Manifest position 602 · CrUX rank bucket 1000
https://posteid.poste.it
Coverage complete
Coverage-complete audit of five representative public paths. Edge rate limiting intermittently produced 403s during parallel evidence collection; claims use successful captures or identify the reproducible user-facing 403 route explicitly.
Attempts
2 / 3
Judged checks
58 / 58
Blocked
0
Not run
0
This report has no published overall score. Blocked and not-run checks are not passes. A coverage-complete report means every check has a judged outcome; it does not mean every check passed.
All 58 atomic check outcomes
| Principle / check | Status | Confidence | Evidence or reason |
|---|---|---|---|
respect-user-preferencesrespects-color-scheme | issues | high | Dark emulation leaves the light palette unchanged and color-scheme is normal. F01 medium: The interface does not adapt to dark or higher-contrast preferences. |
respect-user-preferencesrespects-reduced-motion | pass | high | The emulated preference matched and the page reported zero active animations. |
respect-user-preferencesrespects-contrast | issues | high | No preference-specific adaptation was visible and footer text measured 3.73:1. F01 medium: The interface does not adapt to dark or higher-contrast preferences. |
implement-natural-interactionsview-transitions | issues | medium | Registration, sign-in and recovery are document navigations with no View Transition signal. F02 low: Page and state changes are abrupt and use no modern transition mechanism. |
implement-natural-interactionsscroll-driven-animations | not-applicable | high | The audited templates contain no parallax, scrollytelling, carousel or scroll-linked animation to implement. |
implement-natural-interactionsphysical-gestures | not-applicable | high | The public templates expose links/forms but no swipe, pull, drag, snap-carousel or gesture-driven surface. |
provide-guided-navigationscroll-state-aware-chrome | not-applicable | high | The public pages have no sticky/affixed navigation chrome whose state needs to react to scroll position. |
provide-guided-navigationanchored-positioning | not-applicable | high | No tooltip or anchored menu interaction was present on the representative public paths. |
provide-guided-navigationdirects-attention | pass | medium | Large registration and access cards clearly identify the two primary directions, with explicit recovery and assistance links. |
maximize-content-reduce-noiseno-intrusive-interruptions | issues | high | Chat and cookie layers obscure primary content and controls without user request. F03 high: Fixed cookie and chat UI obscures primary content, especially on mobile. |
maximize-content-reduce-noisesemantic-dismissible-primitives | issues | high | Seven custom dialog-role divs are unlabeled and assistance is a javascript: pseudo-link. F04 medium: Overlay UI is implemented as unlabeled custom dialog divs. |
maximize-content-reduce-noisereduced-chrome | issues | high | Persistent cookie/chat chrome consumes and overlaps scarce mobile content space. F03 high: Fixed cookie and chat UI obscures primary content, especially on mobile. |
adapt-to-the-form-factorresponsive-no-horizontal-scroll | pass | high | The home and registration probes report scrollWidth equal to innerWidth (360px), with no horizontal overflow. |
adapt-to-the-form-factorcomponent-level-responsiveness | issues | high | The registration chooser remains a cramped three-column component and no container-query signal was found. F05 high: Several mobile templates reflow poorly even without horizontal scrolling. |
adapt-to-the-form-factorinput-modality-aware | pass | medium | The first focusable links show browser focus outlines and the primary CTA controls render around 50px high. |
support-core-task-successclear-purpose-and-primary-action | pass | high | The heading explains PosteID and the two primary calls to action are clearly Registration and Access. |
support-core-task-successprimary-flow-completion | pass | medium | The registration and recovery entry pages load and present the expected next choice; authenticated/identity submission was deliberately not performed. |
support-core-task-successclear-system-state-and-recovery | issues | high | The prominently linked accessible version fails with a bare 403 and offers no retry, back link or support recovery. F17 high: A prominently linked accessibility route returns a bare 403 page. |
be-fast-and-stablegood-core-web-vitals | issues | high | Lighthouse LCP was 6.9s and FCP 5.2s, outside good thresholds. F06 high: The public landing page has slow paint and inefficient delivery. |
be-fast-and-stablevisual-stability | pass | high | Lighthouse measured CLS 0 for the tested load. |
be-fast-and-stableefficient-main-thread | pass | high | TBT was 32ms and the trace observed no tasks over 50ms. |
be-fast-and-stableefficient-resource-delivery | issues | high | 94 requests and 962 KiB include render-blocking, cache, font and modern HTTP opportunities. F06 high: The public landing page has slow paint and inefficient delivery. |
be-fast-and-stabletrim-unused-and-duplicate-code | issues | high | The page has estimated unused/minifiable/legacy JS and CSS savings totalling hundreds of KiB. F07 medium: The page ships substantial unused, legacy and unminified client code. |
be-inclusivenames-roles-labels | issues | high | No main landmark, multiple missing image alternatives and unlabeled dialog roles were found. F08 high: Core semantics and accessible names are incomplete. |
be-inclusivesufficient-contrast | issues | high | Footer text is 3.73:1 against its background and links rely on color alone. F01 medium: The interface does not adapt to dark or higher-contrast preferences. F10 medium: Some text and controls are hard to perceive or read. |
be-inclusivestructure-and-focus | issues | high | The DOM has empty headings/no main landmark and major links use positive tabindex 2–39. F08 high: Core semantics and accessible names are incomplete. F09 high: Keyboard order and zoom are overridden. |
be-inclusivelegible-text | issues | high | Registration choice copy is cramped and fixed overlays cover readable/actionable content. F10 medium: Some text and controls are hard to perceive or read. |
be-inclusivezoom-reflow-targets-and-media | issues | high | The served viewport contains user-scalable=no/user-scalable=0, preventing user zoom. F09 high: Keyboard order and zoom are overridden. |
follow-best-practicesno-console-errors | issues | high | Two resources return 404: the OpenID acrlevel endpoint and favicon.ico. F11 medium: The page loads with network console errors and fragile image markup. |
follow-best-practicessound-document-and-assets | issues | high | Doctype/UTF-8 are present, but all 18 images lack explicit dimensions and multiple image loads are broken or under-specified. F11 medium: The page loads with network console errors and fragile image markup. |
follow-best-practicesbrowser-platform-hygiene | issues | medium | Best Practices scored 0.69 and inspector issues, third-party cookie issues and legacy JS were reported. F11 medium: The page loads with network console errors and fragile image markup. |
be-discoverabletitle-and-description | issues | high | A descriptive title exists but meta description is absent. F12 medium: Public pages lack basic descriptive and share metadata. |
be-discoverablecrawlable-and-mobile-friendly | issues | high | The assistance action uses javascript:void(0), and robots.txt returns an application 404 page. F13 medium: Indexing signals are incomplete and one action is not crawlable. |
be-discoverablecanonical-and-indexing-signals | issues | high | robots.txt and sitemap.xml return 404 and the page exposes no canonical URL. F13 medium: Indexing signals are incomplete and one action is not crawlable. |
be-discoverablestructured-and-shareable-metadata | issues | medium | This public organization/service landing page has no JSON-LD or Open Graph metadata. F12 medium: Public pages lack basic descriptive and share metadata. |
be-private-and-securesecure-transport-and-headers | issues | high | HTTPS/HSTS/nosniff/SAMEORIGIN are present, but CSP is absent and BACKEND lacks Secure/HttpOnly/SameSite. F14 high: Browser-enforced security policy is incomplete and one routing cookie is weak. |
be-private-and-securedata-minimisation-and-third-parties | issues | high | Seven third-party origins and five third-party cookies conflict with the technical-cookie-only statement. F15 high: The stated technical-cookie-only posture conflicts with active third-party tracking. |
be-private-and-securein-context-permissions-and-modern-auth | issues | medium | The surface explicitly supports password recovery but exposes no passkey/WebAuthn affordance or code signal. F16 medium: The public authentication proposition appears password-only. |
be-private-and-securedefensive-browser-policies | issues | high | HSTS and SAMEORIGIN are present, but CSP/frame-ancestors, Referrer-Policy and Permissions-Policy are absent. F14 high: Browser-enforced security policy is incomplete and one routing cookie is weak. |
be-resilientprogressive-enhancement | pass | high | The 44,446-byte server HTML contains the headings, notices and primary links without requiring JavaScript. |
be-resilientresilient-runtime-behaviour | issues | high | Fixed overlays cut off controls and the accessible route degrades to a bare 403 page. F03 high: Fixed cookie and chat UI obscures primary content, especially on mobile. F17 high: A prominently linked accessibility route returns a bare 403 page. |
be-resilientoffline-and-installable | not-applicable | high | PosteID is a security-sensitive identity service whose core authentication and account changes are intrinsically online; an offline/installable app is not appropriate for these audited public flows. |
be-resilientnetwork-and-http-failure-states | issues | high | The route returns bare 403 content with no branded recovery action. F17 high: A prominently linked accessibility route returns a bare 403 page. |
be-internationalisedlang-dir-and-logical-properties | pass | high | The Italian pages declare html lang="it" and use the correct default LTR reading direction. |
be-internationalisedlocale-aware-data | not-applicable | high | The audited public Italian-only templates do not render user-specific dates, currencies, durations or calendar data requiring locale formatting. |
be-internationalisedtime-zone-correctness | not-applicable | high | The audited public templates contain no scheduled events, stored timestamps or recurring time-zone-sensitive data. |
be-trustworthyno-dark-patterns | issues | high | The claim that only technical cookies are used conflicts with observed Adobe/Demdex/Everest tracking and third-party cookies. F15 high: The stated technical-cookie-only posture conflicts with active third-party tracking. |
be-trustworthyhumane-error-handling | issues | high | Sensitive forms omit required, aria-invalid and aria-live validation semantics. F18 high: Sensitive account forms omit input assistance and accessible validation hooks. |
be-trustworthytrustworthy-input-assistance | issues | high | Username and related account fields expose no autocomplete tokens. F18 high: Sensitive account forms omit input assistance and accessible validation hooks. |
be-trustworthysafe-commercial-and-account-flows | pass | medium | The suspension page clearly warns about the effect, links reversal, and asks for confirmation of the suspension code before submission. |
be-sustainableoptimised-assets | issues | high | All 18 images are PNG/GIF, dimensions are absent and below-fold images are eager. F19 medium: Asset and third-party budgets are disproportionate for a mostly static landing page. |
be-sustainableno-wasteful-work | issues | high | A mostly static landing page loads 94 requests, 41 scripts and seven third-party origins. F07 medium: The page ships substantial unused, legacy and unminified client code. F19 medium: Asset and third-party budgets are disproportionate for a mostly static landing page. |
be-sustainablethird-party-and-media-budget | issues | high | Five third-party cookies, seven third-party origins and 962 KiB are disproportionate for the static public surface. F15 high: The stated technical-cookie-only posture conflicts with active third-party tracking. F19 medium: Asset and third-party budgets are disproportionate for a mostly static landing page. |
be-agent-readystructured-agent-capabilities | not-applicable | high | This identity and credential-management service exposes security-sensitive actions; no developer intent to permit agent execution was declared, so an agent tool surface is not assumed safe or applicable. |
be-agent-readyon-device-inference | not-applicable | high | The representative identity registration, recovery and suspension tasks do not have an evident summarisation or language-model use case. |
be-memory-efficientno-leak-under-repeated-interaction | pass | medium | Post-interaction totals were lower than baseline (7.26 MB/133,107 nodes vs 9.63 MB/166,733 nodes), with no retained-growth signal. |
be-memory-efficientbounded-footprint | pass | medium | The baseline self-size was 9.63 MB for the loaded landing page, proportionate to the observed UI. |
be-memory-efficientno-detached-dom-or-unbounded-listeners | pass | medium | No Detached* constructor population was reported and aggregate heap/node totals did not grow. |
Provenance
Canonical report: results/atomic/reports/0602-posteid_poste_it.json
Report SHA-256: 6a053058054a824004f4086f6a32ce55cba9e604183514557fef8264fc0db0cd
Local retained report: runs/2026-07-17T17-27-24-856Z/atomic-reports/posteid_poste_it/2026-07-26T15-50-37-958Z/report.json
Local evidence root: runs/2026-07-17T17-27-24-856Z/atomic-reports/posteid_poste_it/2026-07-26T15-50-37-958Z
Catalog SHA-256: sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7
Raw screenshots, HARs, traces, heaps, and other browser artifacts are retained at the local evidence root and intentionally are not committed. Artifact paths in the canonical report are relative to that root.