Manifest position 742 · CrUX rank bucket 1000
https://m.facebook.com
Coverage complete
Complete atomic audit of anonymous public entry, consent, login, registration, and policy templates. Authenticated product surfaces were explicitly out of representative anonymous scope.
Attempts
2 / 3
Judged checks
58 / 58
Blocked
0
Not run
0
This report has no published overall score. Blocked and not-run checks are not passes. A coverage-complete report means every check has a judged outcome; it does not mean every check passed.
All 58 atomic check outcomes
| Principle / check | Status | Confidence | Evidence or reason |
|---|---|---|---|
respect-user-preferencesrespects-color-scheme | issues | high | The light and dark captures are byte-identical (51,708 bytes), and the DOM reports color-scheme: normal with a white body surface despite prefers-color-scheme: dark. F01 medium: The first-run experience does not follow the requested dark theme |
respect-user-preferencesrespects-reduced-motion | pass | medium | The media query matched, 33 reduced-motion CSS rules were present, and document.getAnimations() returned no running animations. |
respect-user-preferencesrespects-contrast | issues | high | Lighthouse measured the white “Allow all cookies” label on #1877f2 at 4.23:1, below the required 4.5:1 for 15px bold text. F02 medium: The primary consent action misses minimum text contrast |
implement-natural-interactionsview-transitions | not-applicable | high | The unauthenticated landing, consent, and policy surfaces expose no same-document route transition to animate; protected SPA navigation requires an account. |
implement-natural-interactionsscroll-driven-animations | not-applicable | high | The representative anonymous surfaces contain no scroll-linked animation or scrollytelling use case; native scrolling is appropriate. |
implement-natural-interactionsphysical-gestures | pass | medium | The audited anonymous surfaces use native document scrolling with no observed custom gesture layer or main-thread pointer-driven interaction. |
provide-guided-navigationscroll-state-aware-chrome | pass | medium | The Privacy Policy uses a compact persistent header and clear section hierarchy while the document itself scrolls natively. |
provide-guided-navigationanchored-positioning | pass | medium | The consent overlay remains centered and within the viewport at both desktop and mobile sizes without edge drift. |
provide-guided-navigationdirects-attention | pass | medium | Login, registration, and privacy surfaces expose a clear primary heading/action; the consent dialog clearly presents the immediate choice. |
maximize-content-reduce-noiseno-intrusive-interruptions | issues | high | Mobile and desktop screenshots show an aria-modal consent layer before any interaction, dimming and blocking the login page; on mobile it consumes most of the visible page. F03 high: A full blocking cookie dialog obscures the entire entry experience |
maximize-content-reduce-noisesemantic-dismissible-primitives | issues | high | The structure probe finds DIV role=dialog aria-modal=true, not <dialog>; focusable elements behind it appear before dialog controls in DOM focus order. F04 medium: The blocking dialog is custom DIV-based UI rather than a native dialog |
maximize-content-reduce-noisereduced-chrome | pass | medium | The Privacy Policy template uses a restrained header and gives most of the viewport to readable policy content. |
adapt-to-the-form-factorresponsive-no-horizontal-scroll | issues | high | At a requested 390px viewport, layout reports a 980px CSS viewport scaled to 0.398 and hasViewportMeta=false, making consent copy and footer links extremely small. F05 high: The m.facebook.com entry page lacks a mobile viewport declaration |
adapt-to-the-form-factorcomponent-level-responsiveness | issues | high | The platform probe found zero @container rules and the 390px capture renders a 980px layout scaled down rather than adapting component geometry. F06 low: The entry components rely on page-level scaling instead of component-level responsiveness |
adapt-to-the-form-factorinput-modality-aware | issues | high | The focus probe successfully focused inputs, Log in, recovery, signup, and footer links, but computed outline was none and box-shadow was none for all sampled controls. F07 high: Keyboard focus is invisible on the primary login controls and footer links |
support-core-task-successclear-purpose-and-primary-action | pass | medium | The entry says “Log in to Facebook”, exposes Log in and Create new account, and the registration route explains account creation. |
support-core-task-successprimary-flow-completion | issues | high | After declining optional cookies and invoking Log in with both fields empty, the page remained unchanged with no invalid controls and no alert or live-region message. F08 high: Empty login submission provides no actionable response |
support-core-task-successclear-system-state-and-recovery | issues | high | The exercised empty-submit state produced invalid: [] and alerts: [], so users receive no state change, diagnosis, or recovery instruction. F09 high: The primary flow does not expose validation or recovery state for missing credentials |
be-fast-and-stablegood-core-web-vitals | issues | high | Lighthouse measured FCP 5.3s, LCP 7.8s, Speed Index 8.1s and performance 0.59; the raw-CDP trace independently measured FCP 4.04s and LCP 4.19s. F10 high: The mobile authentication route paints too slowly |
be-fast-and-stablevisual-stability | issues | high | The layout observer recorded CLS 0.0857 at about 2.26s; all four consent images lack a height attribute and the images probe flags missing dimensions. F11 medium: Late layout movement and dimensionless consent images destabilise first render |
be-fast-and-stableefficient-main-thread | pass | medium | The raw trace recorded 184ms TBT and Lighthouse recorded 25ms TBT, both below the common 200ms poor threshold despite two long tasks. |
be-fast-and-stableefficient-resource-delivery | issues | high | The HAR records 41 requests and 2,050,669 transferred bytes, including 1.33MB of JavaScript, 324KB CSS, a 183KB font, and a parser-inserted 289KB stylesheet. F12 high: The anonymous entry route ships a heavy dependency chain |
be-fast-and-stabletrim-unused-and-duplicate-code | issues | high | Lighthouse’s unused-javascript audit failed with three resources while the HAR shows 24 scripts transferring 1.33MB for a simple login/consent surface. F13 medium: Large unused JavaScript payloads are delivered to the login route |
be-inclusivenames-roles-labels | issues | high | Lighthouse found a role=heading image without aria-level and an unlabeled consent checkbox; the registration probe also shows custom DIV role=button controls. F14 high: Authentication and consent controls contain accessibility naming/role defects |
be-inclusivesufficient-contrast | issues | high | Lighthouse identifies the “Allow all cookies” text at 4.23:1 against its blue background, below 4.5:1. F15 medium: Consent action text has insufficient contrast |
be-inclusivestructure-and-focus | issues | high | The entry structure contains no h1, uses a DIV role=main, and the focus probe finds no visible outline or shadow on sampled controls; Lighthouse also reports malformed ARIA. F16 high: Heading structure and focus treatment are incomplete |
be-inclusivelegible-text | issues | high | The 390px capture uses a 980px CSS viewport at 0.398 scale; the DOM reports 12px body text, rendering key consent and footer copy at roughly 4.8 CSS pixels visually. F17 high: The mobile entry view scales desktop typography down to illegible sizes |
be-inclusivezoom-reflow-targets-and-media | issues | high | The CDP entry route has no viewport meta; Lighthouse’s redirected mobile login has user-scalable=no, initial-scale=1, maximum-scale=1. F18 high: Viewport handling prevents reliable mobile reflow and restricts zoom on a Lighthouse route |
follow-best-practicesno-console-errors | issues | high | Lighthouse captured TypeError: Cannot read properties of undefined (reading getElementsByTagName) in a first-party fbcdn script. F19 medium: The mobile login route throws a production JavaScript exception |
follow-best-practicessound-document-and-assets | issues | high | The images probe reports all four PNGs missing height; the DOM has a valid doctype/UTF-8 but no viewport or description, and CLS reached 0.0857. F20 medium: Consent images omit intrinsic height and the entry document omits key metadata |
follow-best-practicesbrowser-platform-hygiene | issues | high | Lighthouse reports a deprecated unload listener and four back/forward-cache failure reasons on the mobile login route. F21 medium: Deprecated unload listeners and bfcache blockers remain |
be-discoverabletitle-and-description | issues | high | The DOM probe finds title “Facebook” but description=null; the raw HTML comparison also reports no meta description. F22 medium: The entry route has no meta description |
be-discoverablecrawlable-and-mobile-friendly | issues | high | Links are crawlable, but the DOM and layout probes show no viewport meta and a 980px layout scaled into 390px. F23 high: The canonical entry experience is not mobile-friendly at the requested URL |
be-discoverablecanonical-and-indexing-signals | issues | high | The entry canonical points to en-gb.facebook.com, robots.txt is available, but /sitemap.xml returns HTTP 500. F24 low: The sitemap endpoint fails and indexing signals are inconsistent across m/www routes |
be-discoverablestructured-and-shareable-metadata | issues | high | The metadata probe found no JSON-LD, microdata, hreflang, Open Graph, or description metadata on the rendered entry route. F25 low: The anonymous landing route exposes no structured or social metadata |
be-private-and-securesecure-transport-and-headers | issues | high | HTTPS, HSTS, nosniff, X-Frame-Options and Permissions-Policy are present, but Referrer-Policy is absent and style-src allows unsafe-inline. F26 medium: Security headers are strong overall but the CSP and referrer controls have gaps |
be-private-and-securedata-minimisation-and-third-parties | issues | high | Before consent, the tracker/HAR evidence records an Instagram XHR plus 2.05MB classified cross-origin from Facebook/CDN origins; no known third-party tracker or cookie was found. F27 medium: The pre-consent route contacts Instagram and transfers substantial cross-origin resources |
be-private-and-securein-context-permissions-and-modern-auth | pass | medium | No permission prompt appeared on load, no cookies were set before consent, and the username field advertises the webauthn autocomplete token. |
be-private-and-securedefensive-browser-policies | issues | high | Headers show HSTS, DENY framing, nosniff and a broad Permissions-Policy, but no Referrer-Policy and CSP style-src unsafe-inline. F28 medium: Defensive policy coverage is incomplete |
be-resilientprogressive-enhancement | pass | medium | Raw HTML returned 200, the page was not a JS shell, and 73% of rendered content words were available without JavaScript. |
be-resilientresilient-runtime-behaviour | pass | medium | The first-run dialog remained operable and visible under forced colors and at both tested viewport sizes. |
be-resilientoffline-and-installable | not-applicable | high | Anonymous Facebook login and policy pages are network services rather than an installable/offline task in the audited scope; no manifest or service worker was present. |
be-resilientnetwork-and-http-failure-states | issues | high | The empty login submission generated neither native invalid state nor an ARIA alert, leaving the user with no diagnosis or retry guidance. F29 medium: The tested primary form does not present a recoverable failure state |
be-internationalisedlang-dir-and-logical-properties | pass | medium | The main rendered entry has lang=en and dir=ltr, and the UI exposes multiple language choices; the policy is localized English content. |
be-internationalisedlocale-aware-data | not-applicable | high | The sampled anonymous surfaces contain no locale-sensitive numeric/currency output to evaluate; visible dates are prose in the selected English locale. |
be-internationalisedtime-zone-correctness | not-applicable | high | No event scheduling or time-zone-sensitive date/time computation appears in the anonymous representative paths. |
be-trustworthyno-dark-patterns | pass | medium | Decline optional cookies is present alongside Allow all cookies without confirmshaming, and declining reveals the login page without retaliation. |
be-trustworthyhumane-error-handling | issues | high | After empty submission, no :invalid/aria-invalid controls and no alert/live region appeared. F30 high: Missing credentials receive no humane validation feedback |
be-trustworthytrustworthy-input-assistance | issues | high | Login email uses autocomplete="username webauthn", but password autocomplete is empty; all sampled registration inputs use autocomplete="off". F31 high: Password and registration fields disable useful autofill semantics |
be-trustworthysafe-commercial-and-account-flows | issues | high | Registration exposes DIV role=button submission and inputs without required constraints; sampled controls use autocomplete=off. F32 medium: Account creation uses custom controls with weak native form semantics |
be-sustainableoptimised-assets | issues | high | Four below-fold PNGs have no srcset, no lazy loading, no intrinsic height, and no modern format; images transfer 118KB. F33 medium: Consent imagery is not delivered with modern responsive image practices |
be-sustainableno-wasteful-work | issues | high | The route transfers 2.05MB and 24 scripts; the trace records two long tasks and 184ms TBT, while Lighthouse flags unused JavaScript. F34 high: A simple anonymous login surface performs disproportionate work |
be-sustainablethird-party-and-media-budget | issues | high | HAR classifies 2,050,231 bytes across 32 requests as cross-origin from the m.facebook.com start URL, primarily fbcdn and www.facebook.com. F35 medium: The anonymous route exceeds a reasonable cross-origin asset budget |
be-agent-readystructured-agent-capabilities | not-applicable | high | Facebook explicitly disallows major AI-agent crawlers in robots.txt, so exposing agent-executable site capabilities conflicts with the declared indexing policy for this scope. |
be-agent-readyon-device-inference | not-applicable | high | No user-facing summarisation/translation/generation task was exposed on the anonymous login, registration, consent, or policy paths that requires on-device inference. |
be-memory-efficientno-leak-under-repeated-interaction | pass | low | After ten repeated attempts, heap self size changed from 43.9MB to 45.7MB and nodes from 860,566 to 878,221; this one-window comparison did not establish unbounded retained growth. |
be-memory-efficientbounded-footprint | issues | high | The baseline heap summary contains 860,566 nodes and 43.9MB self size before meaningful interaction, disproportionate to a login and consent surface. F36 medium: The static first-run route has a large in-memory footprint |
be-memory-efficientno-detached-dom-or-unbounded-listeners | pass | low | Detached* constructors did not appear among the top retained constructors in either summary; no accumulating detached-DOM signal was observed. |
Provenance
Canonical report: results/atomic/reports/0742-m_facebook_com.json
Report SHA-256: 0b6cac980edbcc8bf081d84f8a13ee3d941afd0d527e320d7c8a3d92ab4ffbf4
Local retained report: runs/2026-07-17T17-27-24-856Z/atomic-reports/m_facebook_com/2026-07-26T21-59-19-108Z/report.json
Local evidence root: runs/2026-07-17T17-27-24-856Z/atomic-reports/m_facebook_com/2026-07-26T21-59-19-108Z
Catalog SHA-256: sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7
Raw screenshots, HARs, traces, heaps, and other browser artifacts are retained at the local evidence root and intentionally are not committed. Artifact paths in the canonical report are relative to that root.