Manifest position 53 · CrUX rank bucket 1000
https://web.spaggiari.eu
Coverage complete
Coverage complete. 34 findings: 0 critical, 15 high, 15 medium, 4 low.
Attempts
3 / 3
Judged checks
58 / 58
Blocked
0
Not run
0
This report has no published overall score. Blocked and not-run checks are not passes. A coverage-complete report means every check has a judged outcome; it does not mean every check passed.
All 58 atomic check outcomes
| Principle / check | Status | Confidence | Evidence or reason |
|---|---|---|---|
respect-user-preferencesrespects-color-scheme | issues | high | Desktop captures under light and prefers-color-scheme: dark are byte-identical (78,996 bytes) and show the same white and red palette. F01 medium: The login surface ignores the user’s dark color-scheme preference. |
respect-user-preferencesrespects-reduced-motion | pass | high | Under prefers-reduced-motion: reduce, matchMedia matched and the page reported zero active animations and zero autoplay elements. |
respect-user-preferencesrespects-contrast | issues | high | The prefers-contrast: more capture is byte-identical to the default capture, while axe found 21 contrast failures, including the primary button at 4.04:1. F02 high: The page neither adapts to increased contrast nor meets baseline contrast in several controls and content panels. |
implement-natural-interactionsview-transitions | issues | high | The page exposes no active animations or View Transition evidence; login, language, disclosure, and project state changes are implemented by legacy scripts and abrupt swaps. F03 low: State changes do not use View Transitions and provide little continuity. |
implement-natural-interactionsscroll-driven-animations | pass | medium | The audited surface contains no parallax, scrollytelling, carousel motion, or active scroll-linked animation to implement with main-thread handlers. |
implement-natural-interactionsphysical-gestures | pass | medium | No custom swipe, drag, pull-to-refresh, or gesture-driven control is present; primary actions remain native links, buttons, and inputs. |
provide-guided-navigationscroll-state-aware-chrome | issues | high | The mobile document is 6,643 CSS pixels tall, but the screenshots and DOM show no progress cue or scroll-responsive chrome. F04 low: A very long public login/marketing page offers no scroll-state orientation. |
provide-guided-navigationanchored-positioning | issues | high | The language dropdown is a Bootstrap-style scripted dropdown; no CSS anchor-positioning primitives or fallback positions were found. F05 low: The language menu relies on legacy manual overlay positioning rather than anchored positioning. |
provide-guided-navigationdirects-attention | issues | high | Focusing the login field produced no visible change in the mobile screenshot, and disclosure links are removed from the tab order with tabindex=-1. F06 medium: Focus and disclosure changes do not reliably guide keyboard users’ attention. |
maximize-content-reduce-noiseno-intrusive-interruptions | issues | high | A fixed cookie banner obscures roughly the bottom fifth of both desktop and mobile first viewports before interaction. F07 medium: The consent banner obscures content on first load. |
maximize-content-reduce-noisesemantic-dismissible-primitives | issues | high | The consent interface is a custom #cookieInfo div with duplicate button IDs; disclosures are scripted anchors rather than dialog, popover, details, or button primitives. F08 medium: Custom div-based overlays and disclosures replace native semantic primitives. |
maximize-content-reduce-noisereduced-chrome | issues | high | The login action is followed by thousands of pixels of project promotion, footer chrome, and a persistent consent bar; the mobile page is 6,643 pixels tall. F09 medium: Marketing and consent chrome overwhelm the focused authentication task. |
adapt-to-the-form-factorresponsive-no-horizontal-scroll | pass | high | At 360x800 the layout primitive measured scrollWidth 360, clientWidth 360, horizontalOverflowPx 0, and a valid viewport meta tag. |
adapt-to-the-form-factorcomponent-level-responsiveness | issues | medium | The page adapts through a global mobile layout, but no component/container-query implementation was found for reused login, project, or consent components. F10 low: Responsive behavior is viewport-wide rather than component-aware. |
adapt-to-the-form-factorinput-modality-aware | issues | high | The probe found 27 interactive elements below 44x44 CSS pixels; login inputs are 38px high, several links are 15 to 20px high, and focused input capture showed no visible focus change. F11 high: Many touch targets are undersized and keyboard focus is weak or invisible. |
support-core-task-successclear-purpose-and-primary-action | pass | high | The first viewport clearly presents personal-code/email and password fields plus credential, SPID, and CIE sign-in actions. |
support-core-task-successprimary-flow-completion | pass | medium | The unauthenticated boundary exposes a credential form, password recovery, and SPID/CIE alternatives with direct controls; protected completion correctly requires a real account and was not bypassed. |
support-core-task-successclear-system-state-and-recovery | issues | high | Submitting the empty credential form reloads essentially the same page without an inline validation message, required-state cue, or actionable recovery state. F12 high: Empty sign-in submission provides no clear validation or recovery feedback. |
be-fast-and-stablegood-core-web-vitals | issues | high | Mobile Lighthouse measured LCP 5.4s, above the 2.5s good threshold, despite low CLS 0.014 and TBT 60ms. F13 high: Largest Contentful Paint is slow on the mobile profile. |
be-fast-and-stablevisual-stability | pass | high | Layout measured CLS 0.0276 and Lighthouse measured 0.014, both within the good range; no large first-load jump was observed. |
be-fast-and-stableefficient-main-thread | pass | high | Trace recorded zero long tasks and 0ms TBT over 5.3s; Lighthouse reported only 60ms TBT. |
be-fast-and-stableefficient-resource-delivery | issues | high | HAR recorded 1.15MB across 33 requests, 670KB of fonts, seven parser-blocking stylesheets, and eight synchronous head scripts; the HTML DOM confirms scripts have no async/defer/module attributes. F14 high: Fonts and synchronous head resources delay critical rendering. |
be-fast-and-stabletrim-unused-and-duplicate-code | issues | high | Lighthouse estimates 59KiB unused jQuery UI JavaScript and 12KiB unused Font Awesome CSS; the page also loads Vue, jQuery, jQuery UI, and plugins for a simple login. F15 medium: The login page ships avoidable legacy and unused code. |
be-inclusivenames-roles-labels | issues | high | axe found missing alt text on two images, a malformed list, and content outside landmarks; Lighthouse also found accessible-name/visible-label mismatches. F16 high: Accessible names, image alternatives, and semantic structure contain multiple failures. |
be-inclusivesufficient-contrast | issues | high | axe reported 21 contrast failures; Lighthouse measured examples as low as 1.82:1 and the primary action at 4.04:1. F17 high: Text and the primary sign-in action fail WCAG color contrast. |
be-inclusivestructure-and-focus | issues | high | The html element has no lang, the document duplicates hidden headings, a list contains a direct span child, disclosure links use tabindex=-1, and focused input state was not visibly distinct. F18 high: Document structure and focus behavior are unreliable for keyboard and assistive-technology users. |
be-inclusivelegible-text | issues | high | Desktop labels and recovery text visibly collide around the password field; mobile explanatory copy is fully justified with large word gaps. F19 medium: Text spacing and alignment reduce legibility around the primary form. |
be-inclusivezoom-reflow-targets-and-media | issues | high | The narrow viewport reflows without horizontal overflow, but 27 measured interactive elements are under 44x44 and several essential controls are only 15 to 20px high. F20 high: Mobile reflow works, but many controls remain too small for touch. |
follow-best-practicesno-console-errors | pass | high | Lighthouse errors-in-console audit passed with no items, and the loaded surface completed without an uncaught exception. |
follow-best-practicessound-document-and-assets | issues | high | Doctype and UTF-8 are valid, but all seven images lack explicit dimensions and the DOM includes a malformed ul with a direct span child. F21 medium: Image sizing and list markup are not soundly authored. |
follow-best-practicesbrowser-platform-hygiene | pass | high | Lighthouse best-practices scored 1.0; console, deprecation, and third-party-cookie audits passed, and no permission prompt appeared on load. |
be-discoverabletitle-and-description | issues | high | The title is descriptive, but both DOM probe and Lighthouse show no meta description. F22 medium: The public login page has no meta description. |
be-discoverablecrawlable-and-mobile-friendly | pass | high | The page has a viewport meta tag, robots.txt explicitly allows the login URL, and primary destination links use real href values. |
be-discoverablecanonical-and-indexing-signals | issues | high | No canonical link is present and sitemap.xml advertises /sdf/, which returned a generic nginx 404 during both DOM and screenshot checks. F23 high: Indexing signals are inconsistent because the sitemap publishes a broken URL and the login page has no canonical. |
be-discoverablestructured-and-shareable-metadata | not-applicable | high | The audited host surface is an authentication entry page, not an article/product/event entity that needs rich-result schema or social sharing cards. |
be-private-and-securesecure-transport-and-headers | issues | high | HTTPS and HSTS are present, but CSP permits unsafe-eval and X-Content-Type-Options and Referrer-Policy are absent. F24 high: The authentication page has weakened XSS and response-header defenses. |
be-private-and-securedata-minimisation-and-third-parties | pass | high | Tracker scan found no known trackers, cookie audit found zero cookies before consent, and HAR showed only one static asset CDN as third party. |
be-private-and-securein-context-permissions-and-modern-auth | pass | medium | No permission prompt or permission-related load was observed; sign-in offers SPID and CIE identity options alongside credentials and password recovery. |
be-private-and-securedefensive-browser-policies | issues | high | HSTS and frame restrictions are present, but Referrer-Policy and nosniff are missing and CSP includes unsafe-eval; Permissions-Policy only limits geolocation. F25 medium: Defensive browser policies are incomplete for a login surface. |
be-resilientprogressive-enhancement | issues | high | With JavaScript disabled, the crawler screenshot shows an empty login panel and no usable credential form even though the full browser view provides authentication controls. F26 high: The core sign-in form is not usable without JavaScript. |
be-resilientresilient-runtime-behaviour | pass | medium | The consent region and sign-in controls remain within both desktop and mobile viewports, no console exceptions were recorded, and disclosure interaction completed. |
be-resilientoffline-and-installable | issues | high | The public login behaves as an app entry point but exposes no web app manifest, service-worker controller, or offline fallback. F27 medium: The app entry point has no installability or offline fallback. |
be-resilientnetwork-and-http-failure-states | issues | high | One browser evidence run received ERR_INVALID_RESPONSE and showed Chrome’s generic error page; the sitemap-listed /sdf/ route returns an unbranded nginx 404 with no recovery links. F28 high: Network and HTTP failures fall through to generic browser/server pages. |
be-internationalisedlang-dir-and-logical-properties | issues | high | A language selector is present, but html has no lang or dir; axe and Lighthouse both flag the missing language declaration. F29 high: The multilingual login page omits the document language and direction. |
be-internationalisedlocale-aware-data | not-applicable | high | The unauthenticated pages contain no user-visible dates, numbers, currencies, durations, or locale-sensitive values to format. |
be-internationalisedtime-zone-correctness | not-applicable | high | The unauthenticated pages expose no events, timestamps, schedules, or time-zone-sensitive controls. |
be-trustworthyno-dark-patterns | pass | high | Consent presents refuse, personalize, and accept actions at the same level; no forced continuity, pricing, disguised advertising, or confirmshaming was observed. |
be-trustworthyhumane-error-handling | issues | high | Empty form submission gives no clear inline error, required marker, aria-invalid state, or announced recovery message. F30 high: Sign-in validation is silent rather than humane and actionable. |
be-trustworthytrustworthy-input-assistance | issues | high | The username/email and password controls both have empty autocomplete properties instead of username and current-password. F31 medium: The sign-in form does not identify fields for password-manager autofill. |
be-trustworthysafe-commercial-and-account-flows | pass | medium | The available account boundary clearly distinguishes credentials, SPID, and CIE and exposes password recovery; no commercial commitment or continuity prompt is present. |
be-sustainableoptimised-assets | issues | high | All seven images lack intrinsic dimensions; four below-fold images are not lazy-loaded, two PNG assets use legacy format, and three responsive candidates have no srcset. F32 medium: Image delivery misses sizing, lazy-loading, and responsive/modern format opportunities. |
be-sustainableno-wasteful-work | issues | high | The simple login ships 59KiB unused jQuery UI JavaScript and 12KiB unused Font Awesome CSS, in addition to multiple legacy UI libraries. F33 medium: The login page performs and transfers avoidable framework work. |
be-sustainablethird-party-and-media-budget | issues | high | Three static CDN requests account for 579,650 bytes, primarily two Averta TTF files; fonts alone transfer 669,677 bytes, over half the 1.15MB page. F34 medium: Third-party font delivery dominates the page-weight budget. |
be-agent-readystructured-agent-capabilities | not-applicable | high | This is a sensitive authentication boundary with no declared agent-facing task; exposing sign-in actions as agent tools would require an explicit safety and consent design. |
be-agent-readyon-device-inference | not-applicable | high | The authentication entry page has no summarisation, generation, translation, or inference task where on-device AI would improve the experience. |
be-memory-efficientno-leak-under-repeated-interaction | pass | medium | After ten disclosure/dropdown interactions, same-page JS heap rose 700,716 bytes and DOM nodes by 43 with no listeners or intervals added; separate heap summaries rose 2.5%, which is bounded warm-up rather than evidence of unbounded retention. |
be-memory-efficientbounded-footprint | pass | medium | Baseline heap summary is 9.39MB with 148,176 snapshot nodes, proportionate to this small Vue/jQuery login; post snapshot is 9.63MB. |
be-memory-efficientno-detached-dom-or-unbounded-listeners | pass | medium | Neither heap summary reports Detached constructors; instrumentation across ten interactions observed zero new listeners and zero intervals. |
Provenance
Canonical report: results/atomic/reports/0053-web_spaggiari_eu.json
Report SHA-256: 70d7d268a2467d176b29333f4c4eb22dfd4d2fa09567447f25b87954666dc7fa
Local retained report: runs/2026-07-17T17-27-24-856Z/atomic-reports/web_spaggiari_eu/2026-07-27T12-35-55-422Z/report.json
Local evidence root: runs/2026-07-17T17-27-24-856Z/atomic-reports/web_spaggiari_eu/2026-07-27T12-35-55-422Z
Catalog SHA-256: sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7
Raw screenshots, HARs, traces, heaps, and other browser artifacts are retained at the local evidence root and intentionally are not committed. Artifact paths in the canonical report are relative to that root.