Manifest position 69 · CrUX rank bucket 1000
https://secure.therapservices.net
Partial after retries
The public login, reset, help, responsive states, and 404 recovery were audited. Three end-to-end authenticated checks are blocked because no authorized test credentials were supplied.
Attempts
3 / 3
Judged checks
55 / 58
Blocked
3
Not run
0
This report has no published overall score. Blocked and not-run checks are not passes. A coverage-complete report means every check has a judged outcome; it does not mean every check passed.
All 58 atomic check outcomes
| Principle / check | Status | Confidence | Evidence or reason |
|---|---|---|---|
respect-user-preferencesrespects-color-scheme | issues | high | The prefers-color-scheme: dark screenshot is visually identical to the light presentation, and the CSS probe found no prefers-color-scheme or color-scheme implementation. F001 medium: The login surface remains light when the user requests a dark color scheme. |
respect-user-preferencesrespects-reduced-motion | pass | high | Reduced-motion probe found Bootstrap and Font Awesome media rules suppressing transitions/animations and no active animations. |
respect-user-preferencesrespects-contrast | pass | high | Forced-colors/high-contrast screenshot keeps text, controls, borders, focus, and links visible. |
implement-natural-interactionsview-transitions | issues | high | The rendered CSS/source probe found no view-transition-name, ::view-transition, or document-startViewTransition usage on the login and recovery surfaces. F002 low: State and route changes have no View Transition treatment. |
implement-natural-interactionsscroll-driven-animations | pass | high | No scroll-linked animation exists, and the page uses no scroll event animation handlers, so there is no main-thread scroll-motion anti-pattern. |
implement-natural-interactionsphysical-gestures | pass | high | The tested public surfaces use native scrolling, form controls, links, and a standard collapsible menu rather than custom pointer-drag gestures. |
provide-guided-navigationscroll-state-aware-chrome | pass | high | The long mobile page scrolls normally with no sticky chrome that needs JS scroll-state synchronization. |
provide-guided-navigationanchored-positioning | pass | high | Openable UI is full-width navigation/help UI rather than a tethered tooltip/menu; no overlay drift was observed at mobile or desktop edges. |
provide-guided-navigationdirects-attention | pass | high | Heading, form sequence, full-width Continue action, recovery links, reset notice, and 404 home recovery clearly direct the next action. |
maximize-content-reduce-noiseno-intrusive-interruptions | pass | high | Initial screenshots show no consent wall, popup, or interstitial obscuring the login/reset task. |
maximize-content-reduce-noisesemantic-dismissible-primitives | issues | high | DOM inspection shows #trouble-logging-modal-view is a div with role=dialog, static backdrop wiring, and an iframe, not a <dialog> or popover. F003 medium: Login help uses a custom Bootstrap modal rather than the native dialog/top-layer primitive. |
maximize-content-reduce-noisereduced-chrome | issues | high | The mobile screenshot places Release Notes immediately after the form; HAR shows embedded promotional panes account for much of 1.31 MB transferred and 22 third-party requests. F004 medium: Promotional iframe chrome competes with a security-sensitive login task. |
adapt-to-the-form-factorresponsive-no-horizontal-scroll | pass | high | At 360x800 the layout primitive measured scrollWidth=clientWidth=360, horizontalOverflowPx=0, with viewport meta present. |
adapt-to-the-form-factorcomponent-level-responsiveness | issues | high | DOM/CSS inspection found Bootstrap viewport grid classes but no @container or container-type declarations for reusable login, reset, navigation, or release-note components. F005 low: Responsiveness is viewport-only rather than component-aware. |
adapt-to-the-form-factorinput-modality-aware | pass | high | Primary fields are 58px high, Continue is 38px, keyboard focus is visible on native controls, and no hover-only primary action was found; smaller ancillary targets are separately reported under inclusive zoom/targets. |
support-core-task-successclear-purpose-and-primary-action | pass | high | First viewport clearly labels Login, asks for Login Name and Provider Code, and presents one full-width Continue action. |
support-core-task-successprimary-flow-completion | blocked | high | The public identifier step was inspected, but no authorized test credentials were supplied, so password/passkey, authenticated completion, cancellation, and sensitive account actions could not be exercised. |
support-core-task-successclear-system-state-and-recovery | pass | high | The reset route explains prerequisites and the real HTTP 404 provides a clear home recovery action. |
be-fast-and-stablegood-core-web-vitals | issues | high | Lighthouse measured LCP 4.6s, FCP 4.4s, TBT 230ms, and performance score 0.69; an unthrottled trace measured LCP 1.66s, showing network/CPU conditions drive the regression. F009 high: The login page misses the good LCP range under Lighthouse mobile throttling. |
be-fast-and-stablevisual-stability | pass | high | Mobile layout observation measured CLS 0 with no shifts; Lighthouse also reports CLS 0. |
be-fast-and-stableefficient-main-thread | pass | high | Trace recorded one 85.56ms long task and 35.56ms TBT; Lighthouse TBT was 230ms, below the 300ms lab poor threshold. |
be-fast-and-stableefficient-resource-delivery | issues | high | The DOM has 17 classic scripts in <head> without async/defer plus many stylesheets; HAR identifies high-priority parser-blocking styles, absent cache headers, and 1.31MB transferred; Lighthouse estimates 2.18s render-blocking savings. F010 high: A long chain of parser-blocking CSS and classic head scripts delays the login UI. |
be-fast-and-stabletrim-unused-and-duplicate-code | issues | high | Lighthouse estimates 192KiB unused JS and 49KiB unused CSS; HAR records two near-identical 184KiB gtag resources plus a 146KiB GTM script. F011 medium: The login page ships substantial unused CSS and duplicate analytics JavaScript. |
be-inclusivenames-roles-labels | issues | high | Lighthouse found the language-picker button has no accessible name and rightPaneFrame has no title; the platform probe also found leftPaneFrame and rightPaneFrame titles empty. F006 high: The custom language picker and promotional frames are not reliably named for assistive technology. |
be-inclusivesufficient-contrast | pass | high | Lighthouse color-contrast audit passed, and forced-colors screenshot remained readable. |
be-inclusivestructure-and-focus | issues | high | DOM inspection found no h1 on login, reset, or 404; the focus probe reports outline none and box-shadow none for #languageSelectPickerBtn. F007 medium: The heading hierarchy starts at h2 and the custom language picker lacks a visible focus treatment. |
be-inclusivelegible-text | pass | high | Mobile screenshots show unclipped labels and readable paragraphs with no horizontal overflow; reset fields wrap without content loss. |
be-inclusivezoom-reflow-targets-and-media | issues | high | The focus/geometry probe measured the language combobox at 24px high and footer/help links at 14px high; the mobile page otherwise reflows without horizontal overflow. F008 medium: Several interactive targets are materially smaller than the recommended touch size. |
follow-best-practicesno-console-errors | pass | high | Lighthouse errors-in-console audit passed with no logged errors. |
follow-best-practicessound-document-and-assets | issues | high | Lighthouse image-size-responsive reports the 100x40 PNG displayed at 100x40 where 150x60 source pixels are expected for the tested DPR. F012 low: The logo raster is undersized for the rendered device-pixel requirement. |
follow-best-practicesbrowser-platform-hygiene | pass | high | Lighthouse found no console/deprecation issue or intrusive permission prompt; the BFCache no-store finding is appropriate for an authentication response. |
be-discoverabletitle-and-description | not-applicable | high | The authenticated application is deliberately gated; search-result presentation of the login endpoint is not a core outcome. |
be-discoverablecrawlable-and-mobile-friendly | pass | high | Viewport meta is present and normal links have real href values; Lighthouse crawlable anchors and crawlability audits passed. Public indexing is not a goal for the gated app. |
be-discoverablecanonical-and-indexing-signals | not-applicable | high | The authenticated application is deliberately gated and does not need canonical/hreflang/sitemap indexing signals on its login endpoint. |
be-discoverablestructured-and-shareable-metadata | not-applicable | high | Login, reset, and error pages do not represent a public rich entity or shareable content item. |
be-private-and-securesecure-transport-and-headers | issues | high | The headers primitive confirms HTTPS but no Content-Security-Policy, Strict-Transport-Security, or X-Content-Type-Options on the login document. F013 critical: The authentication response lacks core browser security headers. |
be-private-and-securedata-minimisation-and-third-parties | issues | high | Tracker evidence finds 7 third-party origins including GTM and DoubleClick; HAR attributes 1.10MB to third parties; cookies include two non-Secure Google Analytics cookies lasting 400 days. F015 high: A login page sends extensive analytics traffic and sets long-lived analytics cookies before authentication. |
be-private-and-securein-context-permissions-and-modern-auth | blocked | high | The public identifier step was inspected, but no authorized test credentials were supplied, so password/passkey, authenticated completion, cancellation, and sensitive account actions could not be exercised. |
be-private-and-securedefensive-browser-policies | issues | high | The headers primitive found neither frame-ancestors/X-Frame-Options nor Referrer-Policy or Permissions-Policy on the authentication response. F014 high: Clickjacking, referrer, and permissions defenses are not declared. |
be-resilientprogressive-enhancement | pass | high | The login and reset forms are server-rendered HTML with native labels, required controls and form actions; noscript gives an explicit status rather than a blank shell. |
be-resilientresilient-runtime-behaviour | pass | high | The mobile form, menu and recovery pages fit the viewport; modal cycles kept DOM nodes stable after initial help iframe creation. |
be-resilientoffline-and-installable | not-applicable | high | This is an intrinsically online, security-sensitive authenticated service; installability/offline authentication is not an appropriate requirement. |
be-resilientnetwork-and-http-failure-states | pass | high | A genuine unknown route returned HTTP 404 with a concise message and a Go Back to HomePage recovery link. |
be-internationalisedlang-dir-and-logical-properties | issues | high | DOM evidence for a real 404 response reports html.lang empty, while login and reset correctly use lang=en. F020 medium: The custom 404 response omits the document language. |
be-internationalisedlocale-aware-data | not-applicable | high | The public pages show no dates, currency, numbers, durations, or calendars requiring locale formatting. |
be-internationalisedtime-zone-correctness | not-applicable | high | The public pages expose no scheduled or stored time concepts. |
be-trustworthyno-dark-patterns | pass | high | No confirmshaming, forced continuity, preselected consent, disguised action, or cancellation obstruction was observed on public login/reset surfaces. |
be-trustworthyhumane-error-handling | pass | high | Required login fields use native required semantics and visible labels; reset instructions explain account prerequisites and recovery ownership without blaming the user. |
be-trustworthytrustworthy-input-assistance | issues | high | DOM and platform probes show loginName and providerCode have empty autocomplete values despite form autocomplete=on. F016 medium: Authentication identifiers do not expose standard autocomplete semantics. |
be-trustworthysafe-commercial-and-account-flows | blocked | high | The public identifier step was inspected, but no authorized test credentials were supplied, so password/passkey, authenticated completion, cancellation, and sensitive account actions could not be exercised. |
be-sustainableoptimised-assets | issues | high | HAR transfers 544KB of images, led by a 191KB animated GIF and multiple 64-98KB promo images; the logo is a legacy PNG with no responsive source. F017 medium: Promotional raster and animated GIF assets are disproportionate to the login task. |
be-sustainableno-wasteful-work | issues | high | HAR records 22 third-party requests and 1.10MB third-party transfer before user interaction, including duplicate analytics libraries and off-task promo frames. F018 medium: Nonessential promotional and analytics work runs during the critical login load. |
be-sustainablethird-party-and-media-budget | issues | high | Third parties account for 1,102,090 of 1,310,615 transferred bytes (84%), with GTM/gtag and promotional embeds dominating the budget. F019 medium: Third-party transfer dominates a simple two-field login page. |
be-agent-readystructured-agent-capabilities | not-applicable | high | Exposing authentication/account actions to agents was judged inappropriate without an explicit safe agent-facing product intent. |
be-agent-readyon-device-inference | not-applicable | high | The public authentication and recovery surfaces have no inference task where a built-in model would improve the experience. |
be-memory-efficientno-leak-under-repeated-interaction | issues | medium | In one session usedJSHeapSize rose from 11.38MB before interaction to 11.75MB after 10 cycles and 12.88MB after 20 while DOM nodes stabilized at 159; separate heap summaries rose from 20.55MB to 24.77MB after 10 cycles. This is a suspicion, not proof of an unbounded leak. F021 low: Repeated help-modal cycles show continued heap growth that warrants leak investigation. |
be-memory-efficientbounded-footprint | pass | high | Baseline heap summary reports 20.55MB self size for a page with two promotional iframes; the footprint is finite, though network/UI complexity should be reduced. |
be-memory-efficientno-detached-dom-or-unbounded-listeners | pass | high | Heap constructor summaries show no Detached* population, and repeated modal cycles stabilized DOM nodes at 159; no direct detached-DOM evidence was found. |
Provenance
Canonical report: results/atomic/reports/0069-secure_therapservices_net.json
Report SHA-256: ed0d7e01e573bc4dff941665b2e75eafb859bff1497cc6d92dda412ad303f28f
Local retained report: runs/2026-07-17T17-27-24-856Z/atomic-reports/secure_therapservices_net/2026-07-27T13-22-56-133Z/report.json
Local evidence root: runs/2026-07-17T17-27-24-856Z/atomic-reports/secure_therapservices_net/2026-07-27T13-22-56-133Z
Catalog SHA-256: sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7
Raw screenshots, HARs, traces, heaps, and other browser artifacts are retained at the local evidence root and intentionally are not committed. Artifact paths in the canonical report are relative to that root.