Manifest position 70 · CrUX rank bucket 1000
https://m.klikbca.com
Partial after retries
Public login audited; 3 checks requiring authenticated banking/account access are blocked by the credential boundary.
Attempts
3 / 3
Judged checks
55 / 58
Blocked
3
Not run
0
This report has no published overall score. Blocked and not-run checks are not passes. A coverage-complete report means every check has a judged outcome; it does not mean every check passed.
All 58 atomic check outcomes
| Principle / check | Status | Confidence | Evidence or reason |
|---|---|---|---|
respect-user-preferencesrespects-color-scheme | issues | high | Dark/reduced screenshot remains a hard-coded white, blue and yellow surface; style.css has no prefers-color-scheme rule. F-01 high: Dark mode is not supported |
respect-user-preferencesrespects-reduced-motion | issues | high | The login contains an auto-advancing eight-image banner, while CSS has no prefers-reduced-motion handling. F-02 medium: Reduced-motion preference is ignored |
respect-user-preferencesrespects-contrast | issues | high | Axe measured contrast as low as 2.09:1 and no prefers-contrast/forced-colors adaptation exists. F-03 high: Text contrast fails WCAG AA |
implement-natural-interactionsview-transitions | issues | high | The entry performs JavaScript document redirects and the carousel swaps state; CDP found no view-transition CSS. F-04 low: State changes do not use view transitions |
implement-natural-interactionsscroll-driven-animations | not-applicable | high | No scroll-linked animation, parallax, reveal or scrollytelling surface exists on the public login page. |
implement-natural-interactionsphysical-gestures | issues | high | Carousel navigation is hand-wired to onclick anchors without href; no scroll-snap or native gesture semantics were found. F-05 medium: Carousel controls fight platform semantics |
provide-guided-navigationscroll-state-aware-chrome | not-applicable | high | The public login is a short, single-screen form with no sticky chrome or meaningful scroll state. |
provide-guided-navigationanchored-positioning | not-applicable | high | No tooltip, popover, anchored menu or similar overlay is present on the public login. |
provide-guided-navigationdirects-attention | issues | high | Carousel arrows are href-less anchors and image banners are onclick-only, so navigation state and focus movement are not semantically communicated. F-06 medium: Navigation state is not communicated |
maximize-content-reduce-noiseno-intrusive-interruptions | pass | high | Load screenshots show no consent wall, interstitial or content-obscuring popup. |
maximize-content-reduce-noisesemantic-dismissible-primitives | pass | high | DOM inspection found no custom modal/popover/disclosure overlay requiring a semantic primitive. |
maximize-content-reduce-noisereduced-chrome | issues | high | The viewport is dominated by legacy framed chrome and empty space while the login content is rendered extremely small. F-07 high: Legacy chrome overwhelms the login |
adapt-to-the-form-factorresponsive-no-horizontal-scroll | issues | high | At a 360px viewport the layout primitive reports a 980 CSS-pixel layout viewport and no effective viewport meta; the page is scaled down rather than reflowed. F-08 critical: Mobile layout is a scaled desktop canvas |
adapt-to-the-form-factorcomponent-level-responsiveness | issues | high | CSS has zero media queries and no @container rules; fixed-width tables and absolute positions govern layout. F-09 high: Components cannot adapt to available space |
adapt-to-the-form-factorinput-modality-aware | pass | high | Lighthouse target-size passed and CDP measured a visible browser focus outline on the first link. |
support-core-task-successclear-purpose-and-primary-action | pass | high | The first view clearly asks for User ID and Internet Banking PIN and exposes a LOGIN action. |
support-core-task-successprimary-flow-completion | blocked | high | End-to-end banking login and post-authentication tasks require valid customer credentials, which were not available and must not be fabricated. |
support-core-task-successclear-system-state-and-recovery | issues | high | Client validation reports mistakes with blocking alert() calls and has no inline, persistent or programmatically associated recovery text. F-10 high: Validation offers weak recovery |
be-fast-and-stablegood-core-web-vitals | issues | high | The entry-url trace measured LCP 3.74s, outside the good 2.5s range, although Lighthouse on the redirected login measured 2.3s. F-11 medium: Entry LCP is slow across redirects |
be-fast-and-stablevisual-stability | pass | high | Layout observed CLS 0.0018 and Lighthouse measured CLS 0.025, both within the good range. |
be-fast-and-stableefficient-main-thread | pass | high | Trace observed no long tasks and 0ms TBT; Lighthouse measured 90ms TBT. |
be-fast-and-stableefficient-resource-delivery | issues | high | HAR captured 53 requests/1.30MB, parser-blocking classic scripts without async/defer, uncompressed JS up to 329KB, and multiple high-priority styles/scripts. F-12 high: Resource delivery is inefficient |
be-fast-and-stabletrim-unused-and-duplicate-code | issues | high | Lighthouse estimates 46KiB unused JavaScript; HAR shows jsencrypt and security scripts loaded across both m. and ibank. redirect documents. F-13 medium: Unused and duplicate JavaScript ships on login |
be-inclusivenames-roles-labels | issues | high | Axe found both credential inputs unlabelled, 16 image-alt failures and unnamed image links; the image probe found 23/23 rendered images missing alt. F-14 critical: Credential fields and images lack accessible names |
be-inclusivesufficient-contrast | issues | high | Axe found seven contrast failures, including orange-on-white at 2.09:1. F-15 high: Essential text has insufficient contrast |
be-inclusivestructure-and-focus | issues | high | Axe found no main landmark or h1 and extensive content outside landmarks; carousel anchors are not real links. F-16 high: Document landmarks and heading structure are missing |
be-inclusivelegible-text | issues | high | The 360px screenshot shows the fixed desktop layout scaled to tiny text; CSS includes 9px and 10px text sizes. F-17 high: Text is too small to read comfortably |
be-inclusivezoom-reflow-targets-and-media | issues | high | Lighthouse fails meta-viewport because maximum-scale is below 5; the layout does not reflow at 360px. F-18 critical: Viewport prevents zoom and reflow |
follow-best-practicesno-console-errors | pass | high | Lighthouse reports no browser console errors; CDP recorded no uncaught exceptions. |
follow-best-practicessound-document-and-assets | issues | high | The journey reaches a document with no parsed doctype and windows-1252, while the image audit reports 10 missing dimensions and one oversized image. F-19 medium: Document and image foundations are unsound |
follow-best-practicesbrowser-platform-hygiene | issues | high | CDP logs malformed viewport-meta parsing and a password field outside a form; multiple actions use javascript: URLs. F-20 medium: Browser platform hygiene warnings remain |
be-discoverabletitle-and-description | issues | high | The title is generic and both raw/rendered probes find no meta description. F-21 medium: Search metadata is incomplete |
be-discoverablecrawlable-and-mobile-friendly | issues | high | The raw entry depends on JavaScript redirect, Full Site/Privacy actions use javascript: URLs, and robots.txt returns a branded 404 page. F-22 high: Entry and links depend on JavaScript |
be-discoverablecanonical-and-indexing-signals | issues | high | No canonical is present and both robots.txt and sitemap.xml return 404 content; no consistent indexing signals were found. F-23 medium: Canonical and indexing signals are absent |
be-discoverablestructured-and-shareable-metadata | not-applicable | high | The public surface is a credential login, not an article, product, event or other rich entity that warrants schema.org or social-preview metadata. |
be-private-and-securesecure-transport-and-headers | issues | high | HTTPS, HSTS, nosniff and SAMEORIGIN are present on m. responses, but CSP, Referrer-Policy and Permissions-Policy are absent; one 400-day cookie is not Secure. F-24 high: Security policy and cookie gaps remain |
be-private-and-securedata-minimisation-and-third-parties | pass | high | Tracker scan found no known analytics trackers; network origins are limited to m.klikbca.com and the same-organisation ibank.klikbca.com. |
be-private-and-securein-context-permissions-and-modern-auth | blocked | high | No permission prompt occurs on load, but the authentication methods available after the credential boundary (including passkey support) cannot be inspected without an account. |
be-private-and-securedefensive-browser-policies | issues | high | Clickjacking and HSTS defenses exist, but CSP/frame-ancestors, Referrer-Policy and Permissions-Policy are absent and all cookies report SameSite=None. F-25 high: Defensive browser policies are incomplete |
be-resilientprogressive-enhancement | issues | high | Discoverability measured only 2% raw/rendered content overlap and isJsShell=true; without JS the page only says JavaScript is required. F-26 critical: Core entry is unavailable without JavaScript |
be-resilientresilient-runtime-behaviour | issues | high | The same entry journey inconsistently transitions from m. login to fixed-width ibank desktop UI, and overlays/navigation rely on brittle javascript: handlers and absolute positioning. F-27 high: Runtime routing is brittle and form-factor dependent |
be-resilientoffline-and-installable | not-applicable | high | Authenticated internet banking is intrinsically online and transaction data must not be presented as operable offline; no installability intent is evident. |
be-resilientnetwork-and-http-failure-states | issues | high | Representative missing routes (/robots.txt and /sitemap.xml) return a bare legacy 404 with no navigation or recovery action. F-28 medium: HTTP failure pages offer no recovery |
be-internationalisedlang-dir-and-logical-properties | issues | high | The bilingual Indonesian/English page has no html lang or dir; CSS uses no logical properties. F-29 high: Bilingual content has no language metadata |
be-internationalisedlocale-aware-data | not-applicable | high | The public login presents no dates, currencies, durations or locale-formatted values to assess. |
be-internationalisedtime-zone-correctness | not-applicable | high | The public login presents no event scheduling or time-zone-sensitive data. |
be-trustworthyno-dark-patterns | pass | high | Public login copy states its purpose, contains no consent wall, upsell, pricing or forced-continuity choice, and exposes no misleading default. |
be-trustworthyhumane-error-handling | issues | high | Validation uses blocking alert() messages, focuses fields manually, and provides no inline aria-live/aria-invalid feedback. F-30 high: Form errors rely on blocking alerts |
be-trustworthytrustworthy-input-assistance | issues | high | Both User ID and password/PIN inputs explicitly set autocomplete="off" instead of appropriate username/current-password tokens. F-31 high: Credential autofill is disabled |
be-trustworthysafe-commercial-and-account-flows | blocked | high | Cancellation, transaction confirmation, reauthentication and account-management flows are behind valid customer authentication and could not be exercised safely. |
be-sustainableoptimised-assets | issues | high | Image audit reports 23 legacy GIF/PNG/JPG images, no modern formats, 10 missing dimensions, five missing srcset and one oversized asset. F-32 medium: Login images are not resource-efficient |
be-sustainableno-wasteful-work | issues | high | The login fetches all eight banner images and 12 scripts during the entry journey, including duplicate libraries across redirects. F-33 medium: The page performs avoidable network work |
be-sustainablethird-party-and-media-budget | issues | high | The lightweight login transfers 1.30MB; 1.19MB is attributed to the ibank subdomain and includes eight promotional banners plus large scripts. F-34 medium: Page weight is disproportionate to the login task |
be-agent-readystructured-agent-capabilities | not-applicable | high | A high-sensitivity authenticated banking login has no declared agent-facing surface; exposing transaction tools is not assumed appropriate. |
be-agent-readyon-device-inference | not-applicable | high | The public login has no summarisation, generation or other inference task where built-in on-device AI would improve the experience. |
be-memory-efficientno-leak-under-repeated-interaction | pass | high | After ten carousel-next interactions heap self-size decreased from 8,602,299 to 8,535,825 bytes; node count changed only 132,280 to 132,410. |
be-memory-efficientbounded-footprint | pass | high | Baseline heap is 8.6MB with 132,280 nodes; CDP reports 10.6MB JS heap and 498 DOM nodes, proportionate for this page. |
be-memory-efficientno-detached-dom-or-unbounded-listeners | pass | high | Neither heap summary reports Detached* constructors, and repeated carousel interaction produced only 130 additional snapshot nodes with lower total self-size. |
Provenance
Canonical report: results/atomic/reports/0070-m_klikbca_com.json
Report SHA-256: a7c6c3e81f384c3d5ef482e0fa9c0068d657c1b7797a9c45e23fb004efc4b682
Local retained report: runs/2026-07-17T17-27-24-856Z/atomic-reports/m_klikbca_com/2026-07-27T13-34-36-823Z/report.json
Local evidence root: runs/2026-07-17T17-27-24-856Z/atomic-reports/m_klikbca_com/2026-07-27T13-34-36-823Z
Catalog SHA-256: sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7
Raw screenshots, HARs, traces, heaps, and other browser artifacts are retained at the local evidence root and intentionally are not committed. Artifact paths in the canonical report are relative to that root.