Manifest position 235 · CrUX rank bucket 1000
https://www.redtube.com
Coverage complete
Regional access gating redirects homepage, category and unknown routes to login. Audit covers the public login gate, invalid-login recovery, privacy notice, contact form, Arabic locale, and indexing endpoints. Authenticated video/detail, playback, account, subscription and cancellation flows were not included because no credentials were provided and new registration is unavailable in this region.
Attempts
1 / 3
Judged checks
58 / 58
Blocked
0
Not run
0
This report has no published overall score. Blocked and not-run checks are not passes. A coverage-complete report means every check has a judged outcome; it does not mean every check passed.
All 58 atomic check outcomes
| Principle / check | Status | Confidence | Evidence or reason |
|---|---|---|---|
respect-user-preferencesrespects-color-scheme | issues | high | The page remains visually identical under prefers-color-scheme: dark and reports computed color-scheme "normal", showing a fixed dark palette rather than a declared preference-aware scheme. F01 low: Declare a preference-aware color scheme |
respect-user-preferencesrespects-reduced-motion | pass | high | The preference was active and the login page had no running animations or auto-advance to suppress. |
respect-user-preferencesrespects-contrast | issues | high | The high-contrast capture is unchanged; Lighthouse found red links at 2.75:1 and a green signup control at 2.51:1. F02 high: High-contrast preferences do not improve already-failing contrast |
implement-natural-interactionsview-transitions | issues | medium | The browser API exists, but no view-transition CSS or authored transition was found; the form state changes abruptly. F03 low: Form state changes are abrupt |
implement-natural-interactionsscroll-driven-animations | pass | medium | No scroll-linked effects or JavaScript-driven parallax were present, so the page avoids the main-thread anti-pattern. |
implement-natural-interactionsphysical-gestures | pass | medium | No custom pointer gesture surface, swipe control, or scroll-jacking behavior was present on the audited public paths. |
provide-guided-navigationscroll-state-aware-chrome | issues | medium | The long privacy document has no progress indicator or scroll-state-aware navigation; its chrome remains static throughout a very long page. F04 low: Long legal content lacks progress/orientation |
provide-guided-navigationanchored-positioning | issues | high | Open overlays are custom role=dialog divs; no dialog/popover or CSS anchor positioning primitives were found. F05 medium: Overlays rely on custom positioning |
provide-guided-navigationdirects-attention | pass | medium | The login heading, focused invalid field, assertive error, and reset link make the current state and next action clear. |
maximize-content-reduce-noiseno-intrusive-interruptions | pass | medium | The on-load gate is required for this region, clearly explains the age/auth restriction, and does not masquerade as unrelated promotional content. |
maximize-content-reduce-noisesemantic-dismissible-primitives | issues | high | The login and cookie experiences use custom divs with role=dialog rather than native dialog/popover controls, requiring manual modality and dismissal behavior. F06 medium: Custom divs implement modal experiences |
maximize-content-reduce-noisereduced-chrome | issues | medium | Desktop renders a login dialog over a duplicate login/signup page, while mobile renders a separate gate, creating redundant chrome and competing signup messaging. F07 medium: Login chrome is duplicated and visually noisy |
adapt-to-the-form-factorresponsive-no-horizontal-scroll | issues | high | Both mobile runs lacked a viewport meta tag and rendered a 1070 CSS-pixel desktop layout scaled down into a 360px device viewport. F08 high: Mobile receives a scaled desktop canvas |
adapt-to-the-form-factorcomponent-level-responsiveness | issues | medium | No container-query rules were found and the form/page shell does not genuinely adapt; Chrome scales a desktop-width canvas instead. F09 medium: Components do not adapt to their available container |
adapt-to-the-form-factorinput-modality-aware | issues | high | Most controls have a visible 2px focus outline, but the checkbox has no outline and key recovery links are only 16px high; Lighthouse failed target size. F10 high: Some keyboard/touch affordances are too small or invisible |
support-core-task-successclear-purpose-and-primary-action | pass | high | The gated page clearly says Login, presents email/password and recovery links, and explains that registration is unavailable in this region. |
support-core-task-successprimary-flow-completion | issues | high | The requested homepage and a category route both redirect to login, while the page states new registrations are unavailable in this region, leaving a new visitor with no path to the advertised content. F11 high: New regional visitors reach a dead end |
support-core-task-successclear-system-state-and-recovery | pass | high | Submitting the login form empty focuses the email field and exposes “Please enter a valid email address” in an aria-live=assertive error region. |
be-fast-and-stablegood-core-web-vitals | issues | high | Mobile Lighthouse measured LCP 5.1s; the desktop trace measured LCP 1.86s, demonstrating poor mobile load performance despite zero CLS. F12 high: Mobile LCP is slow |
be-fast-and-stablevisual-stability | pass | high | Login CLS was 0 and contact CLS was 0.0069, both in the good range. |
be-fast-and-stableefficient-main-thread | issues | high | The desktop trace captured one 408.77ms long task and 358.77ms total blocking time. F13 medium: A long task blocks the main thread |
be-fast-and-stableefficient-resource-delivery | issues | high | The login load transferred 2.04MB, including a 1.55MB document and four parser-inserted very-high-priority stylesheets; mobile LCP was 5.1s. F14 high: The simple login load transfers 2.04MB |
be-fast-and-stabletrim-unused-and-duplicate-code | issues | high | Lighthouse estimated 172KiB unused JavaScript, including 71KiB and 62KiB in two tag-manager bundles; 23 of 28 requests were third-party. F15 medium: Large unused JavaScript ships on login |
be-inclusivenames-roles-labels | pass | high | Lighthouse passed label, image-alt and landmark audits; visible login/contact fields have labels and inspected images have alt text. |
be-inclusivesufficient-contrast | issues | high | Lighthouse found multiple links at 2.75:1 and a signup control at 2.51:1, below WCAG minimums. F16 high: Important text and controls fail contrast |
be-inclusivestructure-and-focus | issues | high | Two recovery links use tabindex=4, disrupting natural focus order, and the visible checkbox has no focus outline. F17 medium: Focus order and visibility are inconsistent |
be-inclusivelegible-text | pass | medium | Text is crisp, aligned, and readable in the desktop captures; the long privacy notice uses clear sectioning and comfortable line length on desktop. |
be-inclusivezoom-reflow-targets-and-media | issues | high | The viewport declares user-scalable=no/maximum-scale=1 in Lighthouse, while primitive runs observed no effective viewport meta; the page is scaled from 1070px and recovery targets are only 16px high. F18 high: Zoom is disabled and mobile does not reflow |
follow-best-practicesno-console-errors | pass | high | Lighthouse reported no console errors or uncaught exceptions. |
follow-best-practicessound-document-and-assets | issues | high | Doctype/charset and aspect ratio passed, but 14 of 24 inspected images omit explicit dimensions and three below-fold images are not lazy-loaded. F19 medium: Image markup omits stability/loading hints |
follow-best-practicesbrowser-platform-hygiene | issues | high | The page is excluded from BFCache by no-store responses and Lighthouse logged a cookie inspector issue; deprecated APIs and source maps otherwise passed. F20 low: The login page cannot use BFCache |
be-discoverabletitle-and-description | pass | high | Login has a descriptive title and meta description, both present in raw HTML; privacy and contact also have titles. |
be-discoverablecrawlable-and-mobile-friendly | issues | high | Anchors are crawlable, but /robots.txt serves the login HTML (2,008 Lighthouse parse errors) and the mobile viewport disables zoom/does not map to device width. F21 high: robots.txt serves HTML instead of crawler rules |
be-discoverablecanonical-and-indexing-signals | issues | high | Canonical URLs and sitemap.xml exist, but robots.txt is replaced by login HTML, making crawler policy invalid and inconsistent with the sitemap. F22 high: Robots and sitemap indexing signals conflict |
be-discoverablestructured-and-shareable-metadata | not-applicable | high | The login, contact, and legal notice pages are not article/product/event entities requiring rich-result metadata. |
be-private-and-securesecure-transport-and-headers | issues | high | HTTPS is used, but CSP, HSTS and nosniff are absent; PHPSESSID is neither Secure nor HttpOnly and all seven cookies use SameSite=None. F23 high: Security headers and cookie protections are incomplete |
be-private-and-securedata-minimisation-and-third-parties | issues | high | The login page contacts seven third-party origins, including Google Tag Manager and Google Analytics; 23/28 requests and 482KB are third-party before login. F24 high: Tracking starts on the login page |
be-private-and-securein-context-permissions-and-modern-auth | issues | high | No permission prompt fires on load, but the only visible authentication method is password-based; no passkey/WebAuthn affordance is exposed. F25 medium: Authentication exposes no phishing-resistant option |
be-private-and-securedefensive-browser-policies | issues | high | X-Frame-Options is present, but HSTS, CSP/frame-ancestors, Referrer-Policy and Permissions-Policy are absent. F26 high: Browser-enforced policies are mostly absent |
be-resilientprogressive-enhancement | pass | high | The raw server HTML contains 100% of rendered content tokens and retains title, h1 and description without JavaScript. |
be-resilientresilient-runtime-behaviour | pass | medium | The visible login dialog stays within the desktop viewport and repeated invalid submissions preserve the form and a single actionable error. |
be-resilientoffline-and-installable | not-applicable | high | A manifest exists, but this media service and authentication flow are intrinsically online; offline installability is not a reasonable core requirement. |
be-resilientnetwork-and-http-failure-states | issues | medium | A nonexistent URL silently redirects to the normal login screen, with no not-found explanation or recovery state distinct from valid gated content. F27 medium: Unknown routes have no distinct recovery state |
be-internationalisedlang-dir-and-logical-properties | issues | high | The Arabic page sets lang=ar but omits dir=rtl, remains largely English, and inspected CSS uses physical left/right positioning. F28 high: Arabic localization is incomplete and lacks RTL semantics |
be-internationalisedlocale-aware-data | issues | medium | The localized surface remains mostly English and the privacy notice renders an English-only hand-formatted date (“April 16th, 2026”), with no locale-aware alternative observed. F29 low: Locale-sensitive content is hard-formatted in English |
be-internationalisedtime-zone-correctness | not-applicable | high | No time-zone-sensitive event, booking, schedule, or timestamp flow appears on the login, contact, or legal pages. |
be-trustworthyno-dark-patterns | pass | medium | Registration unavailability, credential changes, legal notices and privacy links are disclosed plainly; persistent login is not preselected in the inspected form. |
be-trustworthyhumane-error-handling | pass | high | Validation occurs after submission, focuses the relevant field, and announces a specific error assertively without blame. |
be-trustworthytrustworthy-input-assistance | issues | high | Email and password inputs omit autocomplete tokens; contact email also omits autocomplete=email. F30 medium: Login and contact inputs omit autocomplete hints |
be-trustworthysafe-commercial-and-account-flows | pass | medium | The login surface exposes password recovery and clearly discloses regional registration limits; no pricing, subscription continuity, or preselected consent was presented on audited public paths. |
be-sustainableoptimised-assets | issues | high | Three images use legacy PNG/GIF formats, 14 images lack dimensions, three below-fold images are not lazy-loaded, and three raster images lack srcset. F31 medium: Several image assets are not efficiently delivered |
be-sustainableno-wasteful-work | issues | high | Two analytics bundles transfer about 296KB and Lighthouse marks about 133KB of them unused on the login page; total unused JS estimate is 172KiB. F32 medium: Analytics code does substantial unused work |
be-sustainablethird-party-and-media-budget | issues | high | Third parties account for 23/28 requests and 482KB on a simple login page, including two tag-manager payloads and analytics before authentication. F33 medium: Third-party cost is disproportionate to login value |
be-agent-readystructured-agent-capabilities | not-applicable | high | No developer intent or user-facing agent workflow is declared for the gated media/login and legal-information surfaces. |
be-agent-readyon-device-inference | not-applicable | high | No developer intent or user-facing agent workflow is declared for the gated media/login and legal-information surfaces. |
be-memory-efficientno-leak-under-repeated-interaction | pass | medium | After ten submissions DOM elements remained 697 and only one error remained; heap self-size rose 10.70MB to 11.33MB (5.9%), not an unbounded pattern in this bounded exercise. |
be-memory-efficientbounded-footprint | pass | medium | Baseline heap self-size was 10.70MB with 182,753 heap nodes, proportionate to the login page; used JS heap was about 12.3MB. |
be-memory-efficientno-detached-dom-or-unbounded-listeners | pass | medium | Neither heap summary reports Detached* constructors and the live DOM count stayed exactly 697 after ten repeated submissions. |
Provenance
Canonical report: results/atomic/reports/0235-www_redtube_com.json
Report SHA-256: 0a23ab66a67bf1ebc947d5cd4b96ab5d2775aa2f5d457111272c2b48c65cc9a7
Local retained report: runs/2026-07-17T17-27-24-856Z/atomic-reports/www_redtube_com/2026-07-19T08-26-29-130Z/report.json
Local evidence root: runs/2026-07-17T17-27-24-856Z/atomic-reports/www_redtube_com/2026-07-19T08-26-29-130Z
Catalog SHA-256: sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7
Raw screenshots, HARs, traces, heaps, and other browser artifacts are retained at the local evidence root and intentionally are not committed. Artifact paths in the canonical report are relative to that root.