{ "url": "https://fra.xhspot.com", "auditedAt": "2026-07-22T23:39:12.826Z", "mode": "report", "status": "completed", "statusDetail": "Coverage complete. Lighthouse and one HAR attempt encountered intermittent HTTP 503; first-party trace, raw CDP probes, screenshots, DOM, axe, headers, cookies, trackers, images, discoverability, and heap evidence completed all checks.", "page": { "appType": "mpa", "framework": "unknown", "notes": "Server-rendered adult media/listing site with localized domains, public listings, category pages, detail pages, consent overlay, manifest, and service worker." }, "evidenceUsed": [ "screenshot", "dom", "evaluate-probe", "layout-metrics", "trace", "har", "discoverability", "headers", "cookies", "trackers", "images", "secrets", "axe-core", "heap-summary", "Lighthouse (attempted; HTTP 503)" ], "guidanceConsulted": [ "dark-mode", "component-specific-light-dark-theme", "adapt-scrollbar-to-contrast-preferences", "accessibility", "directional-navigation-transitions", "scroll-entry-exit-effects", "scroll-position-aware-elements", "scrollability-affordance-hints", "declarative-dialog-popover-control", "light-dismiss-a-dialog", "size-aware-styling", "forms", "schedule-tasks-by-priority", "optimize-image-priority", "optimize-preload-priority", "break-up-long-tasks", "efficient-background-processing", "html", "css", "performance", "search-hidden-content", "passkeys", "passkey-authentication", "capture-location-agnostic-data", "coordinate-global-events", "privacy", "autofill-sign-up-form", "autofill-sign-in-form", "autofill-payment-form", "deliver-optimized-decorative-images", "agentic-javascript-tools", "agentic-forms", "webmcp", "language-model", "manage-recurring-intervals", "persistent-top-layer-ui", "move-dom-element-without-losing-state", "conditional-async-dependencies", "fluid-scaling" ], "artifacts": [ { "type": "other", "path": "evidence/axe.json", "caption": "axe", "findingIds": [ "F002", "F010", "F014", "F015", "F016" ] }, { "type": "dom", "path": "evidence/categories-dom.json", "caption": "categories dom", "findingIds": [] }, { "type": "layout", "path": "evidence/categories-mobile-layout.json", "caption": "categories mobile layout", "findingIds": [ "F008", "F009" ] }, { "type": "other", "path": "evidence/categories-probe.json", "caption": "categories probe", "findingIds": [] }, { "type": "screenshot", "path": "evidence/categories.png", "caption": "categories", "findingIds": [ "F005" ] }, { "type": "other", "path": "evidence/cookies.json", "caption": "cookies", "findingIds": [ "F022" ] }, { "type": "discoverability", "path": "evidence/discoverability", "caption": "discoverability", "findingIds": [] }, { "type": "screenshot", "path": "evidence/discoverability-crawler.png", "caption": "discoverability crawler", "findingIds": [] }, { "type": "screenshot", "path": "evidence/discoverability-rendered.png", "caption": "discoverability rendered", "findingIds": [] }, { "type": "other", "path": "evidence/guidance-consulted.jsonl", "caption": "guidance consulted", "findingIds": [] }, { "type": "other", "path": "evidence/headers.json", "caption": "headers", "findingIds": [ "F022", "F024" ] }, { "type": "heap", "path": "evidence/heap-baseline", "caption": "heap baseline", "findingIds": [] }, { "type": "heap", "path": "evidence/heap-post-retry", "caption": "heap post retry", "findingIds": [] }, { "type": "screenshot", "path": "evidence/home-dark.png", "caption": "home dark", "findingIds": [] }, { "type": "screenshot", "path": "evidence/home-desktop.png", "caption": "home desktop", "findingIds": [ "F005", "F006", "F015" ] }, { "type": "dom", "path": "evidence/home-dom.json", "caption": "home dom", "findingIds": [ "F003", "F004" ] }, { "type": "layout", "path": "evidence/home-mobile-layout.json", "caption": "home mobile layout", "findingIds": [ "F007", "F008", "F009" ] }, { "type": "screenshot", "path": "evidence/home-mobile.png", "caption": "home mobile", "findingIds": [ "F004", "F007", "F008" ] }, { "type": "har-summary", "path": "evidence/home-summary.json", "caption": "home summary", "findingIds": [ "F011", "F020", "F025" ] }, { "type": "trace", "path": "evidence/home-trace", "caption": "home trace", "findingIds": [] }, { "type": "trace-summary", "path": "evidence/home-trace-summary.json", "caption": "home trace summary", "findingIds": [] }, { "type": "har", "path": "evidence/home.har", "caption": "home.har", "findingIds": [] }, { "type": "other", "path": "evidence/images.json", "caption": "images", "findingIds": [ "F012", "F018", "F026" ] }, { "type": "lighthouse", "path": "evidence/lighthouse.json", "caption": "lighthouse", "findingIds": [] }, { "type": "other", "path": "evidence/platform-memory.json", "caption": "platform memory", "findingIds": [ "F013", "F027" ] }, { "type": "other", "path": "evidence/preferences-css.json", "caption": "preferences css", "findingIds": [ "F001", "F002" ] }, { "type": "other", "path": "evidence/recon-after-consent.json", "caption": "recon after consent", "findingIds": [] }, { "type": "other", "path": "evidence/recon.json", "caption": "recon", "findingIds": [ "F006" ] }, { "type": "other", "path": "evidence/runtime-errors.json", "caption": "runtime errors", "findingIds": [] }, { "type": "other", "path": "evidence/secrets.json", "caption": "secrets", "findingIds": [] }, { "type": "other", "path": "evidence/site-files.json", "caption": "site files", "findingIds": [ "F011", "F020", "F025" ] }, { "type": "other", "path": "evidence/trackers.json", "caption": "trackers", "findingIds": [ "F013", "F023", "F027", "F028" ] }, { "type": "dom", "path": "evidence/video-detail-dom.json", "caption": "video detail dom", "findingIds": [ "F003" ] }, { "type": "other", "path": "evidence/video-detail-probe.json", "caption": "video detail probe", "findingIds": [ "F021" ] }, { "type": "screenshot", "path": "evidence/video-detail.png", "caption": "video detail", "findingIds": [ "F005" ] }, { "type": "other", "path": "evidence/video-images.json", "caption": "video images", "findingIds": [ "F012", "F018", "F026" ] }, { "type": "layout", "path": "evidence/video-mobile-layout.json", "caption": "video mobile layout", "findingIds": [ "F008", "F017", "F019" ] } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 58, "blocked": 0, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": true }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "Screenshot and preference probe show a usable dark surface and authored prefers-color-scheme rules.", "pathIds": [ "home" ], "status": "pass", "artifacts": [ "evidence/home-dark.png", "evidence/preferences-css.json" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "The preferences probe under prefers-reduced-motion: reduce found eight running shimmer-56cf2 animations, each with a 2000 ms duration.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F001" ], "artifacts": [ "evidence/preferences-css.json" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "axe-core reported 48 color-contrast nodes; the preference/CSS probe found no prefers-contrast or forced-colors rule in accessible styles.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F002" ], "artifacts": [ "evidence/axe.json", "evidence/preferences-css.json" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "DOM/CSS inspection found no authored View Transition rules on the representative listing and detail routes, and route navigation performs full abrupt swaps.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F003" ], "artifacts": [ "evidence/home-dom.json", "evidence/video-detail-dom.json" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "No scroll-linked animation or scrollytelling surface was present on the representative paths.", "status": "not-applicable", "reason": "No scroll-linked animation or scrollytelling surface was present on the representative paths." }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "No swipe, pull, drag, or snap-based primary interaction was present on the representative paths.", "status": "not-applicable", "reason": "No swipe, pull, drag, or snap-based primary interaction was present on the representative paths." }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "Screenshots show the same tall header and persistent 190 px sidebar; DOM/CSS inspection found no scroll-state-driven treatment.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F004" ], "artifacts": [ "evidence/home-mobile.png", "evidence/home-dom.json" ] }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "Visible header/sidebar navigation remained attached without clipped transient overlays on all captured paths.", "pathIds": [ "home" ], "status": "pass", "artifacts": [ "evidence/home-desktop.png", "evidence/categories.png" ] }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "Active underline, headings, and persistent category navigation clearly indicate location on listing/category paths.", "pathIds": [ "home" ], "status": "pass", "artifacts": [ "evidence/home-desktop.png", "evidence/categories.png" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "Desktop, categories, and detail screenshots all show a centered 525 px-wide consent overlay covering the page before interaction. Refuse is available, but the content remains obscured.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F005" ], "artifacts": [ "evidence/home-desktop.png", "evidence/categories.png", "evidence/video-detail.png" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "Recon found zero dialog or popover elements while the screenshot shows a modal-like blocking surface.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F006" ], "artifacts": [ "evidence/recon.json", "evidence/home-desktop.png" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "At 360 px, the 190 px sidebar plus clipped content and the full header leave roughly half the visual viewport for the feed.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F007" ], "artifacts": [ "evidence/home-mobile.png", "evidence/home-mobile-layout.json" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "Layout evidence reports 664 px horizontal overflow on both homepage and categories (scrollWidth 1024, visual viewport 360). The detail template lacks viewport meta and is scaled to 0.367.", "pathIds": [ "home", "categories", "detail" ], "status": "issues", "findingIds": [ "F008" ], "artifacts": [ "evidence/home-mobile-layout.json", "evidence/categories-mobile-layout.json", "evidence/video-mobile-layout.json", "evidence/home-mobile.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "The same desktop sidebar/content arrangement remains 1024 px wide on two narrow listing templates, clipping the content rather than adapting.", "pathIds": [ "home", "categories", "detail" ], "status": "issues", "findingIds": [ "F009" ], "artifacts": [ "evidence/home-mobile-layout.json", "evidence/categories-mobile-layout.json" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "axe-core found an aria-hidden login section containing focusable content and one nested interactive control, both of which can disrupt keyboard and assistive-technology interaction.", "pathIds": [ "home", "categories", "detail" ], "status": "issues", "findingIds": [ "F010" ], "artifacts": [ "evidence/axe.json" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "Homepage and category screenshots have descriptive H1s and immediately visible linked media/cards.", "pathIds": [ "home" ], "status": "pass", "artifacts": [ "evidence/home-desktop.png", "evidence/categories.png" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "A homepage content link resolved to a detail page with matching H1, title, creator, and primary viewing action.", "pathIds": [ "home" ], "status": "pass", "artifacts": [ "evidence/recon-after-consent.json", "evidence/video-detail-probe.json" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "HAR and direct fetch attempts received HTTP 503 responses containing only the stock nginx “Service Temporarily Unavailable” page; no retry, status, or navigation action was offered.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F011" ], "artifacts": [ "evidence/home-summary.json", "evidence/site-files.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "Trace measured FCP/LCP 1083.51 ms, TBT 116.17 ms; layout captures measured CLS 0.", "pathIds": [ "home" ], "status": "pass", "artifacts": [ "evidence/home-trace-summary.json", "evidence/home-mobile-layout.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "Homepage and category layout observers recorded CLS 0 with no shift entries.", "pathIds": [ "home" ], "status": "pass", "artifacts": [ "evidence/home-mobile-layout.json", "evidence/categories-mobile-layout.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "Trace found two long tasks, longest 157.86 ms, with 116.17 ms total blocking time, acceptable for this load.", "pathIds": [ "home" ], "status": "pass", "artifacts": [ "evidence/home-trace-summary.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "The image audit found 29/36 homepage images and 28/32 detail images without explicit dimensions, 12 oversized homepage images, and multiple below-fold images without lazy loading.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F012" ], "artifacts": [ "evidence/images.json", "evidence/video-images.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "The live tracker probe observed 139 resources from 15 origins, including 14 third-party origins and 81 requests to static-ah.xhcdn.com.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F013" ], "artifacts": [ "evidence/trackers.json", "evidence/platform-memory.json" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "axe-core found prohibited ARIA on a video span, an aria-hidden region containing focusable content, and a nested interactive control.", "pathIds": [ "home", "categories", "detail" ], "status": "issues", "findingIds": [ "F014" ], "artifacts": [ "evidence/axe.json" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "axe-core reported 48 color-contrast failures across headings, active navigation, metadata, and consent text.", "pathIds": [ "home", "categories", "detail" ], "status": "issues", "findingIds": [ "F015" ], "artifacts": [ "evidence/axe.json", "evidence/home-desktop.png" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "axe-core reported non-unique landmarks, a nested complementary landmark, seven regions outside landmarks, and focusable content inside aria-hidden UI.", "pathIds": [ "home", "categories", "detail" ], "status": "issues", "findingIds": [ "F016" ], "artifacts": [ "evidence/axe.json" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "Screenshots show readable text sizing and stable card-title wrapping, apart from separately reported contrast/reflow defects.", "pathIds": [ "home", "categories", "detail" ], "status": "pass", "artifacts": [ "evidence/home-desktop.png", "evidence/categories.png" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "The detail layout reports hasViewportMeta=false and Chrome scales a 980 px layout to 0.367 on a 360 px device.", "pathIds": [ "home", "categories", "detail" ], "status": "issues", "findingIds": [ "F017" ], "artifacts": [ "evidence/video-mobile-layout.json" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "A five-second active error/unhandledrejection observer recorded zero runtime errors after load.", "pathIds": [ "home" ], "status": "pass", "artifacts": [ "evidence/runtime-errors.json" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "Image probes found dimensions missing on 29 of 36 homepage images and 28 of 32 detail images, with 12 homepage images over twice their display width.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F018" ], "artifacts": [ "evidence/images.json", "evidence/video-images.json" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "No permission prompt appeared, Notification.permission remained default, and the representative paths completed without browser-blocking UI.", "pathIds": [ "home" ], "status": "pass", "artifacts": [ "evidence/platform-memory.json", "evidence/home-desktop.png" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "Homepage, category, and detail probes found unique descriptive titles and meta descriptions.", "pathIds": [ "home", "categories", "detail" ], "status": "pass", "artifacts": [ "evidence/home-dom.json", "evidence/categories-probe.json", "evidence/video-detail-probe.json" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "The mobile detail layout directly reports hasViewportMeta=false; the page renders as a 980 px desktop canvas scaled down.", "pathIds": [ "home", "categories", "detail" ], "status": "issues", "findingIds": [ "F019" ], "artifacts": [ "evidence/video-mobile-layout.json" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "Both in-page fetches returned HTTP 503 for /robots.txt and /sitemap.xml during the run, while the main document was otherwise reachable.", "pathIds": [ "home", "categories", "detail" ], "status": "issues", "findingIds": [ "F020" ], "artifacts": [ "evidence/site-files.json", "evidence/home-summary.json" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "The detail probe found Open Graph metadata but zero application/ld+json scripts for a page representing a video entity.", "pathIds": [ "home", "categories", "detail" ], "status": "issues", "findingIds": [ "F021" ], "artifacts": [ "evidence/video-detail-probe.json" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "CSP is only frame-ancestors self; three of four cookies were flagged insecure, including settings and x_csrf_token without Secure, and settings uses SameSite=None.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F022" ], "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "The tracker probe observed 14 third-party origins, including accounts.google.com, tsydicate.com, img.doppiocdn.com, multiple CDNs, and collection endpoints.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F023" ], "artifacts": [ "evidence/trackers.json" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "No notification permission was requested on load (permission remained default); authentication was not forced into the public browsing flow.", "pathIds": [ "home" ], "status": "pass", "artifacts": [ "evidence/platform-memory.json", "evidence/home-desktop.png" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "Headers evidence shows no X-Content-Type-Options, no Referrer-Policy, a narrow Permissions-Policy, CSP limited to frame-ancestors, and HSTS max-age of only 86400 seconds.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F024" ], "artifacts": [ "evidence/headers.json" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "Discoverability evidence found 74% raw/rendered text overlap, title/H1/description in raw HTML, and no JS shell.", "pathIds": [ "home" ], "status": "pass", "artifacts": [ "evidence/discoverability" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "Three representative routes rendered stable navigation/content without cut-off overlays after load.", "pathIds": [ "home" ], "status": "pass", "artifacts": [ "evidence/home-desktop.png", "evidence/categories.png", "evidence/video-detail.png" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "A valid manifest was fetched and an active service worker controlled the full origin scope.", "pathIds": [ "home" ], "status": "pass", "artifacts": [ "evidence/site-files.json", "evidence/platform-memory.json" ] }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "The captured 503 response is a generic server page with no explanation, retry control, or preserved site navigation.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F025" ], "artifacts": [ "evidence/home-summary.json", "evidence/site-files.json" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "The document declares lang=fr and recon exposes localized alternate-domain links for dozens of languages including RTL languages.", "pathIds": [ "home" ], "status": "pass", "artifacts": [ "evidence/recon.json" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "The audited public paths display no dates, currencies, or locale-sensitive numeric input requiring formatting.", "status": "not-applicable", "reason": "The audited public paths display no dates, currencies, or locale-sensitive numeric input requiring formatting." }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "The audited public paths expose no scheduling or time-zone-sensitive event data.", "status": "not-applicable", "reason": "The audited public paths expose no scheduling or time-zone-sensitive event data." }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "The consent surface gives Accept and Refuse equal size/prominence and provides policy links and later preference management.", "pathIds": [ "home" ], "status": "pass", "artifacts": [ "evidence/home-desktop.png", "evidence/recon-after-consent.json" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "The audited public discovery flow has no data-entry form beyond site search; account and creator forms require separate account journeys.", "status": "not-applicable", "reason": "The audited public discovery flow has no data-entry form beyond site search; account and creator forms require separate account journeys." }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "The public flow contains only search/filter text inputs, for which address, payment, sign-in, or sign-up autocomplete tokens do not apply.", "status": "not-applicable", "reason": "The public flow contains only search/filter text inputs, for which address, payment, sign-in, or sign-up autocomplete tokens do not apply." }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "Checkout, subscription management, and account controls were outside the unauthenticated representative paths and were not invoked.", "status": "not-applicable", "reason": "Checkout, subscription management, and account controls were outside the unauthenticated representative paths and were not invoked." }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "The homepage image probe found 12 oversized images and 17 legacy-format resources; detail found two oversized and 18 legacy-format resources.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F026" ], "artifacts": [ "evidence/images.json", "evidence/video-images.json" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "The page recorded 139 resource entries and 14 third-party origins before user interaction, with one CDN alone receiving 81 requests.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F027" ], "artifacts": [ "evidence/platform-memory.json", "evidence/trackers.json" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "Fourteen third-party origins are contacted during initial load, before the user selects a media item; this adds connection and processing overhead.", "pathIds": [ "home" ], "status": "issues", "findingIds": [ "F028" ], "artifacts": [ "evidence/trackers.json" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "No declared intent or visible agent-facing capability exists; this emerging contextual capability is not expected for the public media-browsing surface.", "status": "not-applicable", "reason": "No declared intent or visible agent-facing capability exists; this emerging contextual capability is not expected for the public media-browsing surface." }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "No user task on the audited paths requires on-device inference, and no developer intent indicates it should be provided.", "status": "not-applicable", "reason": "No user task on the audited paths requires on-device inference, and no developer intent indicates it should be provided." }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "Baseline versus post-interaction heap summaries changed from 33.77 MB to 35.76 MB after ten player toggles; growth was modest (5.9%) and no Detached constructor entered top retained classes.", "pathIds": [ "home" ], "status": "pass", "artifacts": [ "evidence/heap-baseline", "evidence/heap-post-retry" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "Live metrics reported 22.8 MB used JS heap and 1,804 DOM elements; heap summary was 33.77 MB, proportionate to a media listing/detail app.", "pathIds": [ "home" ], "status": "pass", "artifacts": [ "evidence/platform-memory.json", "evidence/heap-baseline" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "confidence": "high", "method": "Active browser evidence inspection", "evidence": "Before/after heap summaries showed no Detached constructor among top retained classes after ten repeated toggles.", "pathIds": [ "home" ], "status": "pass", "artifacts": [ "evidence/heap-baseline", "evidence/heap-post-retry" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F001", "F002" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "issues", "findingIds": [ "F003" ] }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "issues", "findingIds": [ "F004" ] }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "issues", "findingIds": [ "F005", "F006", "F007" ] }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "issues", "findingIds": [ "F008", "F009", "F010" ] }, { "principleId": "support-core-task-success", "expectation": "default", "status": "issues", "findingIds": [ "F011" ] }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F012", "F013" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F014", "F015", "F016", "F017" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "issues", "findingIds": [ "F018" ] }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F019", "F020", "F021" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F022", "F023", "F024" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "issues", "findingIds": [ "F025" ] }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "pass" }, { "principleId": "be-trustworthy", "expectation": "default", "status": "pass" }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F026", "F027", "F028" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "not-applicable", "reason": "No declared intent or visible agent-facing capability exists; this emerging contextual capability is not expected for the public media-browsing surface. No user task on the audited paths requires on-device inference, and no developer intent indicates it should be provided." }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "pass" } ], "paths": [ { "id": "home", "description": "Homepage/listing archetype and public content-discovery entry point; tested desktop, dark/reduced/contrast preferences, narrow mobile, performance, security, privacy, resilience, discoverability, and accessibility.", "url": "https://fra.xhspot.com/", "conditions": [ "desktop load", "prefers-color-scheme: dark", "prefers-reduced-motion: reduce", "prefers-contrast: more", "viewport: 360x800", "no-JavaScript crawler comparison" ], "result": "issues" }, { "id": "categories", "description": "Category index archetype, representing dense taxonomy/listing pages and localized navigation.", "url": "https://fra.xhspot.com/categories", "conditions": [ "desktop load", "viewport: 360x800" ], "result": "issues" }, { "id": "detail", "description": "Representative public video-detail archetype reached from the homepage, covering content metadata, primary viewing action, media assets, mobile behavior, and repeated interaction memory.", "url": "https://fra.xhspot.com/videos/kissing-lessons-stepmom-stepdaughter-xh3KysQ", "conditions": [ "desktop load", "viewport: 360x800", "ten repeated player toggles" ], "result": "issues" }, { "id": "excluded-auth", "description": "Authenticated watch history, subscriptions, creator upload, checkout, and account-management flows were not covered because they require account state and potentially consequential actions.", "conditions": [ "unauthenticated audit" ], "result": "skipped" } ], "findings": [ { "id": "F001", "severity": "medium", "confidence": "high", "summary": "Loading shimmer animations continue when reduced motion is requested", "evidence": "The preferences probe under prefers-reduced-motion: reduce found eight running shimmer-56cf2 animations, each with a 2000 ms duration.", "suggestedFix": "Disable non-essential shimmer and transition animations inside @media (prefers-reduced-motion: reduce).", "effort": "small", "pathId": "home", "url": "https://fra.xhspot.com/", "principleId": "respect-user-preferences", "principleCheckId": "respects-reduced-motion", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "artifacts": [ "evidence/preferences-css.json" ] }, { "id": "F002", "severity": "low", "confidence": "high", "summary": "The default palette has widespread contrast failures and no observed contrast-specific adaptation", "evidence": "axe-core reported 48 color-contrast nodes; the preference/CSS probe found no prefers-contrast or forced-colors rule in accessible styles.", "suggestedFix": "Correct the failing color pairs and add forced-colors/prefers-contrast adaptations for essential controls.", "effort": "medium", "pathId": "home", "url": "https://fra.xhspot.com/", "principleId": "respect-user-preferences", "principleCheckId": "respects-contrast", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "artifacts": [ "evidence/axe.json", "evidence/preferences-css.json" ] }, { "id": "F003", "severity": "low", "confidence": "high", "summary": "Navigation changes are abrupt and do not use View Transitions", "evidence": "DOM/CSS inspection found no authored View Transition rules on the representative listing and detail routes, and route navigation performs full abrupt swaps.", "suggestedFix": "Add progressive cross-document View Transitions for listing-to-detail navigation, with reduced-motion fallbacks.", "effort": "medium", "pathId": "home", "url": "https://fra.xhspot.com/", "principleId": "implement-natural-interactions", "principleCheckId": "view-transitions", "guidanceId": "directional-navigation-transitions", "guidanceCategory": "user-experience", "artifacts": [ "evidence/home-dom.json", "evidence/video-detail-dom.json" ] }, { "id": "F004", "severity": "low", "confidence": "high", "summary": "The large fixed navigation chrome does not adapt as users scroll", "evidence": "Screenshots show the same tall header and persistent 190 px sidebar; DOM/CSS inspection found no scroll-state-driven treatment.", "suggestedFix": "Use scroll-state queries to compact or reveal persistent chrome according to scroll position.", "effort": "medium", "pathId": "home", "url": "https://fra.xhspot.com/", "principleId": "provide-guided-navigation", "principleCheckId": "scroll-state-aware-chrome", "guidanceId": "scroll-position-aware-elements", "guidanceCategory": "user-experience", "artifacts": [ "evidence/home-mobile.png", "evidence/home-dom.json" ] }, { "id": "F005", "severity": "medium", "confidence": "high", "summary": "A consent interstitial obscures the primary content on every fresh load", "evidence": "Desktop, categories, and detail screenshots all show a centered 525 px-wide consent overlay covering the page before interaction. Refuse is available, but the content remains obscured.", "suggestedFix": "Keep equal accept/refuse controls but present consent in a compact non-obscuring surface where legally possible.", "effort": "medium", "pathId": "home", "url": "https://fra.xhspot.com/", "principleId": "maximize-content-reduce-noise", "principleCheckId": "no-intrusive-interruptions", "guidanceId": "light-dismiss-a-dialog", "guidanceCategory": "user-experience", "artifacts": [ "evidence/home-desktop.png", "evidence/categories.png", "evidence/video-detail.png" ] }, { "id": "F006", "severity": "medium", "confidence": "high", "summary": "The blocking consent overlay is not exposed as a native dialog", "evidence": "Recon found zero dialog or popover elements while the screenshot shows a modal-like blocking surface.", "suggestedFix": "Implement the consent flow with a native and declarative dismissal/focus behavior.", "effort": "small", "pathId": "home", "url": "https://fra.xhspot.com/", "principleId": "maximize-content-reduce-noise", "principleCheckId": "semantic-dismissible-primitives", "guidanceId": "declarative-dialog-popover-control", "guidanceCategory": "user-experience", "artifacts": [ "evidence/recon.json", "evidence/home-desktop.png" ] }, { "id": "F007", "severity": "high", "confidence": "high", "summary": "Persistent desktop chrome crowds out content on a narrow viewport", "evidence": "At 360 px, the 190 px sidebar plus clipped content and the full header leave roughly half the visual viewport for the feed.", "suggestedFix": "Replace the desktop sidebar with compact mobile navigation and prioritize the content column.", "effort": "large", "pathId": "home", "url": "https://fra.xhspot.com/", "principleId": "maximize-content-reduce-noise", "principleCheckId": "reduced-chrome", "guidanceId": "size-aware-styling", "guidanceCategory": "user-experience", "artifacts": [ "evidence/home-mobile.png", "evidence/home-mobile-layout.json" ] }, { "id": "F008", "severity": "critical", "confidence": "high", "summary": "Homepage and category templates force a 1024 px desktop layout into a 360 px viewport", "evidence": "Layout evidence reports 664 px horizontal overflow on both homepage and categories (scrollWidth 1024, visual viewport 360). The detail template lacks viewport meta and is scaled to 0.367.", "suggestedFix": "Use width=device-width on every template, remove fixed desktop minimum widths, and reflow navigation/cards at narrow sizes.", "effort": "large", "pathId": "home", "url": "https://fra.xhspot.com/", "principleId": "adapt-to-the-form-factor", "principleCheckId": "responsive-no-horizontal-scroll", "guidanceId": "size-aware-styling", "guidanceCategory": "user-experience", "artifacts": [ "evidence/home-mobile-layout.json", "evidence/categories-mobile-layout.json", "evidence/video-mobile-layout.json", "evidence/home-mobile.png" ] }, { "id": "F009", "severity": "high", "confidence": "high", "summary": "Reused listing/navigation components do not adapt to their available container", "evidence": "The same desktop sidebar/content arrangement remains 1024 px wide on two narrow listing templates, clipping the content rather than adapting.", "suggestedFix": "Give reusable navigation and card-grid components container-query breakpoints and intrinsic sizing.", "effort": "large", "pathId": "home", "url": "https://fra.xhspot.com/", "principleId": "adapt-to-the-form-factor", "principleCheckId": "component-level-responsiveness", "guidanceId": "size-aware-styling", "guidanceCategory": "user-experience", "artifacts": [ "evidence/home-mobile-layout.json", "evidence/categories-mobile-layout.json" ] }, { "id": "F010", "severity": "medium", "confidence": "high", "summary": "Keyboard semantics and focus containment have serious defects", "evidence": "axe-core found an aria-hidden login section containing focusable content and one nested interactive control, both of which can disrupt keyboard and assistive-technology interaction.", "suggestedFix": "Remove hidden descendants from the tab order, avoid nested controls, and verify visible :focus-visible states.", "effort": "small", "pathId": "home", "url": "https://fra.xhspot.com/", "principleId": "adapt-to-the-form-factor", "principleCheckId": "input-modality-aware", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "artifacts": [ "evidence/axe.json" ] }, { "id": "F011", "severity": "high", "confidence": "high", "summary": "Server failures expose a generic dead end with no recovery action", "evidence": "HAR and direct fetch attempts received HTTP 503 responses containing only the stock nginx “Service Temporarily Unavailable” page; no retry, status, or navigation action was offered.", "suggestedFix": "Serve a branded, accessible 503 state with retry, status information, and safe navigation back to available content.", "effort": "medium", "pathId": "home", "url": "https://fra.xhspot.com/", "principleId": "support-core-task-success", "principleCheckId": "clear-system-state-and-recovery", "guidanceId": "forms", "guidanceCategory": "forms", "artifacts": [ "evidence/home-summary.json", "evidence/site-files.json" ] }, { "id": "F012", "severity": "medium", "confidence": "high", "summary": "Image delivery is inefficient across listing and detail templates", "evidence": "The image audit found 29/36 homepage images and 28/32 detail images without explicit dimensions, 12 oversized homepage images, and multiple below-fold images without lazy loading.", "suggestedFix": "Reserve dimensions, select right-sized responsive sources, lazy-load below-fold media, and prioritize only the LCP candidate.", "effort": "medium", "pathId": "home", "url": "https://fra.xhspot.com/", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "guidanceId": "optimize-image-priority", "guidanceCategory": "performance", "artifacts": [ "evidence/images.json", "evidence/video-images.json" ] }, { "id": "F013", "severity": "medium", "confidence": "high", "summary": "A large third-party/request surface is loaded for the initial experience", "evidence": "The live tracker probe observed 139 resources from 15 origins, including 14 third-party origins and 81 requests to static-ah.xhcdn.com.", "suggestedFix": "Audit initial-route dependencies, remove duplicate/nonessential integrations, and conditionally load third-party features on demand.", "effort": "large", "pathId": "home", "url": "https://fra.xhspot.com/", "principleId": "be-fast-and-stable", "principleCheckId": "trim-unused-and-duplicate-code", "guidanceId": "conditional-async-dependencies", "guidanceCategory": "performance", "artifacts": [ "evidence/trackers.json", "evidence/platform-memory.json" ] }, { "id": "F014", "severity": "high", "confidence": "high", "summary": "ARIA role/name semantics contain serious violations", "evidence": "axe-core found prohibited ARIA on a video span, an aria-hidden region containing focusable content, and a nested interactive control.", "suggestedFix": "Use native elements and valid ARIA, remove focusable descendants from aria-hidden content, and unnest interactive controls.", "effort": "small", "pathId": "home", "url": "https://fra.xhspot.com/", "principleId": "be-inclusive", "principleCheckId": "names-roles-labels", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "artifacts": [ "evidence/axe.json" ] }, { "id": "F015", "severity": "high", "confidence": "high", "summary": "Text and controls fail WCAG AA contrast at scale", "evidence": "axe-core reported 48 color-contrast failures across headings, active navigation, metadata, and consent text.", "suggestedFix": "Adjust foreground/background tokens to meet WCAG AA in every state, then rerun axe and visual checks.", "effort": "medium", "pathId": "home", "url": "https://fra.xhspot.com/", "principleId": "be-inclusive", "principleCheckId": "sufficient-contrast", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "artifacts": [ "evidence/axe.json", "evidence/home-desktop.png" ] }, { "id": "F016", "severity": "medium", "confidence": "high", "summary": "Landmark and focus structure is not robust", "evidence": "axe-core reported non-unique landmarks, a nested complementary landmark, seven regions outside landmarks, and focusable content inside aria-hidden UI.", "suggestedFix": "Use unique labelled landmarks, keep asides top-level, contain content in landmarks, and repair hidden focus handling.", "effort": "medium", "pathId": "home", "url": "https://fra.xhspot.com/", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "artifacts": [ "evidence/axe.json" ] }, { "id": "F017", "severity": "high", "confidence": "high", "summary": "The detail page prevents proper mobile reflow by omitting viewport metadata", "evidence": "The detail layout reports hasViewportMeta=false and Chrome scales a 980 px layout to 0.367 on a 360 px device.", "suggestedFix": "Add width=device-width, initial-scale=1 to every template and ensure content reflows at 320 CSS px and zoom.", "effort": "small", "pathId": "detail", "url": "https://fra.xhspot.com/videos/kissing-lessons-stepmom-stepdaughter-xh3KysQ", "principleId": "be-inclusive", "principleCheckId": "zoom-reflow-targets-and-media", "guidanceId": "fluid-scaling", "guidanceCategory": "user-experience", "artifacts": [ "evidence/video-mobile-layout.json" ] }, { "id": "F018", "severity": "medium", "confidence": "high", "summary": "Most content images omit intrinsic dimensions and several are oversized", "evidence": "Image probes found dimensions missing on 29 of 36 homepage images and 28 of 32 detail images, with 12 homepage images over twice their display width.", "suggestedFix": "Emit width/height or aspect-ratio and correctly sized responsive image candidates.", "effort": "medium", "pathId": "home", "url": "https://fra.xhspot.com/", "principleId": "follow-best-practices", "principleCheckId": "sound-document-and-assets", "guidanceId": "html", "guidanceCategory": "html", "artifacts": [ "evidence/images.json", "evidence/video-images.json" ] }, { "id": "F019", "severity": "high", "confidence": "high", "summary": "The public video-detail template has no viewport meta tag", "evidence": "The mobile detail layout directly reports hasViewportMeta=false; the page renders as a 980 px desktop canvas scaled down.", "suggestedFix": "Add a viewport meta tag to the shared detail-page head and verify mobile rendering.", "effort": "small", "pathId": "detail", "url": "https://fra.xhspot.com/videos/kissing-lessons-stepmom-stepdaughter-xh3KysQ", "principleId": "be-discoverable", "principleCheckId": "crawlable-and-mobile-friendly", "guidanceId": "search-hidden-content", "guidanceCategory": "user-experience", "artifacts": [ "evidence/video-mobile-layout.json" ] }, { "id": "F020", "severity": "medium", "confidence": "high", "summary": "robots.txt and sitemap.xml were intermittently unavailable", "evidence": "Both in-page fetches returned HTTP 503 for /robots.txt and /sitemap.xml during the run, while the main document was otherwise reachable.", "suggestedFix": "Keep robots and sitemap endpoints highly available and outside aggressive rate limiting; monitor them separately.", "effort": "small", "pathId": "home", "url": "https://fra.xhspot.com/", "principleId": "be-discoverable", "principleCheckId": "canonical-and-indexing-signals", "guidanceId": "search-hidden-content", "guidanceCategory": "user-experience", "artifacts": [ "evidence/site-files.json", "evidence/home-summary.json" ] }, { "id": "F021", "severity": "medium", "confidence": "high", "summary": "The video detail has social tags but no structured VideoObject data", "evidence": "The detail probe found Open Graph metadata but zero application/ld+json scripts for a page representing a video entity.", "suggestedFix": "Add accurate schema.org VideoObject JSON-LD matching the visible title, thumbnail, duration, upload date, and canonical URL.", "effort": "small", "pathId": "detail", "url": "https://fra.xhspot.com/videos/kissing-lessons-stepmom-stepdaughter-xh3KysQ", "principleId": "be-discoverable", "principleCheckId": "structured-and-shareable-metadata", "artifacts": [ "evidence/video-detail-probe.json" ] }, { "id": "F022", "severity": "high", "confidence": "high", "summary": "Transport is HTTPS, but XSS/header protection and cookie flags are weak", "evidence": "CSP is only frame-ancestors self; three of four cookies were flagged insecure, including settings and x_csrf_token without Secure, and settings uses SameSite=None.", "suggestedFix": "Set Secure on all HTTPS cookies, review SameSite, and deploy an enforceable script/style CSP with nonces or hashes.", "effort": "medium", "pathId": "home", "url": "https://fra.xhspot.com/", "principleId": "be-private-and-secure", "principleCheckId": "secure-transport-and-headers", "guidanceId": "privacy", "guidanceCategory": "privacy", "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ] }, { "id": "F023", "severity": "medium", "confidence": "high", "summary": "The initial page contacts a broad third-party surface", "evidence": "The tracker probe observed 14 third-party origins, including accounts.google.com, tsydicate.com, img.doppiocdn.com, multiple CDNs, and collection endpoints.", "suggestedFix": "Inventory every origin, defer optional integrations until consent/intent, proxy where appropriate, and remove low-value calls.", "effort": "large", "pathId": "home", "url": "https://fra.xhspot.com/", "principleId": "be-private-and-secure", "principleCheckId": "data-minimisation-and-third-parties", "guidanceId": "privacy", "guidanceCategory": "privacy", "artifacts": [ "evidence/trackers.json" ] }, { "id": "F024", "severity": "medium", "confidence": "high", "summary": "Several browser-enforced defenses are absent or too weak", "evidence": "Headers evidence shows no X-Content-Type-Options, no Referrer-Policy, a narrow Permissions-Policy, CSP limited to frame-ancestors, and HSTS max-age of only 86400 seconds.", "suggestedFix": "Add nosniff and a strict Referrer-Policy, tighten Permissions-Policy, strengthen CSP, and extend HSTS after deployment validation.", "effort": "small", "pathId": "home", "url": "https://fra.xhspot.com/", "principleId": "be-private-and-secure", "principleCheckId": "defensive-browser-policies", "guidanceId": "privacy", "guidanceCategory": "privacy", "artifacts": [ "evidence/headers.json" ] }, { "id": "F025", "severity": "high", "confidence": "high", "summary": "Network/server failure handling falls back to an unhelpful nginx page", "evidence": "The captured 503 response is a generic server page with no explanation, retry control, or preserved site navigation.", "suggestedFix": "Handle 5xx responses at the application/edge layer with an accessible recoverable fallback and retry path.", "effort": "medium", "pathId": "home", "url": "https://fra.xhspot.com/", "principleId": "be-resilient", "principleCheckId": "network-and-http-failure-states", "artifacts": [ "evidence/home-summary.json", "evidence/site-files.json" ] }, { "id": "F026", "severity": "medium", "confidence": "high", "summary": "Image bytes and formats are not consistently matched to rendered size", "evidence": "The homepage image probe found 12 oversized images and 17 legacy-format resources; detail found two oversized and 18 legacy-format resources.", "suggestedFix": "Serve modern negotiated formats and width-based responsive candidates sized close to their rendered slots.", "effort": "medium", "pathId": "home", "url": "https://fra.xhspot.com/", "principleId": "be-sustainable", "principleCheckId": "optimised-assets", "guidanceId": "deliver-optimized-decorative-images", "guidanceCategory": "user-experience", "artifacts": [ "evidence/images.json", "evidence/video-images.json" ] }, { "id": "F027", "severity": "medium", "confidence": "high", "summary": "The initial route performs a high volume of distributed network work", "evidence": "The page recorded 139 resource entries and 14 third-party origins before user interaction, with one CDN alone receiving 81 requests.", "suggestedFix": "Defer non-visible and optional modules, consolidate requests, and pause background work when content is off-screen.", "effort": "large", "pathId": "home", "url": "https://fra.xhspot.com/", "principleId": "be-sustainable", "principleCheckId": "no-wasteful-work", "guidanceId": "efficient-background-processing", "guidanceCategory": "performance", "artifacts": [ "evidence/platform-memory.json", "evidence/trackers.json" ] }, { "id": "F028", "severity": "medium", "confidence": "high", "summary": "Third-party integrations are disproportionate on the first view", "evidence": "Fourteen third-party origins are contacted during initial load, before the user selects a media item; this adds connection and processing overhead.", "suggestedFix": "Set a third-party budget, load integrations only after intent/consent, and regularly remove origins that do not justify their cost.", "effort": "large", "pathId": "home", "url": "https://fra.xhspot.com/", "principleId": "be-sustainable", "principleCheckId": "third-party-and-media-budget", "guidanceId": "efficient-background-processing", "guidanceCategory": "performance", "artifacts": [ "evidence/trackers.json" ] } ], "taskList": [ { "id": "T001", "title": "Rebuild narrow-screen layout and restore viewport metadata", "priority": 1, "findingIds": [ "F007", "F008", "F009", "F017", "F019" ], "guidanceId": "size-aware-styling", "status": "open" }, { "id": "T002", "title": "Repair contrast, ARIA, landmarks, and keyboard focus", "priority": 2, "findingIds": [ "F002", "F010", "F014", "F015", "F016" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T003", "title": "Harden CSP, cookies, and defensive headers", "priority": 3, "findingIds": [ "F022", "F024" ], "guidanceId": "privacy", "status": "open" }, { "id": "T004", "title": "Optimize responsive image delivery", "priority": 4, "findingIds": [ "F012", "F018", "F026" ], "guidanceId": "optimize-image-priority", "status": "open" }, { "id": "T005", "title": "Add recoverable 5xx handling and protect crawler endpoints", "priority": 5, "findingIds": [ "F011", "F020", "F025" ], "status": "open" }, { "id": "T006", "title": "Reduce and defer the third-party/request footprint", "priority": 6, "findingIds": [ "F013", "F023", "F027", "F028" ], "guidanceId": "efficient-background-processing", "status": "open" }, { "id": "T007", "title": "Replace the consent overlay with semantic, less-obscuring UI", "priority": 7, "findingIds": [ "F005", "F006" ], "guidanceId": "declarative-dialog-popover-control", "status": "open" }, { "id": "T008", "title": "Respect reduced motion and add progressive route transitions", "priority": 8, "findingIds": [ "F001", "F003" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T009", "title": "Add VideoObject structured data", "priority": 9, "findingIds": [ "F021" ], "status": "open" }, { "id": "T010", "title": "Make persistent chrome react to scroll position", "priority": 10, "findingIds": [ "F004" ], "guidanceId": "scroll-position-aware-elements", "status": "open" } ], "budget": { "pathCount": 3, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-22T23-39-12-826Z" }