Manifest position 811 · CrUX rank bucket 1000
https://accounts.spotify.com
Coverage complete
Coverage-complete audit of the public account entry, invalid/empty recovery state, and signup handoff. Authenticated account pages and real credential completion were not covered because they require a user account.
Attempts
2 / 3
Judged checks
58 / 58
Blocked
0
Not run
0
This report has no published overall score. Blocked and not-run checks are not passes. A coverage-complete report means every check has a judged outcome; it does not mean every check passed.
All 58 atomic check outcomes
| Principle / check | Status | Confidence | Evidence or reason |
|---|---|---|---|
respect-user-preferencesrespects-color-scheme | issues | high | Emulated `prefers-color-scheme: light` screenshot compared with default screenshot. F1 medium: Respect the OS colour preference instead of forcing dark |
respect-user-preferencesrespects-reduced-motion | pass | high | Reduced-motion emulation matched and the page reported zero active animations; there is no non-essential motion to suppress. |
respect-user-preferencesrespects-contrast | pass | high | Forced-colors/high-contrast screenshot keeps text, field borders, button labels, and keyboard focus clearly visible. |
implement-natural-interactionsview-transitions | issues | high | Static rendered stylesheet probe reported `viewTransition: false`. F2 low: Add continuity to multi-step authentication state changes |
implement-natural-interactionsscroll-driven-animations | not-applicable | high | The audited authentication screens contain no scroll-linked storytelling, parallax, carousel, or reveal motion. |
implement-natural-interactionsphysical-gestures | not-applicable | high | The audited authentication screens expose no gesture-driven interaction. |
provide-guided-navigationscroll-state-aware-chrome | not-applicable | high | This short single-task form has no persistent scroll chrome that needs scroll-state adaptation. |
provide-guided-navigationanchored-positioning | not-applicable | high | No tooltip, popover, or menu overlay is present on the audited states. |
provide-guided-navigationdirects-attention | pass | high | The first viewport has one H1, one labelled email field, and one visually dominant Continue action; Next.js also includes an assertive route announcer. |
maximize-content-reduce-noiseno-intrusive-interruptions | pass | high | Desktop and mobile load screenshots show no content-obscuring popup or interstitial. |
maximize-content-reduce-noisesemantic-dismissible-primitives | not-applicable | high | No transient overlay, modal flow, or disclosure control appears on the audited states. |
maximize-content-reduce-noisereduced-chrome | pass | high | The viewport is almost entirely the authentication task, with minimal logo/header chrome and no decorative sidebars. |
adapt-to-the-form-factorresponsive-no-horizontal-scroll | pass | high | At 360x800 the layout primitive measured scrollWidth=clientWidth=360 and zero horizontal overflow; viewport meta is present. |
adapt-to-the-form-factorcomponent-level-responsiveness | not-applicable | high | The public login is a single fixed-purpose form, with no evidence that this component is reused in differently sized containers. |
adapt-to-the-form-factorinput-modality-aware | pass | high | Primary controls are 48px high and the focused email input has a visible 2px white outline. |
support-core-task-successclear-purpose-and-primary-action | pass | high | “Welcome back”, the Email label, and full-width Continue button make purpose and next action immediate on desktop and mobile. |
support-core-task-successprimary-flow-completion | pass | medium | The public entry step exposes working real-href routes for email continuation, three federated providers, and sign-up; no decorative detour precedes the primary action. |
support-core-task-successclear-system-state-and-recovery | issues | high | Interaction screenshot after `form.requestSubmit()` is unchanged; the email input is `type=text`, has no `required`, and remains `aria-invalid=false`. F3 high: Empty primary submission has no visible recovery state |
be-fast-and-stablegood-core-web-vitals | pass | high | Lighthouse measured LCP 2.44s, CLS 0.0099 and TBT 46ms; trace measured LCP 1.53s and TBT 0ms. |
be-fast-and-stablevisual-stability | pass | high | Mobile layout observer measured CLS 0.00898, well within the good range, with no unreserved images. |
be-fast-and-stableefficient-main-thread | pass | high | Trace captured zero long tasks and 0ms total blocking time; the layout observer also saw no long tasks. |
be-fast-and-stableefficient-resource-delivery | issues | high | HAR recorded two 307 redirects; Lighthouse estimated 790 ms redirect savings and 1,040 ms render-blocking savings. F4 medium: Remove redirect and critical delivery delay |
be-fast-and-stabletrim-unused-and-duplicate-code | issues | high | Lighthouse estimated 273 KiB unused JavaScript and 13 KiB legacy JavaScript; HAR transferred 704,779 bytes of script. F5 medium: Trim unused and legacy JavaScript |
be-inclusivenames-roles-labels | pass | high | Lighthouse accessibility scored 1.0; DOM shows a labelled email input, semantic button/anchors, named Spotify SVG, and no content images. |
be-inclusivesufficient-contrast | pass | high | Lighthouse accessibility scored 1.0 and both normal and forced-colors screenshots retain strong contrast. |
be-inclusivestructure-and-focus | pass | high | DOM has one H1, main/header landmarks, semantic controls and an assertive route announcer; focus probe measured a visible 2px outline. |
be-inclusivelegible-text | pass | high | Desktop/mobile screenshots show unclipped, readable text with a clear hierarchy and fluid heading wrap. |
be-inclusivezoom-reflow-targets-and-media | pass | high | Viewport allows scaling, mobile reflow has no overflow, primary controls are 48px high, and there is no media requiring captions. |
follow-best-practicesno-console-errors | pass | high | Lighthouse did not report console-error or uncaught-exception failures during load. |
follow-best-practicessound-document-and-assets | pass | high | DOM has HTML doctype, UTF-8 charset and viewport metadata; the images primitive found no raster images or image defects. |
follow-best-practicesbrowser-platform-hygiene | issues | high | Lighthouse `bf-cache` and `inspector-issues` audits both scored 0. F6 medium: Restore platform navigation hygiene |
be-discoverabletitle-and-description | issues | high | DOM and Lighthouse both found no meta description; rendered title is only “Spotify”. F7 medium: Use descriptive search/share metadata |
be-discoverablecrawlable-and-mobile-friendly | pass | high | All six visible links have real descriptive hrefs, viewport meta is present, and robots.txt explicitly allows `/*/login`. |
be-discoverablecanonical-and-indexing-signals | issues | high | The successful `/en-GB/login` page has no canonical or hreflang signal, and `/sitemap.xml` returned 404, although robots explicitly allows login routes. F8 low: Complete canonical indexing signals |
be-discoverablestructured-and-shareable-metadata | not-applicable | high | A private account login form is not an article, product, event, or other rich public entity requiring schema.org/share metadata. |
be-private-and-securesecure-transport-and-headers | issues | high | Cookie audit found `sp_sso_csrf_token` without Secure and `sp_t` with SameSite=None; CSP permits unsafe-inline styles. F9 high: Harden cookies and CSP on the auth origin |
be-private-and-securedata-minimisation-and-third-parties | pass | high | No sensitive secrets or known tracker origins were found; observed Google requests serve disclosed reCAPTCHA fraud protection. |
be-private-and-securein-context-permissions-and-modern-auth | issues | high | DOM exposes email, Google, Facebook and Apple paths; no passkey control is present on this relevant authentication surface. F10 medium: Offer phishing-resistant authentication |
be-private-and-securedefensive-browser-policies | issues | high | Headers primitive found both policies absent; HSTS, nosniff and clickjacking protection were present. F11 medium: Add missing browser defense policies |
be-resilientprogressive-enhancement | issues | high | Crawler screenshot shows the full form plus “Please enable JavaScript to continue”; discoverability coverage was only 20%. F12 medium: Make the first auth step progressively functional |
be-resilientresilient-runtime-behaviour | pass | high | The simple form has no cut-off overlays; narrow layout remains contained and route state is announced. |
be-resilientoffline-and-installable | not-applicable | high | Authentication intrinsically requires a live identity service; offline/installability is not a meaningful requirement for this login origin. |
be-resilientnetwork-and-http-failure-states | pass | medium | Server HTML includes an actionable no-script alert, and shipped translations include connection, server, retry and support recovery messages. |
be-internationalisedlang-dir-and-logical-properties | pass | high | Rendered HTML declares lang=en-GB and dir=ltr; authored layout CSS uses logical inline/block sizing and padding, with locale-prefixed routes and translations. |
be-internationalisedlocale-aware-data | not-applicable | high | The audited screens display no dates, numbers, currencies, durations, or calendar data. |
be-internationalisedtime-zone-correctness | not-applicable | high | The audited screens display or edit no time-zone-sensitive data. |
be-trustworthyno-dark-patterns | pass | high | The login page presents equivalent provider choices, sign-up and legal links without consent walls, forced continuity, pricing, or confirmshaming. |
be-trustworthyhumane-error-handling | issues | high | Empty-submit interaction remained unchanged; DOM shows no `required` attribute and `aria-invalid=false`. F13 high: Provide humane required-field feedback |
be-trustworthytrustworthy-input-assistance | pass | high | The email/username field is labelled and uses autocomplete=username with autocapitalize, spellcheck and autocorrect disabled appropriately. |
be-trustworthysafe-commercial-and-account-flows | pass | high | Authentication choices and sign-up are explicit, legal links are visible, and no commercial commitment or preselected consent is introduced. |
be-sustainableoptimised-assets | pass | high | Images primitive found zero raster images; brand/provider artwork is lightweight inline SVG, avoiding resolution waste. |
be-sustainableno-wasteful-work | pass | high | Trace and layout observers captured no long tasks or ongoing animation; network completed with 26 bounded requests. |
be-sustainablethird-party-and-media-budget | issues | high | HAR transferred 871,015 bytes total; reCAPTCHA alone was 382,965 bytes, and the tracker probe observed seven third-party origins (none matched known trackers). F14 medium: Defer and budget third-party authentication code |
be-agent-readystructured-agent-capabilities | not-applicable | high | This security-sensitive account login surface has no appropriate agent-facing transaction to expose. |
be-agent-readyon-device-inference | not-applicable | high | The login task has no summarisation or language-model use case that would improve the experience. |
be-memory-efficientno-leak-under-repeated-interaction | pass | high | After ten representative input focus/edit/blur cycles, heap self-size rose only 191,390 bytes (1.38%) and closure count stayed 15,948. |
be-memory-efficientbounded-footprint | pass | high | Baseline heap self-size was 13.84MB for the hydrated Next.js/recaptcha login, proportionate to the page and stable after interaction. |
be-memory-efficientno-detached-dom-or-unbounded-listeners | pass | high | Before/after summaries show unchanged closure count and no growing Detached* constructor among reported populations. |
Provenance
Canonical report: results/atomic/reports/0811-accounts_spotify_com.json
Report SHA-256: 07409691bcace2d6f7cb45feda0db0097a5d74061386765b89a9fd007df16343
Local retained report: runs/2026-07-17T17-27-24-856Z/atomic-reports/accounts_spotify_com/2026-07-27T01-48-42-260Z/report.json
Local evidence root: runs/2026-07-17T17-27-24-856Z/atomic-reports/accounts_spotify_com/2026-07-27T01-48-42-260Z
Catalog SHA-256: sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7
Raw screenshots, HARs, traces, heaps, and other browser artifacts are retained at the local evidence root and intentionally are not committed. Artifact paths in the canonical report are relative to that root.