{ "url": "https://www.paypal.com", "auditedAt": "2026-07-24T01:20:51.965Z", "mode": "report", "status": "completed", "statusDetail": "Coverage-complete unauthenticated audit of five representative UK public templates. Excludes authenticated account, checkout/payment execution, merchant dashboard, help centre, legal documents beyond linked disclosures, and country variants because they require identity/financial actions or are separate shared templates.", "page": { "appType": "hybrid", "framework": "React-like server-rendered MPA", "notes": "www.paypal.com redirected to /uk/home. Public CMS pages ship substantial server HTML and hydrate React-like components." }, "evidenceUsed": [ "Modern Web Guidance live feed", "screenshot", "DOM/CSS inspection", "layout metrics", "evaluate probes", "prefers-color-scheme emulation", "prefers-contrast emulation", "prefers-reduced-motion emulation", "DevTools trace", "HAR", "Lighthouse", "headers", "cookies", "trackers", "secrets scan", "images audit", "discoverability/no-JS crawler view", "heap summaries" ], "guidanceConsulted": [ "dark-mode", "component-specific-light-dark-theme", "accessibility", "adapt-scrollbar-to-contrast-preferences", "same-document-transitions", "cross-document-transitions", "group-element-transitions", "faster-spa-view-transitions", "scrollytelling", "parallax-scroll-effects", "scroll-entry-exit-effects", "carousel-slide-effects", "physics-based-easing", "individual-transform-properties", "animate-element-entry-exit", "animate-to-from-top-layer", "animate-to-intrinsic-sizes", "dynamic-sibling-animations", "interactive-content-reveal", "pull-to-reveal", "swipe-to-remove", "shrinking-header-on-scroll", "scroll-progress-indicator", "scroll-position-aware-elements", "scroll-snap-realtime-feedback", "scroll-snap-state-sync", "scroll-target-on-load", "soft-edge-content-fade", "scrollability-affordance-hints", "anchor-positioning-tab-underline", "position-aware-tooltips", "interest-triggered-tooltips", "interest-triggered-action-previews", "directional-navigation-transitions", "carousel-snap-highlights", "navigation-drawer", "stack-drill-down", "persistent-app-tours", "persistent-toast-notifications", "light-dismiss-a-dialog", "platform-controls-dismiss-dialog", "declarative-dialog-popover-control", "animated-select-picker", "branded-select-styling", "brand-consistent-forms", "custom-select-picker-layouts", "rich-media-picker", "complex-shapes", "shaped-cutouts", "overflow-clipping-control", "visually-texture-content", "apply-webgl-shaders", "interactive-content-in-3d-scenes", "highlight-text-ranges", "prevent-text-wrapping", "customize-scrollbar-color-and-thickness", "export-html-media-from-canvas", "fluid-scaling", "calculate-with-intrinsic-sizes", "css-layout", "size-aware-styling", "content-based-styling", "child-state-based-styling", "design-token-reactivity", "dynamic-sibling-styling", "form-fields-automatically-fit-contents", "improve-text-layout-and-legibility", "forms", "accessible-error-announcement", "required-field-feedback", "validate-input-after-interaction", "identify-inp-causes", "schedule-tasks-by-priority", "optimize-preload-priority", "improve-next-page-load-performance", "interactions-in-complex-layouts", "performance", "visually-stable-font-fallbacks", "break-up-long-tasks", "identify-heavy-scripts", "optimize-script-priority", "defer-rendering-heavy-content", "defer-work-until-scroll-ends", "optimize-image-priority", "conditional-async-dependencies", "expose-canvas-content-to-browser-features", "move-dom-element-without-losing-state", "precise-text-alignment", "visually-stable-mixed-fonts", "css", "html", "reduce-style-repetition", "security", "privacy", "batch-analytics-events", "full-session-analytics", "calculate-total-foreground-time", "passkeys", "passkey-registration", "passkey-authentication", "passkey-reauthentication", "passkey-conditional-create", "passkey-management", "flicker-free-client-side-ab-testing", "consistent-cross-document-transitions", "stabilize-reactive-state", "resilient-context-menus-and-nested-dropdowns", "persistent-top-layer-ui", "detect-initial-visibility-state", "sequence-distributed-events", "translator", "language-detection", "support-global-calendar-systems", "capture-location-agnostic-data", "format-human-readable-durations", "manage-recurring-intervals", "calculate-event-differentials", "coordinate-global-events", "model-partial-time-concepts", "search-hidden-content", "select-menu-interaction", "style-parent-with-has", "autofill-address-form", "autofill-payment-form", "autofill-sign-in-form", "autofill-sign-up-form", "autofill-highlight-inputs", "deliver-optimized-decorative-images", "resolution-optimized-pseudo-elements", "deprioritize-background-fetches", "efficient-background-processing", "webmcp", "agentic-forms", "agentic-javascript-tools", "language-model", "summarizer" ], "artifacts": [ { "type": "screenshot", "path": "evidence/bnpl-discoverability-crawler.png", "caption": "bnpl discoverability crawler", "condition": "JavaScript disabled crawler view", "findingIds": [] }, { "type": "screenshot", "path": "evidence/bnpl-discoverability-rendered.png", "caption": "bnpl discoverability rendered", "condition": "default", "findingIds": [] }, { "type": "discoverability", "path": "evidence/bnpl-discoverability.json", "caption": "bnpl discoverability", "condition": "default", "findingIds": [] }, { "type": "dom", "path": "evidence/bnpl-dom.json", "caption": "bnpl dom", "condition": "default", "findingIds": [] }, { "type": "layout", "path": "evidence/bnpl-layout.json", "caption": "bnpl layout", "condition": "viewport 360x800", "findingIds": [] }, { "type": "screenshot", "path": "evidence/bnpl-mobile.png", "caption": "bnpl mobile", "condition": "viewport 360x800", "findingIds": [] }, { "type": "other", "path": "evidence/bnpl-probe.json", "caption": "bnpl probe", "condition": "default", "findingIds": [] }, { "type": "dom", "path": "evidence/debit-dom.json", "caption": "debit dom", "condition": "default", "findingIds": [] }, { "type": "other", "path": "evidence/debit-images.json", "caption": "debit images", "condition": "default", "findingIds": [ "F15" ] }, { "type": "layout", "path": "evidence/debit-layout.json", "caption": "debit layout", "condition": "viewport 360x800", "findingIds": [] }, { "type": "screenshot", "path": "evidence/debit-mobile.png", "caption": "debit mobile", "condition": "viewport 360x800", "findingIds": [] }, { "type": "screenshot", "path": "evidence/home-contrast.png", "caption": "home contrast", "condition": "prefers-contrast: more", "findingIds": [] }, { "type": "other", "path": "evidence/home-cookies.json", "caption": "home cookies", "condition": "default", "findingIds": [ "F13" ] }, { "type": "screenshot", "path": "evidence/home-dark.png", "caption": "home dark", "condition": "prefers-color-scheme: dark", "findingIds": [ "F01" ] }, { "type": "screenshot", "path": "evidence/home-desktop.png", "caption": "home desktop", "condition": "default", "findingIds": [ "F01" ] }, { "type": "screenshot", "path": "evidence/home-discoverability-crawler.png", "caption": "home discoverability crawler", "condition": "JavaScript disabled crawler view", "findingIds": [ "F10" ] }, { "type": "screenshot", "path": "evidence/home-discoverability-rendered.png", "caption": "home discoverability rendered", "condition": "default", "findingIds": [ "F10" ] }, { "type": "discoverability", "path": "evidence/home-discoverability.json", "caption": "home discoverability", "condition": "default", "findingIds": [ "F10" ] }, { "type": "dom", "path": "evidence/home-dom.json", "caption": "home dom", "condition": "default", "findingIds": [ "F02", "F03" ] }, { "type": "other", "path": "evidence/home-headers.json", "caption": "home headers", "condition": "default", "findingIds": [ "F11" ] }, { "type": "heap", "path": "evidence/home-heap-baseline.json", "caption": "home heap baseline", "condition": "default", "findingIds": [] }, { "type": "heap", "path": "evidence/home-heap-post.json", "caption": "home heap post", "condition": "default", "findingIds": [] }, { "type": "other", "path": "evidence/home-images.json", "caption": "home images", "condition": "default", "findingIds": [ "F15" ] }, { "type": "layout", "path": "evidence/home-mobile-layout.json", "caption": "home mobile layout", "condition": "viewport 360x800", "findingIds": [ "F09" ] }, { "type": "screenshot", "path": "evidence/home-mobile.png", "caption": "home mobile", "condition": "viewport 360x800", "findingIds": [ "F03" ] }, { "type": "other", "path": "evidence/home-probe.json", "caption": "home probe", "condition": "default", "findingIds": [ "F03", "F08", "F09" ] }, { "type": "other", "path": "evidence/home-reduced-motion.json", "caption": "home reduced motion", "condition": "prefers-reduced-motion: reduce", "findingIds": [] }, { "type": "other", "path": "evidence/home-secrets.json", "caption": "home secrets", "condition": "default", "findingIds": [ "F13" ] }, { "type": "other", "path": "evidence/home-summary.json", "caption": "home summary", "condition": "default", "findingIds": [ "F05", "F12", "F16" ] }, { "type": "trace-summary", "path": "evidence/home-trace-summary.json", "caption": "home trace summary", "condition": "default", "findingIds": [ "F04" ] }, { "type": "trace", "path": "evidence/home-trace.json", "caption": "home trace", "condition": "default", "findingIds": [ "F04" ] }, { "type": "other", "path": "evidence/home-trackers.json", "caption": "home trackers", "condition": "default", "findingIds": [ "F12", "F16" ] }, { "type": "har", "path": "evidence/home.har", "caption": "home", "condition": "default", "findingIds": [ "F05", "F12" ] }, { "type": "lighthouse", "path": "evidence/lighthouse-home.json", "caption": "lighthouse home", "condition": "default", "findingIds": [ "F04", "F06", "F07", "F08", "F14" ] }, { "type": "screenshot", "path": "evidence/security-discoverability-crawler.png", "caption": "security discoverability crawler", "condition": "JavaScript disabled crawler view", "findingIds": [] }, { "type": "screenshot", "path": "evidence/security-discoverability-rendered.png", "caption": "security discoverability rendered", "condition": "default", "findingIds": [] }, { "type": "discoverability", "path": "evidence/security-discoverability.json", "caption": "security discoverability", "condition": "default", "findingIds": [] }, { "type": "dom", "path": "evidence/security-dom.json", "caption": "security dom", "condition": "default", "findingIds": [] }, { "type": "layout", "path": "evidence/security-layout.json", "caption": "security layout", "condition": "viewport 360x800", "findingIds": [] }, { "type": "screenshot", "path": "evidence/security-mobile.png", "caption": "security mobile", "condition": "viewport 360x800", "findingIds": [] }, { "type": "screenshot", "path": "evidence/send-discoverability-crawler.png", "caption": "send discoverability crawler", "condition": "JavaScript disabled crawler view", "findingIds": [] }, { "type": "screenshot", "path": "evidence/send-discoverability-rendered.png", "caption": "send discoverability rendered", "condition": "default", "findingIds": [] }, { "type": "discoverability", "path": "evidence/send-discoverability.json", "caption": "send discoverability", "condition": "default", "findingIds": [] }, { "type": "dom", "path": "evidence/send-dom.json", "caption": "send dom", "condition": "default", "findingIds": [] }, { "type": "layout", "path": "evidence/send-layout.json", "caption": "send layout", "condition": "viewport 360x800", "findingIds": [] }, { "type": "screenshot", "path": "evidence/send-mobile.png", "caption": "send mobile", "condition": "viewport 360x800", "findingIds": [] } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 58, "blocked": 0, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": true }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "issues", "confidence": "high", "method": "Active evidence review documented in linked finding", "evidence": "Desktop screenshots captured in default and prefers-color-scheme: dark are byte-identical at 63,512 bytes; the white page and blue hero remain unchanged.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/home-dark.png" ], "findingIds": [ "F01" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "pass", "confidence": "high", "method": "evaluate under prefers-reduced-motion: reduce", "evidence": "Reduced-motion probe matched the preference and found zero active animations; CSS includes a reduced-motion rule for the brand moment.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-reduced-motion.json", "evidence/home-dom.json" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "pass", "confidence": "high", "method": "visual comparison under prefers-contrast: more plus Lighthouse accessibility", "evidence": "High-contrast screenshot remained legible; Lighthouse accessibility scored 0.98 and reported no contrast failure.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-contrast.png", "evidence/lighthouse-home.json" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "issues", "confidence": "medium", "method": "Active evidence review documented in linked finding", "evidence": "Rendered DOM/CSS evidence contains no @view-transition rule or view-transition-name despite prominent navigation between same-origin product pages.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json" ], "findingIds": [ "F02" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "pass", "confidence": "high", "method": "DOM/CSS inspection and reduced-motion animation probe", "evidence": "Sticky/scroll brand-moment styling uses compositor-friendly transforms/opacity and no active animation persisted under reduced motion.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json", "evidence/home-reduced-motion.json" ] }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "not-applicable", "confidence": "high", "method": "Recon and applicability judgement across representative public routes", "evidence": "No drag, swipe-only or other physical-gesture-exclusive core interaction is present on the representative routes.", "reason": "No drag, swipe-only or other physical-gesture-exclusive core interaction is present on the representative routes.", "pathIds": [ "home" ] }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "pass", "confidence": "high", "method": "mobile screenshot and DOM/CSS inspection", "evidence": "Navigation remains compact and usable at 360 px; sticky full-height content is bounded with overflow: clip and responsive rules.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile.png", "evidence/home-dom.json" ] }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "not-applicable", "confidence": "high", "method": "Recon and applicability judgement across representative public routes", "evidence": "No tooltip, teaching bubble or transient anchored surface requiring target-relative positioning appeared in the representative public routes.", "reason": "No tooltip, teaching bubble or transient anchored surface requiring target-relative positioning appeared in the representative public routes.", "pathIds": [ "home" ] }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "pass", "confidence": "high", "method": "visual review across five routes", "evidence": "Each route uses a prominent heading, restrained colour hierarchy and a small set of primary actions; mobile screenshots preserve the intended sequence.", "pathIds": [ "home", "debit", "bnpl", "send", "security" ], "artifacts": [ "evidence/home-mobile.png", "evidence/bnpl-mobile.png" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "pass", "confidence": "high", "method": "visual/DOM review of initial state", "evidence": "The only interruption is the legally motivated cookie banner, which offers equally visible Accept, Decline and Close controls and leaves core content visible.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile.png", "evidence/home-dom.json" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "issues", "confidence": "high", "method": "Active evidence review documented in linked finding", "evidence": "DOM/evaluate evidence reports zero dialog and zero popover elements while showing .CookieBanner_container fixed above content with Accept, Decline and Close controls.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json", "evidence/home-probe.json", "evidence/home-mobile.png" ], "findingIds": [ "F03" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "pass", "confidence": "high", "method": "visual review across route templates", "evidence": "Public templates emphasise product content with a compact global navigation and no dense application chrome.", "pathIds": [ "home", "debit", "bnpl", "send", "security" ], "artifacts": [ "evidence/home-desktop.png", "evidence/security-mobile.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "pass", "confidence": "high", "method": "layout primitive at 360x800 on all five paths", "evidence": "Every tested route reported horizontalOverflowPx 0 and scrollWidth 360 for clientWidth 360.", "pathIds": [ "home", "debit", "bnpl", "send", "security" ], "artifacts": [ "evidence/home-mobile-layout.json", "evidence/debit-layout.json", "evidence/bnpl-layout.json", "evidence/send-layout.json", "evidence/security-layout.json" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "pass", "confidence": "high", "method": "mobile screenshots plus rendered CSS inspection", "evidence": "Grid, clamp(), responsive picture sources and component media queries recompose cards and split sections cleanly across the sampled templates.", "pathIds": [ "home", "debit", "bnpl", "send", "security" ], "artifacts": [ "evidence/home-dom.json", "evidence/debit-mobile.png", "evidence/bnpl-mobile.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "pass", "confidence": "high", "method": "programmatic keyboard focus and CSS inspection", "evidence": "The first visible link accepted focus with a visible auto outline; authored controls include focus/focus-visible styles and carousel buttons expose keyboard state.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-probe.json", "evidence/home-dom.json" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "pass", "confidence": "high", "method": "visual and semantic heading/CTA review", "evidence": "Each route clearly states its purpose and exposes relevant next actions such as Log In, Sign Up or product discovery alongside descriptive headings.", "pathIds": [ "home", "debit", "bnpl", "send", "security" ], "artifacts": [ "evidence/home-mobile.png", "evidence/bnpl-probe.json" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "pass", "confidence": "high", "method": "DOM link integrity and route navigation", "evidence": "Prominent calls to action have real href destinations (zero empty/# links in the homepage probe), and all four representative destination routes loaded successfully.", "pathIds": [ "home", "debit", "bnpl", "send", "security" ], "artifacts": [ "evidence/home-probe.json", "evidence/send-dom.json" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "pass", "confidence": "high", "method": "interactive-state and content review", "evidence": "Carousel controls expose current/disabled state, FAQs disclose state through buttons, and the security route provides recovery/protection guidance.", "pathIds": [ "home", "bnpl", "security" ], "artifacts": [ "evidence/home-probe.json", "evidence/bnpl-probe.json", "evidence/security-mobile.png" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "high", "method": "Active evidence review documented in linked finding", "evidence": "Lighthouse measured performance 0.57, FCP 8.2 s and LCP 12.1 s (CLS 0.033, TBT 0 ms). A separate unthrottled trace measured 546 ms LCP, showing the risk is network/device-sensitive rather than main-thread blocking.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-trace-summary.json", "evidence/home-trace.json" ], "findingIds": [ "F04" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "pass", "confidence": "high", "method": "layout primitives and Lighthouse CLS", "evidence": "All five post-load layout observations recorded CLS 0; Lighthouse’s independent mobile run recorded CLS 0.033.", "pathIds": [ "home", "debit", "bnpl", "send", "security" ], "artifacts": [ "evidence/home-mobile-layout.json", "evidence/lighthouse-home.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "pass", "confidence": "high", "method": "DevTools trace and Lighthouse TBT", "evidence": "Trace recorded zero long tasks and 0 ms TBT; Lighthouse also measured 0 ms TBT under mobile throttling.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-trace-summary.json", "evidence/lighthouse-home.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "Active evidence review documented in linked finding", "evidence": "HAR records 94 requests and 1,136,155 transferred bytes: 44 scripts (713,120 bytes), 19 stylesheets and multiple VeryHigh-priority parser-inserted stylesheets.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/home.har" ], "findingIds": [ "F05" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "high", "method": "Active evidence review documented in linked finding", "evidence": "Lighthouse estimates 231 KiB unused JavaScript and 30 KiB unused CSS; the component bundle is 53% unused and GTM is 64% unused.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json" ], "findingIds": [ "F06" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "issues", "confidence": "high", "method": "Active evidence review documented in linked finding", "evidence": "Lighthouse accessibility found label-content-name-mismatch on the regional banner and carousel controls, including visible “Send” with aria-label “Go to page 1 of 4”.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json" ], "findingIds": [ "F07" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "pass", "confidence": "high", "method": "Lighthouse accessibility and preference screenshot", "evidence": "Lighthouse found no colour-contrast violation and the prefers-contrast screenshot preserved readable foreground/background separation.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-contrast.png" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "issues", "confidence": "high", "method": "Active evidence review documented in linked finding", "evidence": "The rendered page exposes two h1 elements for one phrase, then the cookie banner jumps from page h3 content to h4; Lighthouse flags heading-order. The evaluate probe found only a nav landmark and no main landmark.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-probe.json", "evidence/lighthouse-home.json" ], "findingIds": [ "F08" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "pass", "confidence": "high", "method": "visual review at desktop and 360 px", "evidence": "Headlines and body copy remain legible with responsive clamp-based typography and no clipped text in the sampled mobile screenshots.", "pathIds": [ "home", "debit", "bnpl", "send", "security" ], "artifacts": [ "evidence/home-mobile.png", "evidence/debit-mobile.png", "evidence/security-mobile.png" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "issues", "confidence": "high", "method": "Active evidence review documented in linked finding", "evidence": "The evaluate probe measured visible carousel indicator buttons as small as 8×8 CSS pixels, below a robust touch target, although all tested pages reflowed without horizontal overflow at 360 px.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-probe.json", "evidence/home-mobile-layout.json" ], "findingIds": [ "F09" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "pass", "confidence": "high", "method": "Lighthouse browser diagnostics", "evidence": "The Lighthouse errors-in-console audit passed with an empty item list.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "pass", "confidence": "high", "method": "DOM/evaluate and Lighthouse document audits", "evidence": "The page has HTML doctype, UTF-8, en-GB language, viewport metadata and correct image aspect ratios; representative routes loaded with HTTP 200.", "pathIds": [ "home", "debit", "bnpl", "send", "security" ], "artifacts": [ "evidence/home-probe.json", "evidence/lighthouse-home.json" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "pass", "confidence": "high", "method": "DOM/CSS and Lighthouse best-practice review", "evidence": "The site uses semantic links/buttons, responsive images, font-display swap and modern CSS; no deprecated document primitive failure was observed.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json", "evidence/lighthouse-home.json" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "pass", "confidence": "high", "method": "DOM and no-JS discoverability checks", "evidence": "All sampled routes expose descriptive titles; home and BNPL include descriptive meta text, and crawler evidence retains title/description without JavaScript.", "pathIds": [ "home", "bnpl", "send", "security" ], "artifacts": [ "evidence/home-probe.json", "evidence/bnpl-probe.json", "evidence/send-discoverability.json" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "issues", "confidence": "high", "method": "Active evidence review documented in linked finding", "evidence": "Discoverability evidence reports 56% rendered-word coverage in raw HTML and no h1 in raw HTML, while the rendered page has two h1 elements. Detail routes retain 67–74% and their h1.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-discoverability.json", "evidence/home-discoverability-rendered.png", "evidence/home-discoverability-crawler.png" ], "findingIds": [ "F10" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "pass", "confidence": "high", "method": "evaluate plus Lighthouse SEO", "evidence": "Homepage canonical resolves to /uk/home; Lighthouse reports valid canonical, valid robots.txt and no indexing block.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-probe.json", "evidence/lighthouse-home.json" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "pass", "confidence": "high", "method": "evaluate and rendered DOM inspection", "evidence": "Homepage exposes four JSON-LD blocks and BNPL exposes five; route titles/descriptions are product-specific and suitable for sharing.", "pathIds": [ "home", "bnpl" ], "artifacts": [ "evidence/home-probe.json", "evidence/bnpl-probe.json" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "issues", "confidence": "high", "method": "Active evidence review documented in linked finding", "evidence": "Headers evidence shows HSTS preload and nosniff, but CSP allows unsafe-inline for scripts/defaults and no Referrer-Policy header is present. CSP frame-ancestors mitigates the absent X-Frame-Options header.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-headers.json" ], "findingIds": [ "F11" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "issues", "confidence": "high", "method": "Active evidence review documented in linked finding", "evidence": "HAR attributes 84 of 94 requests and 1,032,165 of 1,136,155 bytes to third-party origins; tracker evidence finds GTM plus repeated Datadog and PayPal telemetry requests.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/home-trackers.json", "evidence/home.har" ], "findingIds": [ "F12" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "pass", "confidence": "high", "method": "DOM, network and permission-surface review", "evidence": "No permission prompt was triggered on public routes; login/signup are explicit same-origin actions and no password form is embedded in marketing content.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json", "evidence/home.har" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "high", "method": "Active evidence review documented in linked finding", "evidence": "Cookie evidence found all 10 cookies flagged: nine SameSite=None and the first-party _dd_s telemetry cookie without Secure. Authentication-like cookies were HttpOnly and no sensitive client secret was found.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-cookies.json", "evidence/home-secrets.json" ], "findingIds": [ "F13" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "pass", "confidence": "high", "method": "crawler/raw HTML comparison across routes", "evidence": "All four crawler-tested pages return substantive server HTML rather than empty app shells; detail pages preserve h1 and 67–74% content coverage.", "pathIds": [ "home", "bnpl", "send", "security" ], "artifacts": [ "evidence/bnpl-discoverability.json", "evidence/send-discoverability.json", "evidence/security-discoverability.json" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "issues", "confidence": "high", "method": "Active evidence review documented in linked finding", "evidence": "Lighthouse reports three bfcache failure reasons, led by Cache-Control: no-store on the main resource and no-store responses requested by JavaScript.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json" ], "findingIds": [ "F14" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "not-applicable", "confidence": "high", "method": "Recon and applicability judgement across representative public routes", "evidence": "These public marketing and regulated financial-product pages do not present an installable/offline experience as a core user promise; authenticated wallet-app resilience was outside this unauthenticated scope.", "reason": "These public marketing and regulated financial-product pages do not present an installable/offline experience as a core user promise; authenticated wallet-app resilience was outside this unauthenticated scope.", "pathIds": [ "home" ] }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "pass", "confidence": "high", "method": "HAR status and content fallback review", "evidence": "Representative routes returned 200 with no HAR HTTP errors; public pages include stable server-rendered content and explicit navigation destinations.", "pathIds": [ "home", "bnpl", "send", "security" ], "artifacts": [ "evidence/home-summary.json", "evidence/send-discoverability.json" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "pass", "confidence": "high", "method": "DOM and CSS inspection", "evidence": "Documents declare en-GB/ltr, CSS uses margin-inline, padding-inline and inset-inline, and includes RTL-specific rules.", "pathIds": [ "home", "bnpl" ], "artifacts": [ "evidence/home-probe.json", "evidence/bnpl-dom.json" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "pass", "confidence": "high", "method": "content and metadata review", "evidence": "UK routes use en-GB copy, UK product/legal terminology and pound-denominated financial context rather than a mismatched locale.", "pathIds": [ "home", "bnpl", "debit" ], "artifacts": [ "evidence/bnpl-probe.json", "evidence/debit-dom.json" ] }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "not-applicable", "confidence": "high", "method": "Recon and applicability judgement across representative public routes", "evidence": "No time-zone-sensitive date/time scheduling or display appeared on the representative public routes.", "reason": "No time-zone-sensitive date/time scheduling or display appeared on the representative public routes.", "pathIds": [ "home" ] }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "pass", "confidence": "high", "method": "cookie/commercial flow visual review", "evidence": "Cookie controls offer Accept and Decline side by side; BNPL copy identifies the product as a loan and links detail/eligibility information without a preselected purchase action.", "pathIds": [ "home", "bnpl" ], "artifacts": [ "evidence/home-mobile.png", "evidence/bnpl-mobile.png" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "pass", "confidence": "high", "method": "security/recovery and CTA review", "evidence": "Public routes avoid blame-oriented errors and direct users to security/protection and FAQ material; no broken-route or HTTP error surfaced.", "pathIds": [ "home", "bnpl", "security" ], "artifacts": [ "evidence/security-mobile.png", "evidence/home-summary.json" ] }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "pass", "confidence": "high", "method": "form inventory and CTA review", "evidence": "No data-entry form is presented on the representative marketing routes, so users are not exposed to misleading validation or unsupported autofill; task entry uses explicit links.", "pathIds": [ "home", "bnpl" ], "artifacts": [ "evidence/home-probe.json", "evidence/bnpl-probe.json" ] }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "pass", "confidence": "high", "method": "commercial copy and navigation review", "evidence": "BNPL terms identify Pay in 3 as an interest-free loan and expose eligibility/credit-score FAQs; account actions are explicit and route to PayPal authentication.", "pathIds": [ "home", "bnpl" ], "artifacts": [ "evidence/bnpl-probe.json", "evidence/bnpl-mobile.png" ] }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "issues", "confidence": "high", "method": "Active evidence review documented in linked finding", "evidence": "Image probes found the homepage hero JPEG oversized at 780 natural vs 351 displayed pixels with no width/height attributes; the debit-card JPEG also lacks dimensions and is not lazy despite being below the fold.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-images.json", "evidence/debit-images.json" ], "findingIds": [ "F15" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "pass", "confidence": "high", "method": "trace, reduced-motion and heap evidence", "evidence": "No long main-thread tasks or persistent reduced-motion animations were observed, and repeated scrolling changed heap self-size by only 10,448 bytes.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-trace-summary.json", "evidence/home-reduced-motion.json", "evidence/home-heap-post.json" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "issues", "confidence": "high", "method": "Active evidence review documented in linked finding", "evidence": "Third-party resources account for about 91% of transferred bytes, including 114,607 bytes for GTM and repeated background RUM calls; total load is 1.14 MB for a marketing entry page.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/home-trackers.json" ], "findingIds": [ "F16" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "not-applicable", "confidence": "high", "method": "Recon and applicability judgement across representative public routes", "evidence": "The unauthenticated marketing site exposes content and navigation, not a declared agent-operated task surface; authenticated account/payment actions were outside scope.", "reason": "The unauthenticated marketing site exposes content and navigation, not a declared agent-operated task surface; authenticated account/payment actions were outside scope.", "pathIds": [ "home" ] }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "high", "method": "Recon and applicability judgement across representative public routes", "evidence": "No AI inference feature is offered on the representative routes, so on-device inference is not applicable.", "reason": "No AI inference feature is offered on the representative routes, so on-device inference is not applicable.", "pathIds": [ "home" ] }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "pass", "confidence": "high", "method": "baseline/post heap comparison after ten scroll cycles", "evidence": "Heap self-size changed from 30,684,019 to 30,694,467 bytes (+0.034%) after ten end-to-end scroll cycles, with no unbounded constructor growth.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-heap-baseline.json", "evidence/home-heap-post.json" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "pass", "confidence": "high", "method": "heap summary and network profile", "evidence": "Heap self-size is about 30.7 MB and remained stable after exercise; no single unexpected application constructor dominates the summary.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-heap-baseline.json", "evidence/home-heap-post.json" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "pass", "confidence": "high", "method": "heap constructor comparison", "evidence": "Heap summaries show no Detached* constructor among top retained constructors; closures rose only 146 and total self-size stayed effectively flat after repetition.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-heap-baseline.json", "evidence/home-heap-post.json" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F01" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "issues", "findingIds": [ "F02" ] }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "pass" }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "issues", "findingIds": [ "F03" ] }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "pass" }, { "principleId": "support-core-task-success", "expectation": "default", "status": "pass" }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F04", "F05", "F06" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F07", "F08", "F09" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "pass" }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F10" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F11", "F12", "F13" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "issues", "findingIds": [ "F14" ] }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "pass" }, { "principleId": "be-trustworthy", "expectation": "default", "status": "pass" }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F15", "F16" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "not-applicable", "reason": "The unauthenticated marketing site exposes content and navigation, not a declared agent-operated task surface; authenticated account/payment actions were outside scope. No AI inference feature is offered on the representative routes, so on-device inference is not applicable." }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "pass" } ], "paths": [ { "id": "home", "description": "UK consumer homepage: entry template, navigation, primary calls to action, preferences, performance and global policy checks.", "url": "https://www.paypal.com/uk/home", "conditions": [ "desktop", "viewport: 360x800", "prefers-color-scheme: dark", "prefers-contrast: more", "prefers-reduced-motion: reduce", "keyboard focus" ], "result": "issues" }, { "id": "debit", "description": "PayPal Debit Card product-detail template: commercial product explanation, imagery and responsive layout.", "url": "https://www.paypal.com/uk/digital-wallet/manage-money/paypal-debit-card", "conditions": [ "viewport: 360x800" ], "result": "issues" }, { "id": "bnpl", "description": "Buy-now-pay-later product and FAQ template: regulated commercial copy, expandable guidance, metadata and no-JS delivery.", "url": "https://www.paypal.com/uk/digital-wallet/ways-to-pay/buy-now-pay-later", "conditions": [ "viewport: 360x800", "JavaScript disabled crawler view" ], "result": "issues" }, { "id": "send", "description": "Send-money journey entry: core task explanation, CTA path, responsive layout and no-JS delivery.", "url": "https://www.paypal.com/uk/digital-wallet/send-receive-money/send-money", "conditions": [ "viewport: 360x800", "JavaScript disabled crawler view" ], "result": "pass" }, { "id": "security", "description": "Security and protection content template: trust claims, recovery guidance, responsive layout and no-JS delivery.", "url": "https://www.paypal.com/uk/digital-wallet/security-and-protection", "conditions": [ "viewport: 360x800", "JavaScript disabled crawler view" ], "result": "pass" } ], "findings": [ { "id": "F01", "severity": "medium", "confidence": "high", "pathId": "home", "url": "https://www.paypal.com/uk/home", "principleId": "respect-user-preferences", "principleCheckId": "respects-color-scheme", "guidanceId": "dark-mode", "guidanceCategory": "user-experience", "summary": "The public surface does not adapt to the user’s dark colour-scheme preference.", "evidence": "Desktop screenshots captured in default and prefers-color-scheme: dark are byte-identical at 63,512 bytes; the white page and blue hero remain unchanged.", "artifacts": [ "evidence/home-desktop.png", "evidence/home-dark.png" ], "suggestedFix": "Declare color-scheme and map page, component and browser-UI colours through light/dark tokens selected by prefers-color-scheme, following dark-mode guidance.", "effort": "medium" }, { "id": "F02", "severity": "low", "confidence": "medium", "pathId": "home", "url": "https://www.paypal.com/uk/home", "principleId": "implement-natural-interactions", "principleCheckId": "view-transitions", "guidanceId": "cross-document-transitions", "guidanceCategory": "user-experience", "summary": "Navigating this MPA has no authored cross-document View Transition treatment.", "evidence": "Rendered DOM/CSS evidence contains no @view-transition rule or view-transition-name despite prominent navigation between same-origin product pages.", "artifacts": [ "evidence/home-dom.json" ], "suggestedFix": "Add a progressively enhanced cross-document view transition for stable header/hero elements, while preserving instant navigation under reduced motion.", "effort": "medium" }, { "id": "F03", "severity": "medium", "confidence": "high", "pathId": "home", "url": "https://www.paypal.com/uk/home", "principleId": "maximize-content-reduce-noise", "principleCheckId": "semantic-dismissible-primitives", "guidanceId": "declarative-dialog-popover-control", "guidanceCategory": "html", "summary": "The cookie interruption is implemented as fixed generic containers rather than a native dismissible top-layer primitive.", "evidence": "DOM/evaluate evidence reports zero dialog and zero popover elements while showing .CookieBanner_container fixed above content with Accept, Decline and Close controls.", "artifacts": [ "evidence/home-dom.json", "evidence/home-probe.json", "evidence/home-mobile.png" ], "suggestedFix": "Use a semantically named dialog or appropriate popover with declarative controls, deterministic focus handling and platform dismissal semantics.", "effort": "medium" }, { "id": "F04", "severity": "high", "confidence": "high", "pathId": "home", "url": "https://www.paypal.com/uk/home", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "guidanceId": "performance", "guidanceCategory": "performance", "summary": "Cold mobile loading is far outside the recommended LCP range.", "evidence": "Lighthouse measured performance 0.57, FCP 8.2 s and LCP 12.1 s (CLS 0.033, TBT 0 ms). A separate unthrottled trace measured 546 ms LCP, showing the risk is network/device-sensitive rather than main-thread blocking.", "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-trace-summary.json", "evidence/home-trace.json" ], "suggestedFix": "Prioritise the LCP content and reduce its dependency chain; validate on Lighthouse mobile conditions and field CWV.", "effort": "large" }, { "id": "F05", "severity": "medium", "confidence": "high", "pathId": "home", "url": "https://www.paypal.com/uk/home", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "guidanceId": "optimize-script-priority", "guidanceCategory": "performance", "summary": "The entry page loads a large, fragmented critical network surface.", "evidence": "HAR records 94 requests and 1,136,155 transferred bytes: 44 scripts (713,120 bytes), 19 stylesheets and multiple VeryHigh-priority parser-inserted stylesheets.", "artifacts": [ "evidence/home-summary.json", "evidence/home.har" ], "suggestedFix": "Consolidate and defer non-critical styles/scripts, explicitly prioritise only LCP-critical resources, and delay analytics and support code until needed or consented.", "effort": "large" }, { "id": "F06", "severity": "medium", "confidence": "high", "pathId": "home", "url": "https://www.paypal.com/uk/home", "principleId": "be-fast-and-stable", "principleCheckId": "trim-unused-and-duplicate-code", "guidanceId": "identify-heavy-scripts", "guidanceCategory": "performance", "summary": "A substantial share of shipped JavaScript and CSS is unused on the homepage.", "evidence": "Lighthouse estimates 231 KiB unused JavaScript and 30 KiB unused CSS; the component bundle is 53% unused and GTM is 64% unused.", "artifacts": [ "evidence/lighthouse-home.json" ], "suggestedFix": "Split page-specific components, conditionally import analytics/support modules and remove duplicated global/component CSS from the entry route.", "effort": "large" }, { "id": "F07", "severity": "medium", "confidence": "high", "pathId": "home", "url": "https://www.paypal.com/uk/home", "principleId": "be-inclusive", "principleCheckId": "names-roles-labels", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "summary": "Several visible control labels do not match their accessible names.", "evidence": "Lighthouse accessibility found label-content-name-mismatch on the regional banner and carousel controls, including visible “Send” with aria-label “Go to page 1 of 4”.", "artifacts": [ "evidence/lighthouse-home.json" ], "suggestedFix": "Make each accessible name begin with and include its visible label, adding state or position after that label.", "effort": "small" }, { "id": "F08", "severity": "medium", "confidence": "high", "pathId": "home", "url": "https://www.paypal.com/uk/home", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "summary": "Heading and landmark structure is inconsistent on the homepage.", "evidence": "The rendered page exposes two h1 elements for one phrase, then the cookie banner jumps from page h3 content to h4; Lighthouse flags heading-order. The evaluate probe found only a nav landmark and no main landmark.", "artifacts": [ "evidence/home-probe.json", "evidence/lighthouse-home.json" ], "suggestedFix": "Use one h1, keep heading levels structural rather than visual, give the cookie title an appropriate level, and expose a main landmark.", "effort": "small" }, { "id": "F09", "severity": "medium", "confidence": "high", "pathId": "home", "url": "https://www.paypal.com/uk/home", "principleId": "be-inclusive", "principleCheckId": "zoom-reflow-targets-and-media", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "summary": "Some carousel pagination controls expose very small hit areas.", "evidence": "The evaluate probe measured visible carousel indicator buttons as small as 8×8 CSS pixels, below a robust touch target, although all tested pages reflowed without horizontal overflow at 360 px.", "artifacts": [ "evidence/home-probe.json", "evidence/home-mobile-layout.json" ], "suggestedFix": "Retain the small visual dot but provide at least a 44×44 CSS-pixel interactive hit area with adequate separation.", "effort": "small" }, { "id": "F10", "severity": "medium", "confidence": "high", "pathId": "home", "url": "https://www.paypal.com/uk/home", "principleId": "be-discoverable", "principleCheckId": "crawlable-and-mobile-friendly", "guidanceId": "html", "guidanceCategory": "html", "summary": "The homepage loses significant primary content when JavaScript is unavailable.", "evidence": "Discoverability evidence reports 56% rendered-word coverage in raw HTML and no h1 in raw HTML, while the rendered page has two h1 elements. Detail routes retain 67–74% and their h1.", "artifacts": [ "evidence/home-discoverability.json", "evidence/home-discoverability-rendered.png", "evidence/home-discoverability-crawler.png" ], "suggestedFix": "Server-render the complete hero heading and core homepage copy so the primary proposition survives without JavaScript.", "effort": "medium" }, { "id": "F11", "severity": "high", "confidence": "high", "pathId": "home", "url": "https://www.paypal.com/uk/home", "principleId": "be-private-and-secure", "principleCheckId": "secure-transport-and-headers", "guidanceId": "security", "guidanceCategory": "security", "summary": "Strong transport headers are weakened by permissive script policy and missing referrer policy.", "evidence": "Headers evidence shows HSTS preload and nosniff, but CSP allows unsafe-inline for scripts/defaults and no Referrer-Policy header is present. CSP frame-ancestors mitigates the absent X-Frame-Options header.", "artifacts": [ "evidence/home-headers.json" ], "suggestedFix": "Remove unsafe-inline from script-src using the existing nonce strategy throughout and add a restrictive Referrer-Policy such as strict-origin-when-cross-origin.", "effort": "large" }, { "id": "F12", "severity": "medium", "confidence": "high", "pathId": "home", "url": "https://www.paypal.com/uk/home", "principleId": "be-private-and-secure", "principleCheckId": "data-minimisation-and-third-parties", "guidanceId": "privacy", "guidanceCategory": "privacy", "summary": "Most homepage traffic is third-party or cross-origin telemetry and shared infrastructure.", "evidence": "HAR attributes 84 of 94 requests and 1,032,165 of 1,136,155 bytes to third-party origins; tracker evidence finds GTM plus repeated Datadog and PayPal telemetry requests.", "artifacts": [ "evidence/home-summary.json", "evidence/home-trackers.json", "evidence/home.har" ], "suggestedFix": "Audit each telemetry purpose, gate optional tags on consent, sample RUM, self-host or eliminate avoidable dependencies, and enforce a documented third-party budget.", "effort": "large" }, { "id": "F13", "severity": "medium", "confidence": "high", "pathId": "home", "url": "https://www.paypal.com/uk/home", "principleId": "be-private-and-secure", "principleCheckId": "defensive-browser-policies", "guidanceId": "security", "guidanceCategory": "security", "summary": "Cookie policy is broader than needed and one telemetry cookie is not Secure.", "evidence": "Cookie evidence found all 10 cookies flagged: nine SameSite=None and the first-party _dd_s telemetry cookie without Secure. Authentication-like cookies were HttpOnly and no sensitive client secret was found.", "artifacts": [ "evidence/home-cookies.json", "evidence/home-secrets.json" ], "suggestedFix": "Set Secure on every cookie and use Lax or Strict unless a documented cross-site flow requires None; keep sensitive cookies HttpOnly.", "effort": "medium" }, { "id": "F14", "severity": "medium", "confidence": "high", "pathId": "home", "url": "https://www.paypal.com/uk/home", "principleId": "be-resilient", "principleCheckId": "resilient-runtime-behaviour", "guidanceId": "performance", "guidanceCategory": "performance", "summary": "The homepage cannot use the back/forward cache.", "evidence": "Lighthouse reports three bfcache failure reasons, led by Cache-Control: no-store on the main resource and no-store responses requested by JavaScript.", "artifacts": [ "evidence/lighthouse-home.json" ], "suggestedFix": "Apply no-store only to genuinely sensitive responses; separate cacheable public marketing HTML and telemetry requests from authenticated state.", "effort": "medium" }, { "id": "F15", "severity": "medium", "confidence": "high", "pathId": "home", "url": "https://www.paypal.com/uk/home", "principleId": "be-sustainable", "principleCheckId": "optimised-assets", "guidanceId": "deliver-optimized-decorative-images", "guidanceCategory": "performance", "summary": "Prominent imagery lacks intrinsic dimensions and modern negotiated formats.", "evidence": "Image probes found the homepage hero JPEG oversized at 780 natural vs 351 displayed pixels with no width/height attributes; the debit-card JPEG also lacks dimensions and is not lazy despite being below the fold.", "artifacts": [ "evidence/home-images.json", "evidence/debit-images.json" ], "suggestedFix": "Serve AVIF/WebP candidates through picture/srcset, size candidates to rendered breakpoints, add width/height, and lazy-load non-critical below-fold images.", "effort": "medium" }, { "id": "F16", "severity": "medium", "confidence": "high", "pathId": "home", "url": "https://www.paypal.com/uk/home", "principleId": "be-sustainable", "principleCheckId": "third-party-and-media-budget", "guidanceId": "efficient-background-processing", "guidanceCategory": "performance", "summary": "The page has no effective third-party byte/request budget.", "evidence": "Third-party resources account for about 91% of transferred bytes, including 114,607 bytes for GTM and repeated background RUM calls; total load is 1.14 MB for a marketing entry page.", "artifacts": [ "evidence/home-summary.json", "evidence/home-trackers.json" ], "suggestedFix": "Set and enforce route-level budgets for total bytes, third-party bytes and request count; defer or sample background analytics after core content is stable.", "effort": "large" } ], "taskList": [ { "id": "T01", "title": "Cut the cold-load critical path and unused route code", "priority": 1, "findingIds": [ "F04", "F05", "F06", "F16" ], "guidanceId": "performance", "status": "open" }, { "id": "T02", "title": "Harden CSP, referrer and cookie policy", "priority": 2, "findingIds": [ "F11", "F13" ], "guidanceId": "security", "status": "open" }, { "id": "T03", "title": "Reduce and consent-gate telemetry and third-party dependencies", "priority": 3, "findingIds": [ "F12", "F16" ], "guidanceId": "privacy", "status": "open" }, { "id": "T04", "title": "Repair accessible naming, heading landmarks and target sizes", "priority": 4, "findingIds": [ "F07", "F08", "F09" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T05", "title": "Server-render the complete homepage proposition", "priority": 5, "findingIds": [ "F10" ], "guidanceId": "html", "status": "open" }, { "id": "T06", "title": "Optimise image formats, dimensions and loading", "priority": 6, "findingIds": [ "F15" ], "guidanceId": "deliver-optimized-decorative-images", "status": "open" }, { "id": "T07", "title": "Respect dark mode and use semantic dismissal primitives", "priority": 7, "findingIds": [ "F01", "F03" ], "guidanceId": "dark-mode", "status": "open" }, { "id": "T08", "title": "Restore bfcache eligibility for public pages", "priority": 8, "findingIds": [ "F14" ], "guidanceId": "performance", "status": "open" }, { "id": "T09", "title": "Progressively enhance same-origin page transitions", "priority": 9, "findingIds": [ "F02" ], "guidanceId": "cross-document-transitions", "status": "open" } ], "budget": { "wallClockSeconds": 900, "pathCount": 5, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-24T01-20-51-965Z" }