Manifest position 530 · CrUX rank bucket 1000
https://www.tiktok.com
Coverage complete
Coverage-complete report-mode audit of four representative anonymous surfaces. Excluded authenticated feed creation/upload, checkout/commerce, live-stream interaction and account settings because they require credentials or materially distinct privileged state.
Attempts
1 / 3
Judged checks
58 / 58
Blocked
0
Not run
0
This report has no published overall score. Blocked and not-run checks are not passes. A coverage-complete report means every check has a judged outcome; it does not mean every check passed.
All 58 atomic check outcomes
| Principle / check | Status | Confidence | Evidence or reason |
|---|---|---|---|
respect-user-preferencesrespects-color-scheme | pass | high | Screenshot comparison under dark preference shows the shell remains a coherent dark design. |
respect-user-preferencesrespects-reduced-motion | issues | high | The reduced-motion evaluate probe found six ~531ms document animations, including running animations, while matchMedia(prefers-reduced-motion: reduce) was true. F01 medium: Motion continues when reduced motion is requested |
respect-user-preferencesrespects-contrast | pass | high | High-contrast emulation screenshot retains visible feed, controls and text. |
implement-natural-interactionsview-transitions | issues | high | The rendered DOM probe found no startViewTransition usage; navigation between feed and Explore swaps state without a documented transition treatment. F02 low: Route and state changes do not use View Transitions |
implement-natural-interactionsscroll-driven-animations | not-applicable | high | No authored parallax, reveal or other scroll-linked animation was present on the representative surfaces; native feed scrolling was tested instead. |
implement-natural-interactionsphysical-gestures | pass | high | Feed and Explore use native vertical scrolling and the sampled media is not autoplaying at probe time. |
provide-guided-navigationscroll-state-aware-chrome | pass | high | Persistent side navigation identifies For You/Explore and stays available while feed content scrolls. |
provide-guided-navigationanchored-positioning | issues | high | Opening More produced a DIV role=dialog at x=220/y=84 and the stylesheet probe found zero anchor-name, position-anchor or position-try rules. F03 low: The More overlay is manually positioned rather than anchored |
provide-guided-navigationdirects-attention | pass | high | Explore selection, content-first feed paging and labeled navigation controls provide clear current-state cues. |
maximize-content-reduce-noiseno-intrusive-interruptions | issues | high | Desktop, Explore, login and 404 screenshots show a 200px cookie panel covering roughly the lower 40% of the 493px viewport before interaction. F04 medium: Cookie consent obscures a large share of every first view |
maximize-content-reduce-noisesemantic-dismissible-primitives | issues | high | The initial DOM contained no dialog, popover or details elements; the More menu opened as a DIV role=dialog and the cookie banner is a custom shadow-DOM element. F05 medium: Overlays use custom elements and ad-hoc dialog roles |
maximize-content-reduce-noisereduced-chrome | pass | high | After consent dismissal the feed dedicates most of the viewport to the current video, with compact side actions. |
adapt-to-the-form-factorresponsive-no-horizontal-scroll | issues | high | At a 360px visual viewport, the layout primitive measured 492px content width and 132px horizontal overflow. The screenshot visibly clips the video and caption. F06 high: The mobile layout overflows horizontally |
adapt-to-the-form-factorcomponent-level-responsiveness | issues | high | The CSSOM probe found zero @container rules while the same shell presents feed cards and a three-column Explore grid in different available widths. F07 low: Reusable feed and listing components show no container-query adaptation |
adapt-to-the-form-factorinput-modality-aware | issues | high | The focus probe reported outline-style none and no box-shadow for every sampled control; navigation buttons are 40x40px and several links are only 16-23px high. F08 high: Keyboard focus is not visibly indicated and several controls are undersized |
support-core-task-successclear-purpose-and-primary-action | pass | high | For You immediately presents a video feed; Explore presents topical cards; login clearly labels its purpose and methods. |
support-core-task-successprimary-flow-completion | pass | high | Anonymous users can consume the feed, navigate to Explore and open login choices without a forced account wall. |
support-core-task-successclear-system-state-and-recovery | pass | high | The unknown-route test renders a branded 404 state with global search/login navigation instead of a blank shell. |
be-fast-and-stablegood-core-web-vitals | issues | high | Lighthouse measured LCP 22.3s, FCP 12.0s, TBT 1,394ms and performance 0.30; the independent trace measured LCP 4.64s and TBT 2.55s. F09 critical: Loading performance is far outside the good range |
be-fast-and-stablevisual-stability | pass | high | The mobile layout observer measured CLS 0.0186, within the good threshold despite later shifts. |
be-fast-and-stableefficient-main-thread | issues | high | The trace found nine long tasks, including one 2,410ms task, for 2,555ms total blocking time; Lighthouse TBT was 1,394ms. F10 high: Startup JavaScript blocks the main thread |
be-fast-and-stableefficient-resource-delivery | issues | high | The HAR recorded 362 requests and 8.83MB transferred; 214 scripts account for 6.31MB, with parser-inserted non-deferred scripts confirmed in the DOM probe. F11 high: The dependency graph is extremely large and delays content |
be-fast-and-stabletrim-unused-and-duplicate-code | issues | high | The HAR recorded 214 scripts and 6.31MB script transfer, including multiple monitoring plugin versions and login chunks on the unauthenticated feed. F12 high: Script volume dominates the page before user intent |
be-inclusivenames-roles-labels | issues | high | Lighthouse found unnamed buttons and links, unlabeled password inputs and images without alt; the agent accessibility tree audit also failed. F13 high: Controls, links, images and inputs lack accessible names |
be-inclusivesufficient-contrast | issues | high | Lighthouse found 3.0:1 white-on-cyan cookie text and 3.68:1 white-on-pink Open TikTok text, below the required 4.5:1. F14 high: Text and primary controls fail WCAG contrast |
be-inclusivestructure-and-focus | issues | high | The homepage has no H1, Lighthouse found skipped heading order, and the focus probe showed outline-style none on all sampled keyboard targets. F15 high: Heading structure and focus presentation are not robust |
be-inclusivelegible-text | pass | high | Screenshots show readable feed captions, topic labels and login choices with adequate line lengths; contrast exceptions are separately recorded. |
be-inclusivezoom-reflow-targets-and-media | issues | high | The 360px layout has 132px horizontal overflow; sampled navigation targets are 40x40px and text links as little as 16px high. F16 medium: Reflow and target sizing fail on narrow screens |
follow-best-practicesno-console-errors | issues | high | Lighthouse failed errors-in-console, including a 400 API request and repeated CSP policy warnings. F17 medium: The page emits runtime and network console errors |
follow-best-practicessound-document-and-assets | issues | high | The images primitive found all four sampled images missing width and height attributes, two oversized avatars and two legacy-format resources. F18 medium: Image markup does not reserve stable dimensions |
follow-best-practicesbrowser-platform-hygiene | issues | high | Lighthouse found unload listeners, deprecated Shared Storage use, and six BFCache blockers including unload, no-store and WebSocket conditions. F19 medium: Deprecated APIs and BFCache blockers remain |
be-discoverabletitle-and-description | issues | high | The rendered metadata probe found a title but no meta description; discoverability confirmed the description is absent in raw HTML. F20 medium: The public homepage has no meta description |
be-discoverablecrawlable-and-mobile-friendly | issues | high | Lighthouse failed crawlable-anchors for a Learn more anchor without href and link-name for an unlabeled search link. F21 medium: Some links are unnamed or not crawlable |
be-discoverablecanonical-and-indexing-signals | issues | high | Lighthouse found no valid rel=canonical; /sitemap.xml returned Not Found, while robots.txt defines a selective crawl policy. F22 medium: Canonical and sitemap signals are incomplete |
be-discoverablestructured-and-shareable-metadata | issues | high | The DOM probe found zero JSON-LD blocks and no Open Graph metadata on the public homepage. F23 medium: The homepage lacks entity and share-preview metadata |
be-private-and-securesecure-transport-and-headers | issues | high | Headers show HTTPS/HSTS but CSP allows unsafe-inline and unsafe-eval; the cookie audit found nine cookies flagged insecure and msToken without Secure/HttpOnly using SameSite=None. F24 high: Cookie and CSP posture has avoidable weaknesses |
be-private-and-securedata-minimisation-and-third-parties | issues | high | The tracker probe found 16 third-party origins; the HAR attributed 329 requests and 8.59MB to third-party origins, including monitoring domains, before account interaction. F25 high: The initial anonymous load has a very large telemetry and third-party footprint |
be-private-and-securein-context-permissions-and-modern-auth | issues | high | The login probe offers QR, phone/email/username, Facebook, Google and Apple; neither rendered markup nor the DOM contained passkey/WebAuthn signals. F26 medium: The login entry exposes no phishing-resistant passkey option |
be-private-and-securedefensive-browser-policies | issues | high | Permissions-Policy is missing and CSP permits unsafe-inline/unsafe-eval; Lighthouse also reported third-party cookie and CSP inspector issues. F27 medium: Defensive browser policy coverage is incomplete |
be-resilientprogressive-enhancement | issues | high | Discoverability measured only 3% raw/rendered word coverage and classified the page as a JS shell; the crawler screenshot is effectively blank while the browser screenshot contains the feed. F28 high: Core feed content is unavailable without JavaScript |
be-resilientresilient-runtime-behaviour | pass | high | The More menu opened within the viewport and the feed remained usable after repeated scrolling. |
be-resilientoffline-and-installable | pass | high | A scoped active service worker and installable manifest with name, icons, start_url and display mode were directly observed. |
be-resilientnetwork-and-http-failure-states | pass | high | A deliberately unknown route produced a branded 404 recovery surface with search and login navigation. |
be-internationalisedlang-dir-and-logical-properties | pass | high | Rendered documents declare en/en-GB and ltr, and login exposes a broad language selector including RTL languages. |
be-internationalisedlocale-aware-data | pass | high | The session rendered en-GB locale selection and region-aware content; no malformed locale-sensitive numeric/date formatting was observed. |
be-internationalisedtime-zone-correctness | not-applicable | high | No event, timestamp editing or other time-zone-sensitive value appeared on the audited anonymous surfaces. |
be-trustworthyno-dark-patterns | pass | high | Consent presents equally prominent Decline optional cookies and Allow all controls; login terms and privacy links are visible. |
be-trustworthyhumane-error-handling | not-applicable | high | The audited unauthenticated login entry rendered method-choice and federated controls but no editable authored form on which validation behavior could be exercised. |
be-trustworthytrustworthy-input-assistance | issues | high | Lighthouse found four password inputs without labels; the markup snippets expose no autocomplete token, placeholder or accessible name. F29 medium: Hidden sign-in inputs lack basic input semantics |
be-trustworthysafe-commercial-and-account-flows | issues | high | The public login entry offers QR, phone/email/username and federated providers but no passkey or WebAuthn path. F30 medium: Account access relies on legacy/federated choices without passkey management |
be-sustainableoptimised-assets | issues | high | Two of four sampled images are oversized, all lack width/height and two use legacy formats; one below-fold image lacks lazy loading. F31 medium: Image delivery wastes bytes and omits intrinsic metadata |
be-sustainableno-wasteful-work | issues | high | The initial load makes 362 requests including 89 fetch/XHR requests and multiple monitoring endpoints; trace TBT is 2.55s. F32 high: Anonymous startup performs excessive background work |
be-sustainablethird-party-and-media-budget | issues | high | Third parties account for 329 requests and 8.59MB of 8.83MB transferred; scripts alone are 6.31MB and fonts 643KB. F33 high: Third-party code dominates the resource budget |
be-agent-readystructured-agent-capabilities | not-applicable | high | Agent-facing capabilities are emerging and no developer intent to expose TikTok actions to agents was declared; absence is not penalised. |
be-agent-readyon-device-inference | not-applicable | high | No summarisation or language-model task was part of the audited anonymous journeys, so on-device inference is not applicable. |
be-memory-efficientno-leak-under-repeated-interaction | pass | high | After ten feed scroll-down/up cycles, heap self size changed from 100.06MB to 100.87MB while node count fell from 1,765,634 to 1,753,945; no monotonic retained growth is established. |
be-memory-efficientbounded-footprint | issues | high | The baseline heap summary contains 1,765,634 nodes/records and 100.1MB self size, including 492,545 code entries and 164,467 closures for one visible feed card. F34 medium: The initial heap footprint is disproportionate to the visible feed |
be-memory-efficientno-detached-dom-or-unbounded-listeners | pass | high | After repeated scrolling, live DOM nodes fell from 764 to 706 and heap node count fell; Detached constructors did not appear among the largest baseline/post constructors. |
Provenance
Canonical report: results/atomic/reports/0530-www_tiktok_com.json
Report SHA-256: 215f7d2e9d5865e3e5c35af862eb11abbb9d245b0c2bd078f7b8d2efcd48fa12
Local retained report: runs/2026-07-17T17-27-24-856Z/atomic-reports/www_tiktok_com/2026-07-21T09-37-58-184Z/report.json
Local evidence root: runs/2026-07-17T17-27-24-856Z/atomic-reports/www_tiktok_com/2026-07-21T09-37-58-184Z
Catalog SHA-256: sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7
Raw screenshots, HARs, traces, heaps, and other browser artifacts are retained at the local evidence root and intentionally are not committed. Artifact paths in the canonical report are relative to that root.