Manifest position 671 · CrUX rank bucket 1000
https://apps.facebook.com
Partial after retries
Public login, consent, signup and recovery surfaces were inspected. 5 authenticated/error-state checks were blocked by the absence of an authorized test account or controlled backend.
Attempts
3 / 3
Judged checks
53 / 58
Blocked
5
Not run
0
This report has no published overall score. Blocked and not-run checks are not passes. A coverage-complete report means every check has a judged outcome; it does not mean every check passed.
All 58 atomic check outcomes
| Principle / check | Status | Confidence | Evidence or reason |
|---|---|---|---|
respect-user-preferencesrespects-color-scheme | issues | high | The dark-mode capture is visually identical to the light capture; DOM computed styles report color-scheme: normal and a white body/dialog. F01 medium: The public login and consent UI ignore the user’s dark color-scheme preference. |
respect-user-preferencesrespects-reduced-motion | pass | high | Reduced-motion emulation found no active animations and multiple CSS rules that set transition/animation duration to zero or animation-name:none. |
respect-user-preferencesrespects-contrast | pass | medium | The prefers-contrast:more screenshot preserves visible text, controls, outlines, and consent choices without clipping. |
implement-natural-interactionsview-transitions | pass | medium | CSS inspection finds view-transition rules and the consent dismissal completes without a jarring intermediate frame. |
implement-natural-interactionsscroll-driven-animations | not-applicable | high | The public login and consent surfaces contain no scroll-linked animation, parallax, carousel, or scrollytelling behavior to implement. |
implement-natural-interactionsphysical-gestures | not-applicable | high | No swipe, pull, drag, scroll-snap, or other gesture-driven interaction exists on the audited public surfaces. |
provide-guided-navigationscroll-state-aware-chrome | not-applicable | high | The short public login surface has no sticky/affixed chrome or meaningful scroll-state transition. |
provide-guided-navigationanchored-positioning | pass | medium | CSS inspection finds anchor-positioning declarations; the consent overlay remains attached and within both tested viewport edges. |
provide-guided-navigationdirects-attention | pass | high | The modal state uses a dimmed backdrop and clear action placement; after dismissal, the login heading and form become the dominant next step. |
maximize-content-reduce-noiseno-intrusive-interruptions | issues | high | Desktop and mobile screenshots show the page dimmed behind a modal that occupies most of the usable viewport before any user action. F02 medium: A full-screen cookie consent dialog obscures the entire primary login experience on first load. |
maximize-content-reduce-noisesemantic-dismissible-primitives | issues | high | The DOM probe finds DIV role=dialog aria-modal=true and no dialog element. F03 low: The consent modal is implemented as a custom div rather than the native dialog primitive. |
maximize-content-reduce-noisereduced-chrome | pass | high | After declining consent, the page text is a focused login form with recovery/signup actions and a low-priority footer rather than application chrome. |
adapt-to-the-form-factorresponsive-no-horizontal-scroll | issues | high | The mobile layout reports hasViewportMeta:false, innerWidth 980, and visual scale 0.367; the screenshot renders the dialog and footer at tiny text sizes. F04 high: The desktop login document does not set a viewport meta tag, causing a 980 CSS-pixel layout to be scaled down on a 360px screen. |
adapt-to-the-form-factorcomponent-level-responsiveness | pass | medium | CSS inspection detects container-query rules in the delivered stylesheets. |
adapt-to-the-form-factorinput-modality-aware | issues | high | The focus probe programmatically focuses the email input and reads outline:none and box-shadow:none. F05 high: Keyboard focus is not visibly indicated on the first focusable login input. |
support-core-task-successclear-purpose-and-primary-action | pass | high | After consent dismissal the body begins “Log in to Facebook” and exposes email, password, Log in, recovery and account-creation actions. |
support-core-task-successprimary-flow-completion | blocked | high | Authentication credentials were not available, so end-to-end login and authenticated app task completion could not be exercised. |
support-core-task-successclear-system-state-and-recovery | blocked | high | Credential and network-error states could not be safely completed without a test account and controlled backend failure. |
be-fast-and-stablegood-core-web-vitals | issues | high | The DevTools trace measured FCP/LCP at 7.22s; Lighthouse measured FCP 6.3s and LCP 7.7s with performance 0.58. F06 high: The public login experience paints far too late. |
be-fast-and-stablevisual-stability | issues | high | The mobile layout observer measured CLS 0.085; all four consent images lack complete width/height dimensions. F07 medium: Late layout movement and unreserved consent imagery reduce visual stability. |
be-fast-and-stableefficient-main-thread | issues | high | The trace reports two long tasks, longest 141ms, and 156.7ms total blocking time. F08 medium: Main-thread work includes blocking tasks during the delayed paint. |
be-fast-and-stableefficient-resource-delivery | issues | high | HAR captured 43 requests and 2.05MB transferred, including 1.33MB script, 324KB CSS, and a 183KB font; a parser-inserted VeryHigh stylesheet is on the critical path. F09 high: A simple public login/consent surface transfers a heavy startup payload. |
be-fast-and-stabletrim-unused-and-duplicate-code | issues | high | HAR reports 24 script requests and 1.33MB transferred; the largest script is 298KB and Lighthouse flags missing source maps for large first-party JavaScript. F10 high: The unauthenticated page ships 24 scripts and multiple large bundles before the user can log in. |
be-inclusivenames-roles-labels | issues | high | Lighthouse accessibility score is 0.78 and fails aria-required-attr and label audits. F11 high: The mobile login variant contains incomplete ARIA and unlabeled form controls. |
be-inclusivesufficient-contrast | issues | high | Lighthouse fails the color-contrast audit on the mobile login variant. F12 medium: Some foreground/background combinations fail minimum contrast. |
be-inclusivestructure-and-focus | issues | high | The DOM probe finds zero h1 and no main/nav/header/footer landmarks; focused email input has no outline or shadow. F13 high: The public page lacks semantic landmarks/headings and suppresses visible focus. |
be-inclusivelegible-text | pass | medium | Desktop screenshot shows readable line lengths and unclipped dialog/body text at the desktop condition. |
be-inclusivezoom-reflow-targets-and-media | issues | high | Layout evidence shows no viewport meta on the rendered desktop response; Lighthouse fails meta-viewport because the mobile response limits scaling below the audit threshold. F14 high: The mobile variant constrains scaling and the desktop response omits a device-width viewport. |
follow-best-practicesno-console-errors | issues | high | Lighthouse fails the errors-in-console audit. F15 medium: The login load logs browser console errors. |
follow-best-practicessound-document-and-assets | issues | high | The images primitive reports all four images missing a height attribute; the layout observer records CLS 0.085. F16 medium: Consent images omit complete intrinsic dimensions. |
follow-best-practicesbrowser-platform-hygiene | issues | high | Lighthouse reports one deprecated API warning and four BFCache failure reasons. F17 medium: The page uses deprecated behavior and is not eligible for the back/forward cache. |
be-discoverabletitle-and-description | issues | high | DOM probe reports title “Facebook” and description:null. F18 medium: The public landing page has only a generic title and no meta description. |
be-discoverablecrawlable-and-mobile-friendly | issues | high | Discoverability measured 1% raw/rendered word coverage, classified the response as a JS shell, and captured a blank crawler screenshot. F19 high: Non-JavaScript crawlers receive almost none of the visible public content. |
be-discoverablecanonical-and-indexing-signals | pass | medium | The fetch succeeds with HTTP 200 after one intentional redirect and DOM exposes canonical https://en-gb.facebook.com/. |
be-discoverablestructured-and-shareable-metadata | not-applicable | high | The audited endpoint is a generic login gateway, not an article, product, event, place, or rich public entity. |
be-private-and-securesecure-transport-and-headers | issues | high | Headers evidence shows HTTPS, HSTS, nosniff and CSP, but the style-src policy includes unsafe-inline. F20 low: The CSP still permits unsafe inline styles. |
be-private-and-securedata-minimisation-and-third-parties | pass | medium | Tracker primitive found no known tracker domains and the pre-consent cookie audit found zero cookies; optional tracking is gated by consent. |
be-private-and-securein-context-permissions-and-modern-auth | pass | medium | No permission prompt appeared on load, Notification permission stayed default, and the login identity field advertises username webauthn. |
be-private-and-securedefensive-browser-policies | issues | high | Headers evidence reports referrer-policy missing while HSTS, X-Frame-Options and Permissions-Policy are present. F21 low: The main response omits an explicit Referrer-Policy header. |
be-resilientprogressive-enhancement | issues | high | Discoverability captured an empty crawler view and 1% content coverage despite 1,954 rendered text characters. F22 high: The public page is effectively blank without JavaScript. |
be-resilientresilient-runtime-behaviour | pass | medium | The modal remains fully bounded at desktop and narrow viewport conditions and can be dismissed to a stable login state. |
be-resilientoffline-and-installable | not-applicable | high | Facebook authentication and social data are intrinsically online; an offline/installable public login gateway would not provide a meaningful core task. |
be-resilientnetwork-and-http-failure-states | blocked | high | No controlled backend or authenticated test account was available to simulate representative Facebook HTTP/network failures. |
be-internationalisedlang-dir-and-logical-properties | pass | medium | DOM reports html lang=en and dir=ltr, with visible language-switching links and a stable layout in the tested locale. |
be-internationalisedlocale-aware-data | not-applicable | high | No dates, numbers, currency, durations, or calendars are rendered on the audited public surfaces. |
be-internationalisedtime-zone-correctness | not-applicable | high | No time or event data is presented or edited on the audited public surfaces. |
be-trustworthyno-dark-patterns | issues | high | Desktop and mobile screenshots show “Allow all cookies” as the filled blue primary action while “Decline optional cookies” is visually secondary, despite both being valid choices. F28 medium: The consent design gives the acceptance choice stronger visual emphasis than rejection. |
be-trustworthyhumane-error-handling | blocked | high | Invalid credential submission was not performed against the production authentication endpoint without an authorized test account. |
be-trustworthytrustworthy-input-assistance | issues | high | DOM probe reports username webauthn on the identity field but an empty autocomplete value on the password field. F23 medium: The password field omits an autocomplete token. |
be-trustworthysafe-commercial-and-account-flows | blocked | high | Authenticated account-management, reauthentication, cancellation, and sensitive-action flows require an authorized test account. |
be-sustainableoptimised-assets | issues | high | Images evidence reports four PNGs, all missing srcset and loading=lazy; each is below the fold. F24 medium: Consent imagery uses legacy PNG files without responsive sources or lazy loading below the fold. |
be-sustainableno-wasteful-work | issues | high | HAR records 43 requests and 2.05MB, including 24 scripts, before authentication; trace still records long tasks. F25 high: The login/consent route performs disproportionate startup work for its narrow purpose. |
be-sustainablethird-party-and-media-budget | issues | high | Relative to apps.facebook.com, HAR attributes 34 requests and 2.052MB to other origins, primarily static.xx.fbcdn.net; even accounting for same-owner CDN delivery, the payload is disproportionate to a login form. F26 medium: Cross-origin delivery dominates the app-origin request profile. |
be-agent-readystructured-agent-capabilities | not-applicable | high | The public login gateway exposes no safe unauthenticated agent task, and authenticated agent capabilities were outside accessible scope. |
be-agent-readyon-device-inference | not-applicable | high | The login and consent tasks do not benefit from on-device language-model or summarization inference. |
be-memory-efficientno-leak-under-repeated-interaction | pass | medium | After ten repeated focus/blur cycles, node count fell from 859,958 to 859,615; no unbounded retained growth was observed in this bounded interaction. |
be-memory-efficientbounded-footprint | issues | high | Baseline heap summary contains about 860k nodes/heap entries and 43.8MB self size; post-focus-cycle snapshot remains about 44.0MB. F27 medium: The initial heap footprint is high for a public login and consent surface. |
be-memory-efficientno-detached-dom-or-unbounded-listeners | pass | medium | Across baseline/post snapshots, total node count and object/array/closure populations did not grow after repeated focus cycles. |
Provenance
Canonical report: results/atomic/reports/0671-apps_facebook_com.json
Report SHA-256: a97d1ae8a505a8d07404b7943d6d11813a44810739afb12199b0d69251aefe04
Local retained report: runs/2026-07-17T17-27-24-856Z/atomic-reports/apps_facebook_com/2026-07-28T04-30-52-086Z/report.json
Local evidence root: runs/2026-07-17T17-27-24-856Z/atomic-reports/apps_facebook_com/2026-07-28T04-30-52-086Z
Catalog SHA-256: sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7
Raw screenshots, HARs, traces, heaps, and other browser artifacts are retained at the local evidence root and intentionally are not committed. Artifact paths in the canonical report are relative to that root.