Manifest position 722 · CrUX rank bucket 1000
https://noor.moe.gov.sa
Coverage complete
Coverage-complete audit of the public landing page and authentication gateway. The authenticated application and external identity-provider content are excluded because credentials were not supplied.
Attempts
1 / 3
Judged checks
58 / 58
Blocked
0
Not run
0
This report has no published overall score. Blocked and not-run checks are not passes. A coverage-complete report means every check has a judged outcome; it does not mean every check passed.
All 58 atomic check outcomes
| Principle / check | Status | Confidence | Evidence or reason |
|---|---|---|---|
respect-user-preferencesrespects-color-scheme | issues | high | Desktop screenshots under light and prefers-color-scheme: dark are pixel-identical; the page remains a white/light surface. F01 medium: The landing page ignores the system dark-color preference. |
respect-user-preferencesrespects-reduced-motion | issues | high | With prefers-reduced-motion: reduce active, the probe found two fadeInBottom animations lasting 1.75s and 2s plus two ride=carousel components. F02 medium: Reduced-motion users still receive entrance motion and auto-advancing carousels. |
respect-user-preferencesrespects-contrast | pass | high | Forced-colors screenshot preserves readable text, controls, and page structure. |
implement-natural-interactionsview-transitions | issues | high | The DOM probe shows primary navigation as javascript:__doPostBack links and no authored transition evidence; route changes replace the document abruptly. F03 low: Navigation relies on abrupt ASP.NET postbacks with no transition continuity. |
implement-natural-interactionsscroll-driven-animations | issues | high | The page probe found zero scroll timelines; all observed motion is conventional keyframe/carousel behavior. F04 low: Scroll-related presentation does not use declarative scroll timelines. |
implement-natural-interactionsphysical-gestures | issues | high | DOM and CSS inspection found Bootstrap carousel/navigation code, no scroll timeline, and no scroll-snap or native gesture evidence on the primary surfaces. F05 low: Carousel and mobile navigation use legacy framework behavior rather than platform-native interaction patterns. |
provide-guided-navigationscroll-state-aware-chrome | issues | high | The mobile probe identifies a position-fixed header, while source inspection found no scroll-state container query or progress treatment. F06 low: The fixed header does not adapt to scroll position. |
provide-guided-navigationanchored-positioning | not-applicable | high | No tooltip, popover, or edge-positioned menu is exposed on the two representative public surfaces. |
provide-guided-navigationdirects-attention | issues | high | Primary section links are javascript postbacks, and no authored view transition/highlight cue was found in the DOM/CSS probe. F07 low: Postback navigation provides no focus or visual continuity cue. |
maximize-content-reduce-noiseno-intrusive-interruptions | pass | high | Desktop/mobile load screenshots show content immediately with no blocking interstitial. |
maximize-content-reduce-noisesemantic-dismissible-primitives | issues | high | DOM inspection found zero dialog, popover, or details elements while the mobile UI includes a collapsible menu and a 400px settings panel. F08 medium: The collapsible navigation and settings panel are custom/Bootstrap div structures rather than modern semantic disclosure primitives. |
maximize-content-reduce-noisereduced-chrome | pass | high | Landing and login screenshots devote the central viewport to announcement, service explanation, and authentication choices. |
adapt-to-the-form-factorresponsive-no-horizontal-scroll | issues | high | The mobile screenshot shows the Arabic announcement cut off on both sides. body overflow-x:hidden masks overflow, so layout metrics report no scrollbar while content is still lost. F09 high: The hero is visibly cropped on a 360px viewport. |
adapt-to-the-form-factorcomponent-level-responsiveness | issues | high | The page probe found zero container queries, while the same navigation/settings components are placed in constrained mobile containers. F10 low: Components rely on global breakpoints rather than container-aware adaptation. |
adapt-to-the-form-factorinput-modality-aware | issues | high | The 360px probe measured the login button at 42.9px high, footer links at 34.7px, and social-icon links around 22-28px. F11 medium: Several interactive targets are smaller than the recommended touch area. |
support-core-task-successclear-purpose-and-primary-action | pass | high | Landing prominently labels sign-in; login page clearly offers the two national/unified identity choices. |
support-core-task-successprimary-flow-completion | pass | high | The representative sign-in handoff was activated and navigated away from the inspected document to the selected identity provider; further completion requires user credentials. |
support-core-task-successclear-system-state-and-recovery | not-applicable | high | The reachable public flow is a choice of external SSO providers and exposes no loading, empty, editable, or recoverable partial-completion state to exercise. |
be-fast-and-stablegood-core-web-vitals | issues | high | Lighthouse measured LCP 13.3s, FCP 3.8s, Speed Index 5.2s, and performance 0.64; the independent trace measured LCP 3.71s on an unthrottled run. F12 high: Largest Contentful Paint is very slow in the mobile Lighthouse run. |
be-fast-and-stablevisual-stability | pass | high | Landing CLS was 0.0029 and login CLS 0.0828 at 360px, both below the 0.1 good threshold. |
be-fast-and-stableefficient-main-thread | pass | high | Trace and layout observers recorded no long tasks and 0ms total blocking time; Lighthouse TBT was 10ms. |
be-fast-and-stableefficient-resource-delivery | issues | high | HAR recorded 46 requests and 2,043,486 transferred bytes, seven very-high-priority stylesheets, three parser-blocking legacy scripts, redirects, and four large advertisement/hero images without cache headers. F13 medium: The 2.04MB load has a long render-blocking and poorly cached dependency path. |
be-fast-and-stabletrim-unused-and-duplicate-code | issues | high | Lighthouse estimates 117KiB unused JavaScript and 84KiB unused CSS; Font Awesome JS alone transfers 410,531 bytes in the HAR. F14 medium: The page ships substantial unused CSS and JavaScript. |
be-inclusivenames-roles-labels | issues | high | The images primitive found two images without alt; Lighthouse image-alt failed on footer imagery, and the link inventory contains multiple image/icon links with empty text. F15 high: Meaningful images and links lack accessible alternatives. |
be-inclusivesufficient-contrast | pass | high | Lighthouse color-contrast audit passed and forced-colors capture remains legible. |
be-inclusivestructure-and-focus | issues | high | The DOM probe reports empty html lang/dir and no main landmark; the H1 is empty. Lighthouse failed html-has-lang and heading-order on seven H6 elements. F16 high: The landing page lacks a document language and has broken heading/landmark structure. |
be-inclusivelegible-text | pass | high | Desktop landing and both login captures use readable Arabic type, line spacing, and clear alignment; clipping is separately recorded under responsive reflow. |
be-inclusivezoom-reflow-targets-and-media | pass | high | Both pages reflow to 360px without a document scrollbar and viewport scaling is not disabled; undersized targets are separately recorded under input modality. |
follow-best-practicesno-console-errors | issues | high | HAR and Lighthouse console evidence report net::ERR_SSL_VERSION_OR_CIPHER_MISMATCH for rocket-loader.min.js. F17 medium: A third-party Cloudflare script fails during page load. |
follow-best-practicessound-document-and-assets | issues | high | The images primitive found 14 of 18 images without dimensions, 13 below-fold images not lazy-loaded, 15 legacy-format images, and six raster images without srcset. F18 medium: Image delivery lacks basic sizing and responsive hygiene. |
follow-best-practicesbrowser-platform-hygiene | issues | high | The DOM probe lists most navigation and login actions as javascript:__doPostBack or javascript:;, preventing normal URL semantics and graceful browser behavior. F19 medium: Core links depend on javascript: URLs and legacy postback wiring. |
be-discoverabletitle-and-description | pass | high | DOM/discoverability evidence confirms descriptive title and meta description in raw and rendered HTML. |
be-discoverablecrawlable-and-mobile-friendly | issues | high | Most internal links are javascript postbacks. Lighthouse reports 359 robots.txt errors because /robots.txt redirects to and serves an HTML page. F20 high: Core internal links are not crawler-friendly and robots.txt is invalid. |
be-discoverablecanonical-and-indexing-signals | issues | high | The landing canonical points to Login.aspx?ref=noor; /robots.txt and /sitemap.xml both redirect into login HTML instead of serving their formats. F21 medium: Indexing signals disagree with the public landing page. |
be-discoverablestructured-and-shareable-metadata | issues | high | og:url, og:image, and twitter:image use https:/ with one slash; no JSON-LD was found despite the page representing a government education organization/service. F22 medium: Social metadata contains malformed URLs and no structured entity data. |
be-private-and-securesecure-transport-and-headers | issues | high | Headers primitive found no CSP or HSTS. Cookie audit found six of seven cookies without Secure, including ASPSESSIONIDSQASRDDQ without HttpOnly, and most use SameSite=None. F23 critical: The final document lacks core security headers and sets insecure session/tracking cookies. |
be-private-and-securedata-minimisation-and-third-parties | issues | high | Tracker scan found seven third-party origins including Google Analytics; HAR attributes 1,291,653 of 2,043,486 bytes to third parties and shows 400-day GA cookies. F24 medium: Third-party analytics and monitoring dominate the transfer budget. |
be-private-and-securein-context-permissions-and-modern-auth | pass | high | No permission prompt appeared on load; the login page offers national identity and unified SSO rather than an exposed password-only form. |
be-private-and-securedefensive-browser-policies | issues | high | Headers evidence reports missing clickjacking protection, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy in addition to CSP/HSTS. F25 high: Browser-enforced defensive policies are absent on the final page. |
be-resilientprogressive-enhancement | issues | high | Although raw HTML contains content, the DOM shows the core navigation and authentication controls as javascript:__doPostBack links. F26 high: Primary navigation and sign-in actions do not work as links without JavaScript. |
be-resilientresilient-runtime-behaviour | pass | high | Mobile menu repeated 10 times without DOM growth or a broken state; both narrow captures retain usable controls. |
be-resilientoffline-and-installable | not-applicable | high | The public landing/sign-in gateway is intrinsically online and is not presented as an installable application. |
be-resilientnetwork-and-http-failure-states | issues | high | Direct requests for robots.txt and sitemap.xml both return 302 redirects into login/landing HTML; Lighthouse parses the HTML as 359 robots errors. F27 medium: Machine-readable and missing routes are redirected into HTML rather than returning intentional failure/resource states. |
be-internationalisedlang-dir-and-logical-properties | issues | high | Landing html has no lang or dir. CSS inspection counted 9 logical-property occurrences versus 1,443 physical left/right declarations. F28 high: The Arabic landing page does not declare language/direction and overwhelmingly uses physical CSS. |
be-internationalisedlocale-aware-data | not-applicable | high | The representative public pages show no dates, currencies, locale-sensitive numbers, or user-entered locale data. |
be-internationalisedtime-zone-correctness | not-applicable | high | The representative public pages expose no scheduled events or time-zone-sensitive values. |
be-trustworthyno-dark-patterns | pass | high | No consent wall, confirmshaming, disguised advertising, forced continuity, or preselected commercial choice appeared on landing/login. |
be-trustworthyhumane-error-handling | not-applicable | high | The reachable sign-in page has no authored input fields; authentication is handed to external SSO providers. |
be-trustworthytrustworthy-input-assistance | not-applicable | high | The reachable sign-in page contains no address, payment, account, or text inputs requiring autocomplete. |
be-trustworthysafe-commercial-and-account-flows | not-applicable | high | No commercial, subscription, cancellation, or account-management flow is publicly reachable without authentication. |
be-sustainableoptimised-assets | issues | high | HAR transfers 661KB of images and 506KB of fonts; image inspection found 15 legacy-format files, six missing responsive sources, and three oversized images. F29 medium: Media is delivered inefficiently for a mostly informational landing page. |
be-sustainableno-wasteful-work | issues | high | The page loads Google Analytics, AppDynamics, Font Awesome JS and a failing Rocket Loader; Lighthouse identifies 117KiB unused JS and 84KiB unused CSS. F30 medium: Non-essential analytics, monitoring, and unused framework code create avoidable work. |
be-sustainablethird-party-and-media-budget | issues | high | HAR reports 13 third-party requests and 1.29MB third-party transfer, about 63% of the total; trackers include GTM/GA and AppDynamics. F31 medium: Third-party resources consume a disproportionate share of a simple landing page. |
be-agent-readystructured-agent-capabilities | not-applicable | high | This conventional public information/sign-in gateway declares no agent-facing intent; the emerging WebMCP opportunity is out of scope. |
be-agent-readyon-device-inference | not-applicable | high | The public landing/sign-in tasks do not require summarization or language-model inference. |
be-memory-efficientno-leak-under-repeated-interaction | pass | high | After 10 menu open/close cycles, heap self-size rose only 220,725 bytes (1.3%) and DOM nodes remained 353; this does not indicate unbounded retention. |
be-memory-efficientbounded-footprint | pass | high | Baseline heap self-size was 16.7MB with 353 live DOM elements, proportionate for this page. |
be-memory-efficientno-detached-dom-or-unbounded-listeners | pass | high | Baseline/post constructor summaries show no Detached* population and DOM nodes remained 353 after 10 cycles. |
Provenance
Canonical report: results/atomic/reports/0722-noor_moe_gov_sa.json
Report SHA-256: 02e21535b2bf3e7d13331e9bcd6824a63c3fcddbd260a81c709369fbe1f85f5a
Local retained report: runs/2026-07-17T17-27-24-856Z/atomic-reports/noor_moe_gov_sa/2026-07-22T15-40-16-306Z/report.json
Local evidence root: runs/2026-07-17T17-27-24-856Z/atomic-reports/noor_moe_gov_sa/2026-07-22T15-40-16-306Z
Catalog SHA-256: sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7
Raw screenshots, HARs, traces, heaps, and other browser artifacts are retained at the local evidence root and intentionally are not committed. Artifact paths in the canonical report are relative to that root.