit passed; probes found no load-time permission prompt, paste blocker, or broken runtime flow.", "pathIds": [ "home" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "issues", "confidence": "high", "method": "Targeted visual/CDP/tool evidence described in the linked finding", "evidence": "DOM probe found title “منصة التأشيرات” and no meta description; representative routes reuse the same title.", "pathIds": [ "home" ], "artifacts": [ "evidence/probe.json", "evidence/lighthouse.json" ], "findingIds": [ "F19" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "issues", "confidence": "high", "method": "Targeted visual/CDP/tool evidence described in the linked finding", "evidence": "DOM probe found javascript: and # hrefs; Lighthouse crawlable-anchors and robots audits score 0, and /robots.txt returns a request-rejected HTML page.", "pathIds": [ "home" ], "artifacts": [ "evidence/probe.json", "evidence/robots.txt", "evidence/lighthouse.json" ], "findingIds": [ "F20" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "issues", "confidence": "high", "method": "Targeted visual/CDP/tool evidence described in the linked finding", "evidence": "Probe found no canonical; sitemap.xml returned an empty body and robots.txt was blocked, despite public routes returning 200.", "pathIds": [ "home" ], "artifacts": [ "evidence/probe.json", "evidence/sitemap.xml", "evidence/robots.txt" ], "findingIds": [ "F21" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "issues", "confidence": "high", "method": "Targeted visual/CDP/tool evidence described in the linked finding", "evidence": "Probe found zero JSON-LD blocks and no Open Graph metadata on the home page.", "pathIds": [ "home" ], "artifacts": [ "evidence/probe.json" ], "findingIds": [ "F22" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "issues", "confidence": "high", "method": "Targeted visual/CDP/tool evidence described in the linked finding", "evidence": "Headers primitive found no CSP, HSTS, or nosniff; cookies primitive found cw0125088f without Secure or HttpOnly.", "pathIds": [ "home" ], "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ], "findingIds": [ "F23" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM/evaluate probe, or objective tool result on representative paths", "evidence": "Tracker capture saw one third-party origin, no known trackers, and zero transferred third-party bytes; secrets scan found no exposed credentials.", "pathIds": [ "home" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM/evaluate probe, or objective tool result on representative paths", "evidence": "No permission prompt occurred on load; login path prominently supports the Saudi national unified access identity provider.", "pathIds": [ "home" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "high", "method": "Targeted visual/CDP/tool evidence described in the linked finding", "evidence": "Headers primitive found no X-Frame-Options or CSP frame-ancestors, Referrer-Policy, or Permissions-Policy; all cookies use SameSite=None.", "pathIds": [ "home" ], "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ], "findingIds": [ "F24" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM/evaluate probe, or objective tool result on representative paths", "evidence": "Discoverability runs show 100% rendered-content coverage in raw HTML for home, service, and login routes with no JS shell.", "pathIds": [ "home" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM/evaluate probe, or objective tool result on representative paths", "evidence": "Menus, cards, modal dismissal, mobile support layout, and validation states remained usable in exercised paths without clipping or runtime failure.", "pathIds": [ "home" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "not-applicable", "confidence": "medium", "method": "Recon and applicability judgement", "evidence": "This transactional government visa service is intrinsically online and has no useful offline completion mode; offline/installability is contextual. No manifest or service-worker registration was found.", "reason": "This transactional government visa service is intrinsically online and has no useful offline completion mode; offline/installability is contextual. No manifest or service-worker registration was found." }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM/evaluate probe, or objective tool result on representative paths", "evidence": "A nonexistent route produces a branded, explanatory recovery page rather than a blank shell or infinite spinner.", "pathIds": [ "home" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "issues", "confidence": "high", "method": "Targeted visual/CDP/tool evidence described in the linked finding", "evidence": "DOM has lang=ar-sa but no dir; CSS probe found no logical properties and 846 left/right declarations.", "pathIds": [ "home" ], "artifacts": [ "evidence/probe.json", "evidence/platform-probe.json" ], "findingIds": [ "F25" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "not-applicable", "confidence": "medium", "method": "Recon and applicability judgement", "evidence": "No locale-sensitive dates, currency, durations, or numeric presentation appeared in the representative public routes.", "reason": "No locale-sensitive dates, currency, durations, or numeric presentation appeared in the representative public routes." }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "not-applicable", "confidence": "medium", "method": "Recon and applicability judgement", "evidence": "No events, appointments, recurring intervals, or time-zone-sensitive data appeared in the exercised scope.", "reason": "No events, appointments, recurring intervals, or time-zone-sensitive data appeared in the exercised scope." }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "issues", "confidence": "high", "method": "Targeted visual/CDP/tool evidence described in the linked finding", "evidence": "The first viewport is blocked by a promotional modal, while the consent banner exposes only “Agree” with no equivalent reject/manage choice.", "pathIds": [ "home" ], "artifacts": [ "evidence/desktop.png", "evidence/mobile.png" ], "findingIds": [ "F26" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "issues", "confidence": "high", "method": "Targeted visual/CDP/tool evidence described in the linked finding", "evidence": "Submitting an empty lookup yields three identical “required field” messages, while no controls match :invalid and axe finds missing labels.", "pathIds": [ "home" ], "artifacts": [ "evidence/form-invalid.json", "evidence/axe.json" ], "findingIds": [ "F27" ] }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "issues", "confidence": "high", "method": "Targeted visual/CDP/tool evidence described in the linked finding", "evidence": "DOM probe found blank autocomplete values for lookup fields and autocomplete=off for CAPTCHA; inspected sign-in is a primary account path.", "pathIds": [ "home" ], "artifacts": [ "evidence/probe.json", "evidence/login-individuals.png" ], "findingIds": [ "F28" ] }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM/evaluate probe, or objective tool result on representative paths", "evidence": "No commercial commitment appears in inspected scope; account path clearly separates national SSO and legacy sign-in without a forced upsell.", "pathIds": [ "home" ] }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "issues", "confidence": "high", "method": "Targeted visual/CDP/tool evidence described in the linked finding", "evidence": "Image audit found 6/6 without dimensions, 3 without srcset, 2 legacy-format images, 2 below-fold images not lazy-loaded, and one oversized logo.", "pathIds": [ "home" ], "artifacts": [ "evidence/images.json" ], "findingIds": [ "F29" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM/evaluate probe, or objective tool result on representative paths", "evidence": "HAR is bounded at 38 requests/630 KB and trace shows only 18.24 ms TBT with no media or background polling observed.", "pathIds": [ "home" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM/evaluate probe, or objective tool result on representative paths", "evidence": "Only one zero-byte third-party request was recorded, no audio/video exists, and no autoplay media was found.", "pathIds": [ "home" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "not-applicable", "confidence": "medium", "method": "Recon and applicability judgement", "evidence": "Emerging agent tooling was judged out of scope for this public visa portal audit; conventional server-rendered forms and links remain machine-readable.", "reason": "Emerging agent tooling was judged out of scope for this public visa portal audit; conventional server-rendered forms and links remain machine-readable." }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "medium", "method": "Recon and applicability judgement", "evidence": "No summarisation, generation, or other inference task exists on the inspected public routes where on-device AI would materially improve the core journey.", "reason": "No summarisation, generation, or other inference task exists on the inspected public routes where on-device AI would materially improve the core journey." }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM/evaluate probe, or objective tool result on representative paths", "evidence": "After 10 dropdown open/close cycles, heap node count and self size decreased (148681→148404 nodes; 9,291,146→9,249,360 bytes).", "pathIds": [ "home" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM/evaluate probe, or objective tool result on representative paths", "evidence": "Baseline heap is proportionate for the page at 148681 nodes and 9.29 MB self size; DOM probe counted 270 live elements.", "pathIds": [ "home" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM/evaluate probe, or objective tool result on representative paths", "evidence": "Repeated interaction left live DOM count unchanged at 270 and listener probe delta at 0; post heap did not grow.", "pathIds": [ "home" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F01", "F02" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "issues", "findingIds": [ "F03" ] }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "issues", "findingIds": [ "F04", "F05" ] }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "issues", "findingIds": [ "F06", "F07", "F08" ] }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "issues", "findingIds": [ "F09", "F10" ] }, { "principleId": "support-core-task-success", "expectation": "default", "status": "pass" }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F11", "F12", "F13" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F14", "F15", "F16", "F17" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "issues", "findingIds": [ "F18" ] }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F19", "F20", "F21", "F22" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F23", "F24" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "pass" }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "issues", "findingIds": [ "F25" ] }, { "principleId": "be-trustworthy", "expectation": "default", "status": "issues", "findingIds": [ "F26", "F27", "F28" ] }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F29" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "not-applicable", "reason": "Emerging agent tooling was judged out of scope for this public visa portal audit; conventional server-rendered forms and links remain machine-readable. No summarisation, generation, or other inference task exists on the inspected public routes where on-device AI would materially improve the core journey." }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "pass" } ], "paths": [ { "id": "home", "description": "Public landing page, service chooser, visa-status lookup form, launch modal, and consent surface.", "url": "https://visa.mofa.gov.sa/", "conditions": [ "desktop 1440x1000", "mobile 360x800", "dark preference", "forced colors", "reduced motion", "keyboard focus" ], "result": "issues" }, { "id": "visitor-services", "description": "Representative service-listing archetype for visitor visa tasks.", "url": "https://visa.mofa.gov.sa/Home/Index2?service_type=1", "conditions": [ "desktop", "JavaScript disabled crawler view" ], "result": "issues" }, { "id": "individual-login", "description": "Representative authentication path, including national SSO and legacy account sign-in.", "url": "https://visa.mofa.gov.sa/Account/Loginindividuals", "conditions": [ "desktop", "JavaScript disabled crawler view" ], "result": "issues" }, { "id": "support", "description": "Support/content archetype and mobile layout.", "url": "https://visa.mofa.gov.sa/Home/Support", "conditions": [ "mobile 360x800" ], "result": "issues" }, { "id": "not-found", "description": "Recovery state for an invalid route.", "url": "https://visa.mofa.gov.sa/this-route-does-not-exist-audit", "conditions": [ "mobile 360x800" ], "result": "pass" } ], "findings": [ { "id": "F01", "severity": "medium", "confidence": "high", "summary": "The site does not honor the user’s dark color-scheme preference.", "evidence": "The dark-preference screenshot is visually indistinguishable from the light rendering, and the CSS probe found no prefers-color-scheme rule.", "suggestedFix": "Declare color-scheme and define preference-driven light/dark surface, text, control, and image treatments.", "effort": "medium", "pathId": "home", "url": "https://visa.mofa.gov.sa/", "principleId": "respect-user-preferences", "principleCheckId": "respects-color-scheme", "guidanceId": "dark-mode", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/dark.png", "evidence/platform-probe.json" ] }, { "id": "F02", "severity": "medium", "confidence": "high", "summary": "A non-essential 10-second animation continues under reduced motion.", "evidence": "The reduced-motion probe matched prefers-reduced-motion: reduce but still found a running animation with duration 10000 ms.", "suggestedFix": "Disable auto-advance and non-essential animation inside prefers-reduced-motion: reduce.", "effort": "small", "pathId": "home", "url": "https://visa.mofa.gov.sa/", "principleId": "respect-user-preferences", "principleCheckId": "respects-reduced-motion", "guidanceId": "accessibility", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/reduced-motion.json" ] }, { "id": "F03", "severity": "low", "confidence": "high", "summary": "Page and state changes are abrupt rather than continuity-preserving.", "evidence": "The CSS probe found no view-transition usage across the inspected MPA routes.", "suggestedFix": "Progressively add same-origin cross-document View Transitions, with reduced-motion handling.", "effort": "medium", "pathId": "home", "url": "https://visa.mofa.gov.sa/", "principleId": "implement-natural-interactions", "principleCheckId": "view-transitions", "guidanceId": "cross-document-transitions", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/platform-probe.json" ] }, { "id": "F04", "severity": "low", "confidence": "high", "summary": "The large navigation chrome does not react to scroll position.", "evidence": "The CSS probe found no scroll-state/container or scroll-timeline support while screenshots show persistent multi-row header/banner chrome.", "suggestedFix": "Use CSS scroll-state queries or a simple sticky-state treatment to reduce chrome and preserve orientation after scrolling.", "effort": "medium", "pathId": "home", "url": "https://visa.mofa.gov.sa/", "principleId": "provide-guided-navigation", "principleCheckId": "scroll-state-aware-chrome", "guidanceId": "shrinking-header-on-scroll", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/platform-probe.json", "evidence/services-visitors.png" ] }, { "id": "F05", "severity": "low", "confidence": "high", "summary": "Help tooltips rely on legacy scripted positioning rather than resilient anchored positioning.", "evidence": "The DOM contains tooltip links and Bootstrap scripts, while the CSS probe found no anchor-name or position-anchor usage.", "suggestedFix": "Use native popover plus CSS anchor positioning and position-try fallbacks for contextual help.", "effort": "medium", "pathId": "home", "url": "https://visa.mofa.gov.sa/", "principleId": "provide-guided-navigation", "principleCheckId": "anchored-positioning", "guidanceId": "position-aware-tooltips", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/probe.json", "evidence/platform-probe.json" ] }, { "id": "F06", "severity": "high", "confidence": "high", "summary": "A launch modal and consent banner obscure the primary service and lookup content on arrival.", "evidence": "Desktop and mobile load screenshots show a centered promotional modal plus a bottom consent banner covering most of the first viewport.", "suggestedFix": "Move the promotion to an inline, non-blocking notice and keep consent compact, reversible, and non-obscuring.", "effort": "small", "pathId": "home", "url": "https://visa.mofa.gov.sa/", "principleId": "maximize-content-reduce-noise", "principleCheckId": "no-intrusive-interruptions", "guidanceId": "light-dismiss-a-dialog", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/desktop.png", "evidence/mobile.png" ] }, { "id": "F07", "severity": "medium", "confidence": "high", "summary": "The launch experience uses custom Bootstrap div dialogs with incomplete semantics.", "evidence": "DOM evidence found div.modal elements with role=dialog; axe reports the visible dialog has no accessible name.", "suggestedFix": "Use a native dialog or popover as appropriate, wire an accessible name, focus management, Escape, and light-dismiss behavior.", "effort": "medium", "pathId": "home", "url": "https://visa.mofa.gov.sa/", "principleId": "maximize-content-reduce-noise", "principleCheckId": "semantic-dismissible-primitives", "guidanceId": "declarative-dialog-popover-control", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/probe.json", "evidence/axe.json" ] }, { "id": "F08", "severity": "medium", "confidence": "high", "summary": "Promotional and consent chrome displaces core content on every representative route.", "evidence": "Service, login, and support screenshots show the KSA Visa banner and bottom consent layer consuming substantial viewport area.", "suggestedFix": "Reserve the first viewport for the current task; collapse repeated promotion/consent chrome after first acknowledgement.", "effort": "small", "pathId": "home", "url": "https://visa.mofa.gov.sa/", "principleId": "maximize-content-reduce-noise", "principleCheckId": "reduced-chrome", "guidanceId": "reduce-style-repetition", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/services-visitors.png", "evidence/login-individuals.png", "evidence/support-mobile.png" ] }, { "id": "F09", "severity": "low", "confidence": "high", "summary": "Reusable cards and forms adapt only through legacy viewport styling.", "evidence": "The CSS probe found no @container rules despite card/form components being reused in different page regions.", "suggestedFix": "Give reusable components containment and size-aware container-query layouts, retaining a fallback where needed.", "effort": "medium", "pathId": "home", "url": "https://visa.mofa.gov.sa/", "principleId": "adapt-to-the-form-factor", "principleCheckId": "component-level-responsiveness", "guidanceId": "size-aware-styling", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/platform-probe.json", "evidence/services-visitors.png" ] }, { "id": "F10", "severity": "high", "confidence": "high", "summary": "Keyboard focus is not visibly indicated and several targets are undersized.", "evidence": "The active-control probe reports outline-style none for sampled links/fields and multiple controls at 12–41 px in one dimension.", "suggestedFix": "Add a strong :focus-visible treatment and enlarge interactive hit areas to at least 44×44 CSS px where practical.", "effort": "small", "pathId": "home", "url": "https://visa.mofa.gov.sa/", "principleId": "adapt-to-the-form-factor", "principleCheckId": "input-modality-aware", "guidanceId": "accessibility", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/platform-probe.json" ] }, { "id": "F11", "severity": "high", "confidence": "high", "summary": "The main page misses the good LCP range.", "evidence": "Lighthouse measured LCP 5.5 s (performance 0.73); the independent trace measured LCP 4075.66 ms and FCP 3573.56 ms.", "suggestedFix": "Prioritize the LCP resource, reduce document/server delay, and defer non-critical promotion and scripts.", "effort": "medium", "pathId": "home", "url": "https://visa.mofa.gov.sa/", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "guidanceId": "performance", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/lighthouse.json", "evidence/load-trace-summary.json" ] }, { "id": "F12", "severity": "medium", "confidence": "high", "summary": "Critical delivery is slowed by many blocking resources and weak cache/compression hygiene.", "evidence": "HAR reports 8 parser-inserted high-priority stylesheets, synchronous classic scripts, an uncompressed 56 KB document, and missing cache headers on major assets.", "suggestedFix": "Inline or consolidate critical CSS, defer non-critical scripts, compress HTML, and set durable cache headers on versioned assets.", "effort": "medium", "pathId": "home", "url": "https://visa.mofa.gov.sa/", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "guidanceId": "optimize-script-priority", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/network-summary.json", "evidence/probe.json" ] }, { "id": "F13", "severity": "low", "confidence": "high", "summary": "The page ships avoidable CSS and legacy dependency overhead.", "evidence": "Lighthouse estimates 55 KiB of unused CSS; HAR shows 9 stylesheets and 12 scripts for a small landing page.", "suggestedFix": "Remove unused rules and conditionally load validation, Select2, and route-specific scripts only where needed.", "effort": "medium", "pathId": "home", "url": "https://visa.mofa.gov.sa/", "principleId": "be-fast-and-stable", "principleCheckId": "trim-unused-and-duplicate-code", "guidanceId": "identify-heavy-scripts", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/lighthouse.json", "evidence/network-summary.json" ] }, { "id": "F14", "severity": "high", "confidence": "high", "summary": "Core lookup controls and contextual help lack accessible names.", "evidence": "Axe reports critical label/select-name/image-alt failures, unnamed tooltip links, and an unnamed launch dialog.", "suggestedFix": "Associate every field with a label, name icon-only controls, describe the CAPTCHA appropriately, and label the dialog.", "effort": "small", "pathId": "home", "url": "https://visa.mofa.gov.sa/", "principleId": "be-inclusive", "principleCheckId": "names-roles-labels", "guidanceId": "accessibility", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/axe.json", "evidence/probe.json" ] }, { "id": "F15", "severity": "medium", "confidence": "high", "summary": "Navigation and service text fail WCAG AA contrast.", "evidence": "Axe measured ratios of 4.34:1 and 3.38:1 for normal-sized text, below the required 4.5:1.", "suggestedFix": "Darken the affected purple text tokens and retest all states against their actual backgrounds.", "effort": "small", "pathId": "home", "url": "https://visa.mofa.gov.sa/", "principleId": "be-inclusive", "principleCheckId": "sufficient-contrast", "guidanceId": "accessibility", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/axe.json" ] }, { "id": "F16", "severity": "medium", "confidence": "high", "summary": "Heading, landmark, and keyboard-focus structure is incomplete.", "evidence": "Axe reports invalid heading order and content outside landmarks; the focus probe found no visible outline on sampled controls.", "suggestedFix": "Use main/nav/header/footer landmarks, correct heading order, and a consistent visible :focus-visible style.", "effort": "medium", "pathId": "home", "url": "https://visa.mofa.gov.sa/", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "guidanceId": "accessibility", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/axe.json", "evidence/platform-probe.json" ] }, { "id": "F17", "severity": "medium", "confidence": "high", "summary": "Although mobile reflow works, several interactive targets remain too small.", "evidence": "Mobile layouts have no horizontal overflow, but the modality probe measured links and help icons as small as 12×12 px and key controls below 44 px high.", "suggestedFix": "Increase target hit areas without changing visual density, and verify at 200% zoom and narrow reflow.", "effort": "small", "pathId": "home", "url": "https://visa.mofa.gov.sa/", "principleId": "be-inclusive", "principleCheckId": "zoom-reflow-targets-and-media", "guidanceId": "fluid-scaling", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/layout-mobile.json", "evidence/layout-support-mobile.json", "evidence/platform-probe.json" ] }, { "id": "F18", "severity": "medium", "confidence": "high", "summary": "The document lacks a doctype and image sizing metadata.", "evidence": "DOM/Lighthouse report no HTML doctype; the image audit found all 6 images missing explicit width and height.", "suggestedFix": "Add and intrinsic width/height or aspect-ratio for every image.", "effort": "small", "pathId": "home", "url": "https://visa.mofa.gov.sa/", "principleId": "follow-best-practices", "principleCheckId": "sound-document-and-assets", "guidanceId": "html", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/probe.json", "evidence/lighthouse.json", "evidence/images.json" ] }, { "id": "F19", "severity": "medium", "confidence": "high", "summary": "Pages use a generic title and omit meta descriptions.", "evidence": "DOM probe found title “منصة التأشيرات” and no meta description; representative routes reuse the same title.", "suggestedFix": "Give each archetype a unique descriptive title and concise Arabic/English meta description.", "effort": "small", "pathId": "home", "url": "https://visa.mofa.gov.sa/", "principleId": "be-discoverable", "principleCheckId": "title-and-description", "guidanceId": "improve-text-layout-and-legibility", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/probe.json", "evidence/lighthouse.json" ] }, { "id": "F20", "severity": "medium", "confidence": "high", "summary": "Some links are not crawlable and robots.txt is unusable.", "evidence": "DOM probe found javascript: and # hrefs; Lighthouse crawlable-anchors and robots audits score 0, and /robots.txt returns a request-rejected HTML page.", "suggestedFix": "Use real href destinations or buttons for actions and serve a valid text/plain robots.txt.", "effort": "small", "pathId": "home", "url": "https://visa.mofa.gov.sa/", "principleId": "be-discoverable", "principleCheckId": "crawlable-and-mobile-friendly", "guidanceId": "html", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/probe.json", "evidence/robots.txt", "evidence/lighthouse.json" ] }, { "id": "F21", "severity": "medium", "confidence": "high", "summary": "Canonical, sitemap, and consistent indexing signals are missing.", "evidence": "Probe found no canonical; sitemap.xml returned an empty body and robots.txt was blocked, despite public routes returning 200.", "suggestedFix": "Publish canonical links, a valid sitemap, and consistent robots/indexing policy for public pages.", "effort": "small", "pathId": "home", "url": "https://visa.mofa.gov.sa/", "principleId": "be-discoverable", "principleCheckId": "canonical-and-indexing-signals", "guidanceId": "html", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/probe.json", "evidence/sitemap.xml", "evidence/robots.txt" ] }, { "id": "F22", "severity": "low", "confidence": "high", "summary": "The public government service has no structured or social-preview metadata.", "evidence": "Probe found zero JSON-LD blocks and no Open Graph metadata on the home page.", "suggestedFix": "Add accurate Organization/WebSite/WebPage JSON-LD plus Open Graph and Twitter preview metadata.", "effort": "small", "pathId": "home", "url": "https://visa.mofa.gov.sa/", "principleId": "be-discoverable", "principleCheckId": "structured-and-shareable-metadata", "guidanceId": "html", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/probe.json" ] }, { "id": "F23", "severity": "high", "confidence": "high", "summary": "HTTPS is used, but core security headers are absent and one cookie is not Secure.", "evidence": "Headers primitive found no CSP, HSTS, or nosniff; cookies primitive found cw0125088f without Secure or HttpOnly.", "suggestedFix": "Deploy HSTS, a restrictive nonce/hash-based CSP, nosniff, and Secure/HttpOnly/SameSite cookie attributes appropriate to each cookie.", "effort": "medium", "pathId": "home", "url": "https://visa.mofa.gov.sa/", "principleId": "be-private-and-secure", "principleCheckId": "secure-transport-and-headers", "guidanceId": "security", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ] }, { "id": "F24", "severity": "high", "confidence": "high", "summary": "Browser-enforced clickjacking, referrer, and permissions defenses are not configured.", "evidence": "Headers primitive found no X-Frame-Options or CSP frame-ancestors, Referrer-Policy, or Permissions-Policy; all cookies use SameSite=None.", "suggestedFix": "Set frame-ancestors, strict referrer and permissions policies, and narrow SameSite=None to cookies that truly require cross-site use.", "effort": "medium", "pathId": "home", "url": "https://visa.mofa.gov.sa/", "principleId": "be-private-and-secure", "principleCheckId": "defensive-browser-policies", "guidanceId": "security", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ] }, { "id": "F25", "severity": "medium", "confidence": "high", "summary": "The Arabic layout does not explicitly declare direction and relies heavily on physical CSS.", "evidence": "DOM has lang=ar-sa but no dir; CSS probe found no logical properties and 846 left/right declarations.", "suggestedFix": "Set dir=rtl and migrate layout primitives to inline/block logical properties so translation and bidi content remain robust.", "effort": "medium", "pathId": "home", "url": "https://visa.mofa.gov.sa/", "principleId": "be-internationalised", "principleCheckId": "lang-dir-and-logical-properties", "guidanceId": "translator", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/probe.json", "evidence/platform-probe.json" ] }, { "id": "F26", "severity": "high", "confidence": "high", "summary": "Consent and promotional defaults are coercive.", "evidence": "The first viewport is blocked by a promotional modal, while the consent banner exposes only “Agree” with no equivalent reject/manage choice.", "suggestedFix": "Remove the forced promotion and offer equally prominent accept, reject, and manage-consent controls with an easy later reversal.", "effort": "small", "pathId": "home", "url": "https://visa.mofa.gov.sa/", "principleId": "be-trustworthy", "principleCheckId": "no-dark-patterns", "guidanceId": "custom-button-actions", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/desktop.png", "evidence/mobile.png" ] }, { "id": "F27", "severity": "medium", "confidence": "high", "summary": "Lookup validation is generic and not connected to programmatic invalid state.", "evidence": "Submitting an empty lookup yields three identical “required field” messages, while no controls match :invalid and axe finds missing labels.", "suggestedFix": "Validate after interaction, identify each field in the message, set aria-invalid, connect errors with aria-describedby, and announce a summary.", "effort": "small", "pathId": "home", "url": "https://visa.mofa.gov.sa/", "principleId": "be-trustworthy", "principleCheckId": "humane-error-handling", "guidanceId": "accessible-error-announcement", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/form-invalid.json", "evidence/axe.json" ] }, { "id": "F28", "severity": "medium", "confidence": "high", "summary": "Forms omit useful autocomplete semantics.", "evidence": "DOM probe found blank autocomplete values for lookup fields and autocomplete=off for CAPTCHA; inspected sign-in is a primary account path.", "suggestedFix": "Add correct autocomplete tokens to identity/sign-in fields and suitable inputmode tokens to numeric identifiers.", "effort": "small", "pathId": "home", "url": "https://visa.mofa.gov.sa/", "principleId": "be-trustworthy", "principleCheckId": "trustworthy-input-assistance", "guidanceId": "autofill-sign-in-form", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/probe.json", "evidence/login-individuals.png" ] }, { "id": "F29", "severity": "medium", "confidence": "high", "summary": "Image delivery lacks basic sizing and responsive optimization.", "evidence": "Image audit found 6/6 without dimensions, 3 without srcset, 2 legacy-format images, 2 below-fold images not lazy-loaded, and one oversized logo.", "suggestedFix": "Add intrinsic dimensions, responsive sources, modern formats where useful, and lazy-load non-critical below-fold imagery.", "effort": "small", "pathId": "home", "url": "https://visa.mofa.gov.sa/", "principleId": "be-sustainable", "principleCheckId": "optimised-assets", "guidanceId": "deliver-optimized-decorative-images", "guidanceCategory": "modern-web-guidance", "artifacts": [ "evidence/images.json" ] } ], "taskList": [ { "id": "T01", "title": "Move the promotion to an inline, non-blocking notice and keep consent compact, reversible, and non-obscuring.", "priority": 1, "findingIds": [ "F06" ], "guidanceId": "light-dismiss-a-dialog", "status": "open" }, { "id": "T02", "title": "Deploy HSTS, a restrictive nonce/hash-based CSP, nosniff, and Secure/HttpOnly/SameSite cookie attributes appropriate to each cookie.", "priority": 2, "findingIds": [ "F23" ], "guidanceId": "security", "status": "open" }, { "id": "T03", "title": "Associate every field with a label, name icon-only controls, describe the CAPTCHA appropriately, and label the dialog.", "priority": 3, "findingIds": [ "F14" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T04", "title": "Add a strong :focus-visible treatment and enlarge interactive hit areas to at least 44×44 CSS px where practical.", "priority": 4, "findingIds": [ "F10" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T05", "title": "Prioritize the LCP resource, reduce document/server delay, and defer non-critical promotion and scripts.", "priority": 5, "findingIds": [ "F11" ], "guidanceId": "performance", "status": "open" }, { "id": "T06", "title": "Set frame-ancestors, strict referrer and permissions policies, and narrow SameSite=None to cookies that truly require cross-site use.", "priority": 6, "findingIds": [ "F24" ], "guidanceId": "security", "status": "open" }, { "id": "T07", "title": "Remove the forced promotion and offer equally prominent accept, reject, and manage-consent controls with an easy later reversal.", "priority": 7, "findingIds": [ "F26" ], "guidanceId": "custom-button-actions", "status": "open" }, { "id": "T08", "title": "Use a native dialog or popover as appropriate, wire an accessible name, focus management, Escape, and light-dismiss behavior.", "priority": 8, "findingIds": [ "F07" ], "guidanceId": "declarative-dialog-popover-control", "status": "open" }, { "id": "T09", "title": "Inline or consolidate critical CSS, defer non-critical scripts, compress HTML, and set durable cache headers on versioned assets.", "priority": 9, "findingIds": [ "F12" ], "guidanceId": "optimize-script-priority", "status": "open" }, { "id": "T10", "title": "Use main/nav/header/footer landmarks, correct heading order, and a consistent visible :focus-visible style.", "priority": 10, "findingIds": [ "F16" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T11", "title": "Validate after interaction, identify each field in the message, set aria-invalid, connect errors with aria-describedby, and announce a summary.", "priority": 11, "findingIds": [ "F27" ], "guidanceId": "accessible-error-announcement", "status": "open" }, { "id": "T12", "title": "Darken the affected purple text tokens and retest all states against their actual backgrounds.", "priority": 12, "findingIds": [ "F15" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T13", "title": "Increase target hit areas without changing visual density, and verify at 200% zoom and narrow reflow.", "priority": 13, "findingIds": [ "F17" ], "guidanceId": "fluid-scaling", "status": "open" }, { "id": "T14", "title": "Give each archetype a unique descriptive title and concise Arabic/English meta description.", "priority": 14, "findingIds": [ "F19" ], "guidanceId": "improve-text-layout-and-legibility", "status": "open" }, { "id": "T15", "title": "Use real href destinations or buttons for actions and serve a valid text/plain robots.txt.", "priority": 15, "findingIds": [ "F20" ], "guidanceId": "html", "status": "open" }, { "id": "T16", "title": "Publish canonical links, a valid sitemap, and consistent robots/indexing policy for public pages.", "priority": 16, "findingIds": [ "F21" ], "guidanceId": "html", "status": "open" }, { "id": "T17", "title": "Set dir=rtl and migrate layout primitives to inline/block logical properties so translation and bidi content remain robust.", "priority": 17, "findingIds": [ "F25" ], "guidanceId": "translator", "status": "open" }, { "id": "T18", "title": "Add correct autocomplete tokens to identity/sign-in fields and suitable inputmode tokens to numeric identifiers.", "priority": 18, "findingIds": [ "F28" ], "guidanceId": "autofill-sign-in-form", "status": "open" }, { "id": "T19", "title": "Add intrinsic dimensions, responsive sources, modern formats where useful, and lazy-load non-critical below-fold imagery.", "priority": 19, "findingIds": [ "F29" ], "guidanceId": "deliver-optimized-decorative-images", "status": "open" }, { "id": "T20", "title": "Declare color-scheme and define preference-driven light/dark surface, text, control, and image treatments.", "priority": 20, "findingIds": [ "F01" ], "guidanceId": "dark-mode", "status": "open" }, { "id": "T21", "title": "Disable auto-advance and non-essential animation inside prefers-reduced-motion: reduce.", "priority": 21, "findingIds": [ "F02" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T22", "title": "Reserve the first viewport for the current task; collapse repeated promotion/consent chrome after first acknowledgement.", "priority": 22, "findingIds": [ "F08" ], "guidanceId": "reduce-style-repetition", "status": "open" }, { "id": "T23", "title": "Add and intrinsic width/height or aspect-ratio for every image.", "priority": 23, "findingIds": [ "F18" ], "guidanceId": "html", "status": "open" }, { "id": "T24", "title": "Give reusable components containment and size-aware container-query layouts, retaining a fallback where needed.", "priority": 24, "findingIds": [ "F09" ], "guidanceId": "size-aware-styling", "status": "open" }, { "id": "T25", "title": "Remove unused rules and conditionally load validation, Select2, and route-specific scripts only where needed.", "priority": 25, "findingIds": [ "F13" ], "guidanceId": "identify-heavy-scripts", "status": "open" }, { "id": "T26", "title": "Progressively add same-origin cross-document View Transitions, with reduced-motion handling.", "priority": 26, "findingIds": [ "F03" ], "guidanceId": "cross-document-transitions", "status": "open" }, { "id": "T27", "title": "Use CSS scroll-state queries or a simple sticky-state treatment to reduce chrome and preserve orientation after scrolling.", "priority": 27, "findingIds": [ "F04" ], "guidanceId": "shrinking-header-on-scroll", "status": "open" }, { "id": "T28", "title": "Use native popover plus CSS anchor positioning and position-try fallbacks for contextual help.", "priority": 28, "findingIds": [ "F05" ], "guidanceId": "position-aware-tooltips", "status": "open" }, { "id": "T29", "title": "Add accurate Organization/WebSite/WebPage JSON-LD plus Open Graph and Twitter preview metadata.", "priority": 29, "findingIds": [ "F22" ], "guidanceId": "html", "status": "open" } ], "budget": { "pathCount": 5, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-22T21-27-09-990Z" }