Manifest position 67 · CrUX rank bucket 1000
https://ufgrowfun.com
Coverage complete
Coverage-complete audit of the public unauthenticated portal and representative reachable states; authenticated wagering functionality was not entered because no credentials were provided.
Attempts
1 / 3
Judged checks
58 / 58
Blocked
0
Not run
0
This report has no published overall score. Blocked and not-run checks are not passes. A coverage-complete report means every check has a judged outcome; it does not mean every check passed.
All 58 atomic check outcomes
| Principle / check | Status | Confidence | Evidence or reason |
|---|---|---|---|
respect-user-preferencesrespects-color-scheme | issues | high | Desktop and prefers-color-scheme: dark screenshots are pixel-equivalent in treatment, while the page declares no color-scheme or theme media query. F01 medium: Theme is hard-coded rather than preference-aware. |
respect-user-preferencesrespects-reduced-motion | issues | high | Under prefers-reduced-motion: reduce, the probe still found data-ride="carousel" and a deprecated <marquee>; neither was disabled. F02 high: Auto-advancing motion ignores reduced-motion. |
respect-user-preferencesrespects-contrast | issues | high | axe measured 3.49:1 placeholder contrast for both login fields; forced-colors capture also leaves content-heavy raster imagery as the primary communication. F03 medium: Controls do not remain robust under contrast needs. |
implement-natural-interactionsview-transitions | issues | high | ShowGC() directly toggles table rows from displayed to none/table-row; no View Transition CSS or API use is present. F04 low: The in-page Games state swaps abruptly. |
implement-natural-interactionsscroll-driven-animations | pass | high | No scroll-linked animation or scroll handler is used, so the anti-pattern is absent. |
implement-natural-interactionsphysical-gestures | pass | high | No gesture-driven interaction is present to implement or fight with custom pointer handlers. |
provide-guided-navigationscroll-state-aware-chrome | pass | high | The audited portal has no meaningful scrolling chrome; no static sticky header or JS scroll toggle is present. |
provide-guided-navigationanchored-positioning | pass | high | No tooltip, popover, or attached menu is present on the audited public surface. |
provide-guided-navigationdirects-attention | issues | high | The Games & Casino onclick state hides the main content and reveals a table row without moving focus, updating URL/state, or announcing the new section. F05 medium: In-page navigation does not preserve or direct attention. |
maximize-content-reduce-noiseno-intrusive-interruptions | pass | high | Load screenshot shows no modal, consent wall, or full-viewport interruption obscuring the portal. |
maximize-content-reduce-noisesemantic-dismissible-primitives | issues | high | DOM shows onclick div navigation and PopupCenter window calls, with zero dialog, popover, or details elements. F06 medium: Navigation and overlays use ad-hoc scripting and popup windows. |
maximize-content-reduce-noisereduced-chrome | pass | high | The entry screen keeps chrome compact and gives the primary viewport to service imagery and login. |
adapt-to-the-form-factorresponsive-no-horizontal-scroll | issues | high | At a requested 360x800 viewport Chrome reports no viewport meta and a 980 CSS-pixel layout scaled to 0.367; the screenshot renders login controls and text extremely small. F07 critical: The mobile page is a scaled desktop canvas. |
adapt-to-the-form-factorcomponent-level-responsiveness | issues | high | Rendered HTML uses a 975px table, 734px/233px columns, and many pixel widths; no container-query behavior was observed. F08 high: Components are fixed-width and cannot adapt to their containers. |
adapt-to-the-form-factorinput-modality-aware | issues | high | The active controls measure only 20-22 CSS px high, including language, username, password, and Login. F09 high: Primary controls are too small for touch. |
support-core-task-successclear-purpose-and-primary-action | pass | high | UFABET branding, betting categories, and the LOGIN action are visible in the first viewport. |
support-core-task-successprimary-flow-completion | issues | high | Submitting test credentials navigated the inspected target away; the captured post-submit visual showed no inline validation or recovery affordance. F10 high: The primary login flow does not expose a usable failure path. |
support-core-task-successclear-system-state-and-recovery | issues | high | Invalid login produced no visible error in the captured state, and a missing route returned HTTP 403 with a blank-looking page. F11 high: Error and recovery states are missing. |
be-fast-and-stablegood-core-web-vitals | issues | high | Lighthouse scored performance 0.54 with LCP 34.5s, TBT 310ms, and Speed Index 5.7s; the first-party trace measured LCP 1.78s without throttling. F12 high: Throttled loading performance misses the Core Web Vitals bar. |
be-fast-and-stablevisual-stability | pass | high | Layout observer recorded CLS 0 and Lighthouse recorded CLS 0.012, both within the good range. |
be-fast-and-stableefficient-main-thread | issues | high | Lighthouse measured 310ms TBT although the unthrottled trace saw no >50ms long task, indicating device/network sensitivity. F13 medium: Shipped scripting creates avoidable blocking under throttling. |
be-fast-and-stableefficient-resource-delivery | issues | high | HAR and DOM confirm jQuery, Popper, Bootstrap, bjqs and default.js are parser-inserted in <head> without async, defer, or module semantics. F14 high: Five synchronous head scripts block parsing. |
be-fast-and-stabletrim-unused-and-duplicate-code | issues | high | Lighthouse estimates 345 KiB unused JavaScript and 51 KiB unused CSS; the HAR transfers 219,215 third-party bytes. F15 high: The page ships substantial unused JS and CSS. |
be-inclusivenames-roles-labels | issues | high | axe found critical unnamed language select and image input, unnamed carousel controls, and the image audit found all 11 images missing alt text. F16 critical: Core content and controls lack accessible names. |
be-inclusivesufficient-contrast | issues | high | axe measured 3.49:1 for the 11px username and password placeholders against white, below 4.5:1. F17 high: Login placeholder text fails WCAG AA contrast. |
be-inclusivestructure-and-focus | issues | high | axe found no main landmark, no h1, content outside landmarks, and tabindex values 1 and 3; the probe found no headings or landmarks. F18 high: The document has no semantic structure and forces positive tabindex. |
be-inclusivelegible-text | issues | high | The 980px desktop layout is scaled to 36.7% on a 360px device, making 11-14px desktop text effectively tiny and difficult to read. F19 high: Text is too small after mobile down-scaling. |
be-inclusivezoom-reflow-targets-and-media | issues | high | No viewport meta is present, controls are 20-22px high, and the mobile screenshot is a miniature desktop page. F20 critical: The page fails mobile reflow and target sizing. |
follow-best-practicesno-console-errors | pass | high | Lighthouse no-console-errors audit passed and the page loaded without an uncaught error in evidence sessions. |
follow-best-practicessound-document-and-assets | issues | high | Images audit found 6 missing dimensions, all 11 in legacy PNG/JPG, 7 without responsive sources, and 5 below-fold images eagerly loaded; DOM is table-based. F21 medium: Document assets use brittle, legacy patterns. |
follow-best-practicesbrowser-platform-hygiene | issues | high | DOM includes deprecated <marquee>, javascript: links, popup windows, inline handlers, jQuery 3.4.1 and Bootstrap 4.3.1. F22 medium: Deprecated and stale platform patterns remain. |
be-discoverabletitle-and-description | issues | high | The EN-US route has Thai title/description while the visible navigation and selected language are English. F23 high: Metadata language does not match the visible English variant. |
be-discoverablecrawlable-and-mobile-friendly | issues | high | Lighthouse crawlable-anchors failed; primary actions use javascript: and onclick divs, and viewport meta is absent. F24 high: Navigation is not crawlable or mobile friendly. |
be-discoverablecanonical-and-indexing-signals | issues | high | The public landing page declares noindex/googlebot noindex, has no canonical, and /sitemap.xml returns the text DIV rather than a sitemap. F25 high: Public indexing signals are contradictory or absent. |
be-discoverablestructured-and-shareable-metadata | issues | high | Probe found zero JSON-LD and zero Open Graph tags despite the page representing a named betting service. F26 medium: The service has no structured or social metadata. |
be-private-and-securesecure-transport-and-headers | issues | high | HTTPS is used, but CSP/HSTS/nosniff are absent and ASP.NET_SessionId lacks Secure. F27 critical: Session transport defenses are incomplete. |
be-private-and-securedata-minimisation-and-third-parties | issues | high | Tracker probe found Google Tag Manager and five third-party origins; HAR attributes 219,215 transferred bytes to third parties, with GTM the largest script at 139,430 bytes. F28 high: Tracking loads before any visible consent or explanation. |
be-private-and-securein-context-permissions-and-modern-auth | issues | high | The only auth fields are username/password; no WebAuthn/passkey surface was found, and autocomplete attributes are empty. F29 high: Authentication is password-only and lacks modern assistance. |
be-private-and-securedefensive-browser-policies | issues | high | Headers probe found no frame protection, Referrer-Policy, Permissions-Policy, CSP, HSTS, or nosniff. F30 high: Browser-enforced defensive policies are absent. |
be-resilientprogressive-enhancement | issues | high | Discoverability fetch received only 87 bytes of raw HTML with 0% rendered-word coverage; the crawler screenshot is blank while the browser screenshot has the portal. F31 critical: Core content disappears for non-JavaScript crawlers. |
be-resilientresilient-runtime-behaviour | pass | high | The simple Games state toggle completed reliably and did not produce a clipped overlay or unstable async state. |
be-resilientoffline-and-installable | issues | high | Probe found no active service worker and recon found no web app manifest. F32 medium: The app-like login portal has no install or offline support. |
be-resilientnetwork-and-http-failure-states | issues | high | A representative missing route returned HTTP 403 and a blank-looking screenshot with no navigation or retry guidance. F33 high: Failure routes do not provide recovery. |
be-internationalisedlang-dir-and-logical-properties | issues | high | The page offers 14 language options but <html> has no lang or dir; axe flags html-has-lang. F34 high: Language variants are not declared correctly. |
be-internationalisedlocale-aware-data | issues | high | Inline code constructs serverTime from a locale-fragile string and renders a fixed DD-MM-YYYY time format on all variants. F35 medium: Date/time output is hard-coded rather than locale-aware. |
be-internationalisedtime-zone-correctness | issues | high | The header explicitly displays GMT+8 and the script seeds a naive Date without an offset, so interpretation varies by browser time zone. F36 medium: The displayed time assumes GMT+8 for every user. |
be-trustworthyno-dark-patterns | pass | high | No consent wall, forced continuity, disguised ad, confirmshaming, or preselected upsell appeared on the accessible public page. |
be-trustworthyhumane-error-handling | issues | high | The invalid-login capture contains no visible inline error, field state, help, or accessible announcement. F37 high: Login errors are not handled humanely. |
be-trustworthytrustworthy-input-assistance | issues | high | The username and password inputs have empty autocomplete values and no labels. F38 high: Sign-in fields omit autocomplete semantics. |
be-trustworthysafe-commercial-and-account-flows | issues | high | The login view exposes only username, password, and Login: no password recovery/help route, passkey option, or visible security guidance. F39 medium: The account entry flow lacks recovery and safer authentication cues. |
be-sustainableoptimised-assets | issues | high | All 11 images are JPG/PNG, 7 lack responsive sources, 5 below-fold images are not lazy, and all five carousel banners load up front. F40 high: Images are eagerly delivered in legacy formats. |
be-sustainableno-wasteful-work | issues | high | Inline code starts a one-second setInterval for the clock, while Bootstrap auto-runs the carousel; hidden slides and legacy libraries are loaded immediately. F41 medium: The idle page performs avoidable continuous work. |
be-sustainablethird-party-and-media-budget | issues | high | HAR transfers 880,688 bytes: 634,658 image bytes and 219,215 third-party bytes; GTM alone is 139,430 bytes. F42 high: Third-party and decorative media cost is disproportionate to the simple portal. |
be-agent-readystructured-agent-capabilities | not-applicable | high | This is a sensitive wagering login portal; exposing transactional actions to autonomous agents is not an evidenced product intent and could create financial risk. |
be-agent-readyon-device-inference | not-applicable | high | No summarisation or language-model task is part of the small public login surface, so on-device inference has no justified use. |
be-memory-efficientno-leak-under-repeated-interaction | pass | medium | After ten Games state toggles, heap summary rose modestly from 6,396,512 to 6,609,728 bytes (+3.3%) and closures from 6,006 to 6,020; no unbounded trend is indicated. |
be-memory-efficientbounded-footprint | pass | medium | The portal uses about 6.4-6.6 MB heap with 212 DOM elements, proportionate to this small page. |
be-memory-efficientno-detached-dom-or-unbounded-listeners | pass | medium | Top-constructor summaries contain no Detached* population; closures changed by only 14 after ten toggles. |
Provenance
Canonical report: results/atomic/reports/0067-ufgrowfun_com.json
Report SHA-256: 4de9cc4cf8e435611e0ed0db99dd4200fcec61a4e25e5dbf37c0469b4efa8938
Local retained report: runs/2026-07-17T17-27-24-856Z/atomic-reports/ufgrowfun_com/2026-07-18T04-35-22-231Z/report.json
Local evidence root: runs/2026-07-17T17-27-24-856Z/atomic-reports/ufgrowfun_com/2026-07-18T04-35-22-231Z
Catalog SHA-256: sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7
Raw screenshots, HARs, traces, heaps, and other browser artifacts are retained at the local evidence root and intentionally are not committed. Artifact paths in the canonical report are relative to that root.