Manifest position 336 · CrUX rank bucket 1000
https://xhaccess.com
Coverage complete
Coverage-complete audit of five representative public templates and flows. Authenticated, paid, upload, and third-party live flows were excluded because they require credentials, payment, user content, or leave the origin.
Attempts
1 / 3
Judged checks
58 / 58
Blocked
0
Not run
0
This report has no published overall score. Blocked and not-run checks are not passes. A coverage-complete report means every check has a judged outcome; it does not mean every check passed.
All 58 atomic check outcomes
| Principle / check | Status | Confidence | Evidence or reason |
|---|---|---|---|
respect-user-preferencesrespects-color-scheme | issues | high | Default and prefers-color-scheme: dark screenshots are visually identical, and computed CSS reports color-scheme: normal. The interface is hard-coded dark rather than preference-driven. F-01 low: Theme does not respond to the system color preference. |
respect-user-preferencesrespects-reduced-motion | issues | high | The reduced-motion probe found eight running placeholder animations, each with a 2000 ms duration, while prefers-reduced-motion: reduce matched. F-02 medium: Loading animations continue under reduced-motion. |
respect-user-preferencesrespects-contrast | issues | high | Lighthouse accessibility found color-contrast failures, and the prefers-contrast: more capture does not introduce a stronger contrast treatment. F-03 high: Text and controls do not maintain sufficient contrast. |
implement-natural-interactionsview-transitions | issues | high | A 585,604-character accessible CSS corpus contained no view-transition rule, while the site has many route and dialog state changes. F-04 low: Route and state changes lack declarative View Transitions. |
implement-natural-interactionsscroll-driven-animations | not-applicable | high | CSS and visual inspection found no scroll-linked effect that needed an implementation choice. |
implement-natural-interactionsphysical-gestures | pass | medium | Representative browsing uses native scrolling, links, buttons, and form controls; no custom pointer gesture that fights platform behavior was observed. |
provide-guided-navigationscroll-state-aware-chrome | issues | high | The long listing keeps static, space-heavy chrome; CSS inspection found no scroll-state or scroll timeline support. F-05 low: Persistent navigation does not respond to scroll state. |
provide-guided-navigationanchored-positioning | issues | high | The site exposes multiple dropdown/navigation surfaces, but the accessible CSS corpus contains no anchor-name, position-anchor, or position-try rules. F-06 low: Menus are not built with CSS anchor positioning. |
provide-guided-navigationdirects-attention | issues | high | Representative screenshots and CSS inspection show no transition or highlight mechanism that cues where attention moved after route/state changes. F-07 low: Navigation changes provide little visual continuity. |
maximize-content-reduce-noiseno-intrusive-interruptions | issues | high | The desktop load screenshot shows a 502 by 365 pixel consent overlay centered over the first viewport and blocking the listing. F-08 high: A consent modal obscures the primary content on load. |
maximize-content-reduce-noisesemantic-dismissible-primitives | issues | high | The cookie and login surfaces are present, but DOM probes report zero dialog, popover, details, role=dialog, or aria-modal elements. F-09 medium: Custom overlays do not use dialog or popover primitives. |
maximize-content-reduce-noisereduced-chrome | issues | high | At 765 pixels wide, the first viewport is dominated by a 207 pixel sidebar, a 100 pixel header/navigation stack, two promotional banners, and the consent overlay. F-10 high: Navigation, promotions, and sidebars crowd out content. |
adapt-to-the-form-factorresponsive-no-horizontal-scroll | issues | high | All five mobile layout probes report inner/scroll width 1024 against a 360 pixel visual viewport, producing 664 pixels of horizontal overflow. The signup form is mostly off-screen. F-11 critical: The desktop layout is forced into mobile viewports. |
adapt-to-the-form-factorcomponent-level-responsiveness | issues | high | The accessible CSS corpus contains no @container rules, and reused listing/form components remain desktop-sized inside a 360 pixel viewport. F-12 medium: Components do not adapt to their available container. |
adapt-to-the-form-factorinput-modality-aware | issues | high | The focus probe found no outline or box-shadow on the search input/button, Lighthouse failed target-size, and the home probe listed many 16 by 16 or 20 pixel interactive targets. F-13 high: Focus indicators and touch targets are inadequate. |
support-core-task-successclear-purpose-and-primary-action | pass | high | Each representative page has a descriptive title and clear H1 or primary account prompt; the home listing, category index, search results, video detail, and signup purpose are immediately identifiable. |
support-core-task-successprimary-flow-completion | issues | high | At 360 by 800, the signup panel begins around x=327 and extends beyond the screenshot, while layout metrics report 664 pixels of horizontal overflow. Primary signup controls cannot be reached without horizontal panning. F-14 critical: The signup flow is unusable at a common mobile viewport. |
support-core-task-successclear-system-state-and-recovery | pass | high | Search reports a result count and filters, form submission shows field-specific errors and focuses the email input, and an unknown URL returns a branded 404 with a Return to Home action. |
be-fast-and-stablegood-core-web-vitals | issues | high | Lighthouse measured LCP and FCP at 3.5 seconds, while a separate trace measured LCP at 1.59 seconds. The slower controlled run is outside the 2.5 second good range. F-15 medium: Homepage LCP misses the good threshold in Lighthouse. |
be-fast-and-stablevisual-stability | pass | high | Layout observers recorded CLS 0 on home, category, detail, and signup, and 0.00029 on search, all in the good range despite unsized-image risk. |
be-fast-and-stableefficient-main-thread | issues | high | The trace found two long tasks, with a longest task of 175.56 ms and 136.55 ms total blocking time; layout probes also observed tasks up to 195 ms. F-16 medium: Load work includes avoidable long tasks. |
be-fast-and-stableefficient-resource-delivery | issues | high | Lighthouse estimates 1,160 ms savings from render-blocking requests and 115 KiB from cache lifetime improvements. The HAR confirms three parser-inserted VeryHigh-priority stylesheets; scripts are correctly deferred. F-17 high: Render-blocking and cache inefficiencies delay content. |
be-fast-and-stabletrim-unused-and-duplicate-code | issues | high | Lighthouse estimates 57 KiB unused CSS and 26 KiB unused JavaScript; the HAR records 61 scripts and 997,754 transferred script bytes. F-18 medium: The homepage ships excess CSS and JavaScript. |
be-inclusivenames-roles-labels | issues | high | Lighthouse failed button-name, link-name, label-content-name-mismatch, list semantics, and accessibility-tree audits. The category probe counted 220 unlabeled interactive candidates. F-19 high: Interactive controls lack robust accessible names and roles. |
be-inclusivesufficient-contrast | issues | high | Lighthouse scored the color-contrast audit 0 on both home and signup. F-20 high: Text and controls fail WCAG contrast. |
be-inclusivestructure-and-focus | issues | high | The focused search input and button have outline:none and no box-shadow. The signup page starts its main content at H3 with no H1. F-21 high: Keyboard focus is invisible and page structure is inconsistent. |
be-inclusivelegible-text | issues | high | Mobile captures show desktop columns clipped at 360 pixels; on signup, only a narrow right edge of the panel remains visible. F-22 high: Mobile reflow clips and hides essential text and controls. |
be-inclusivezoom-reflow-targets-and-media | issues | high | Every 360 pixel layout has 664 pixels of horizontal overflow, and Lighthouse failed target-size and meta-viewport accessibility audits in its mobile run. F-23 high: The experience fails reflow and target-size requirements. |
follow-best-practicesno-console-errors | pass | high | Lighthouse best-practices scored 1.0 on home and signup and did not report console or runtime error failures. |
follow-best-practicessound-document-and-assets | issues | high | The image primitive found 29 of 36 home images and 16 of 20 detail images without width/height attributes; Lighthouse also failed unsized-images. F-24 medium: Many images lack explicit intrinsic dimensions. |
follow-best-practicesbrowser-platform-hygiene | pass | high | Lighthouse best-practices scored 1.0 on both tested templates, no permission request fired on load, and scripts use async/defer appropriately. |
be-discoverabletitle-and-description | pass | high | All five representative pages expose unique, descriptive titles and meta descriptions. |
be-discoverablecrawlable-and-mobile-friendly | pass | high | Navigation uses real href links, viewport metadata is present, robots.txt allows public content routes, and Lighthouse SEO scored 1.0. Mobile usability defects are recorded under form-factor and inclusion checks. |
be-discoverablecanonical-and-indexing-signals | issues | high | Canonical URLs are present, but probes found zero hreflang links even though many language subdomains exist, and /sitemap.xml returned HTTP 404. F-25 medium: Localized pages lack hreflang and the conventional sitemap endpoint is missing. |
be-discoverablestructured-and-shareable-metadata | issues | high | The video detail has accurate Open Graph metadata but no JSON-LD; home and category pages also expose no JSON-LD. F-26 medium: Rich content lacks structured data. |
be-private-and-securesecure-transport-and-headers | issues | high | CSP contains only frame-ancestors, X-Content-Type-Options and Referrer-Policy headers are absent, and the settings and CSRF cookies were observed without Secure. F-27 high: Transport is HTTPS, but browser defenses and cookie flags are incomplete. |
be-private-and-securedata-minimisation-and-third-parties | issues | high | The HAR records 116 third-party requests and 1,558,102 third-party transferred bytes across 13 third-party origins, including ad-network origins, before consent interaction. F-28 high: The initial load has a large third-party footprint. |
be-private-and-securein-context-permissions-and-modern-auth | pass | medium | No geolocation or notification request was observed on load. Signup offers federated methods and the authored page contains passkey/WebAuthn markers. |
be-private-and-securedefensive-browser-policies | issues | high | HSTS and frame protection are present, but CSP only sets frame-ancestors, nosniff and Referrer-Policy headers are absent, Permissions-Policy only mentions two client hints, and page markup declares referrer=unsafe-url. F-29 high: Defensive policies are too narrow. |
be-resilientprogressive-enhancement | pass | high | Raw HTML contains 87% of home, 100% of category, and 79% of detail rendered content; titles, H1s, and descriptions survive without JavaScript, and no page is a JS shell. |
be-resilientresilient-runtime-behaviour | pass | medium | Representative routes loaded with stable state, deferred scripts, and usable navigation; no clipped overlay-specific failure was observed separately from the global fixed-width defect. |
be-resilientoffline-and-installable | pass | medium | This app-like site provides a manifest with start_url and icons, an active service worker controls the page, and its service-worker source contains cache and offline handling paths. |
be-resilientnetwork-and-http-failure-states | pass | high | A deliberately unknown path returns a true HTTP 404 and a branded recovery page with Return to Home and related content. |
be-internationalisedlang-dir-and-logical-properties | pass | high | English and Spanish pages set matching lang values, the Arabic locale sets lang=ar and dir=rtl, and the CSS corpus includes logical properties. |
be-internationalisedlocale-aware-data | pass | medium | The tested English, Spanish, and Arabic locale variants localize page titles and navigation content rather than exposing one hard-coded language. No incorrect locale-formatted data was observed. |
be-internationalisedtime-zone-correctness | not-applicable | high | DOM probes found no representative time-zone-sensitive surface to test. |
be-trustworthyno-dark-patterns | pass | medium | Consent presents Accept and Reject with equal visual weight, signup states its data-use implications, and no preselected paid continuity or confirmshaming was observed. |
be-trustworthyhumane-error-handling | issues | high | Submitting the empty email form shows clear messages and focuses email, but the error elements have no role=alert and fields do not expose aria-invalid. F-30 medium: Signup errors are visual but not programmatically announced. |
be-trustworthytrustworthy-input-assistance | issues | high | The signup email input and site search input use autocomplete=off; email is not identified with autocomplete=email. F-31 medium: Email and search fields disable useful autofill. |
be-trustworthysafe-commercial-and-account-flows | pass | medium | The tested signup surface clearly offers login, federated, and email choices and discloses terms, privacy, public profile implications, and possible age verification before commitment. Paid checkout and authenticated cancellation were excluded because they require credentials/payment. |
be-sustainableoptimised-assets | issues | high | The home image audit found 13 oversized images, 15 legacy-format URLs, 29 missing dimensions, and 3 without responsive sources. F-32 medium: Many image assets are oversized or lack delivery metadata. |
be-sustainableno-wasteful-work | issues | high | The homepage loads 144 requests, 61 scripts, and 1.75 MB transferred, with multiple long tasks and large modules before a user selects content. F-33 medium: The initial page performs excessive work before user intent. |
be-sustainablethird-party-and-media-budget | issues | high | Third-party origins account for 116 of 144 requests and 1.56 MB of 1.75 MB transferred; the largest origin alone transfers 1.07 MB. F-34 high: Third-party delivery dominates the page budget. |
be-agent-readystructured-agent-capabilities | issues | medium | The page has no WebMCP or agent-tool markers, and Lighthouse agentic-browsing scored 0.5 with a malformed accessibility-tree finding on home. F-35 low: Searchable catalogue capabilities are not exposed as structured agent tools. |
be-agent-readyon-device-inference | not-applicable | high | The audited public catalogue does not present an inference task; absence is not penalized. |
be-memory-efficientno-leak-under-repeated-interaction | issues | medium | After garbage collection, ten login open/Escape-close cycles increased nodes from 682,925 to 748,412 (9.6%) and self size from 36,328,468 to 39,909,837 bytes (9.9%). Separate fresh sessions add variance, so confidence is medium. F-36 medium: Retained heap grows after repeated login open/close cycles. |
be-memory-efficientbounded-footprint | issues | medium | The garbage-collected baseline contains 682,925 heap nodes, 94,819 closures, and 36.3 MB self size for a catalogue landing page with 1,819 DOM elements. F-37 medium: The landing page starts with a large JavaScript heap footprint. |
be-memory-efficientno-detached-dom-or-unbounded-listeners | pass | medium | Neither heap summary lists a Detached constructor among the top 25 by self size. Closures rise by about 4% after the repeated modal cycle, materially less than total node growth, so no direct detached-DOM or clearly unbounded-listener signal was established. |
Provenance
Canonical report: results/atomic/reports/0336-xhaccess_com.json
Report SHA-256: 97f6de824b9100fece0082448088db9d3b1b79b829050aea92ca195994d73ae6
Local retained report: runs/2026-07-17T17-27-24-856Z/atomic-reports/xhaccess_com/2026-07-20T01-02-19-476Z/report.json
Local evidence root: runs/2026-07-17T17-27-24-856Z/atomic-reports/xhaccess_com/2026-07-20T01-02-19-476Z
Catalog SHA-256: sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7
Raw screenshots, HARs, traces, heaps, and other browser artifacts are retained at the local evidence root and intentionally are not committed. Artifact paths in the canonical report are relative to that root.