Manifest position 945 · CrUX rank bucket 1000
https://www.paypal.com
Coverage complete
Coverage-complete unauthenticated audit of five representative UK public templates. Excludes authenticated account, checkout/payment execution, merchant dashboard, help centre, legal documents beyond linked disclosures, and country variants because they require identity/financial actions or are separate shared templates.
Attempts
1 / 3
Judged checks
58 / 58
Blocked
0
Not run
0
This report has no published overall score. Blocked and not-run checks are not passes. A coverage-complete report means every check has a judged outcome; it does not mean every check passed.
All 58 atomic check outcomes
| Principle / check | Status | Confidence | Evidence or reason |
|---|---|---|---|
respect-user-preferencesrespects-color-scheme | issues | high | Desktop screenshots captured in default and prefers-color-scheme: dark are byte-identical at 63,512 bytes; the white page and blue hero remain unchanged. F01 medium: The public surface does not adapt to the user’s dark colour-scheme preference. |
respect-user-preferencesrespects-reduced-motion | pass | high | Reduced-motion probe matched the preference and found zero active animations; CSS includes a reduced-motion rule for the brand moment. |
respect-user-preferencesrespects-contrast | pass | high | High-contrast screenshot remained legible; Lighthouse accessibility scored 0.98 and reported no contrast failure. |
implement-natural-interactionsview-transitions | issues | medium | Rendered DOM/CSS evidence contains no @view-transition rule or view-transition-name despite prominent navigation between same-origin product pages. F02 low: Navigating this MPA has no authored cross-document View Transition treatment. |
implement-natural-interactionsscroll-driven-animations | pass | high | Sticky/scroll brand-moment styling uses compositor-friendly transforms/opacity and no active animation persisted under reduced motion. |
implement-natural-interactionsphysical-gestures | not-applicable | high | No drag, swipe-only or other physical-gesture-exclusive core interaction is present on the representative routes. |
provide-guided-navigationscroll-state-aware-chrome | pass | high | Navigation remains compact and usable at 360 px; sticky full-height content is bounded with overflow: clip and responsive rules. |
provide-guided-navigationanchored-positioning | not-applicable | high | No tooltip, teaching bubble or transient anchored surface requiring target-relative positioning appeared in the representative public routes. |
provide-guided-navigationdirects-attention | pass | high | Each route uses a prominent heading, restrained colour hierarchy and a small set of primary actions; mobile screenshots preserve the intended sequence. |
maximize-content-reduce-noiseno-intrusive-interruptions | pass | high | The only interruption is the legally motivated cookie banner, which offers equally visible Accept, Decline and Close controls and leaves core content visible. |
maximize-content-reduce-noisesemantic-dismissible-primitives | issues | high | DOM/evaluate evidence reports zero dialog and zero popover elements while showing .CookieBanner_container fixed above content with Accept, Decline and Close controls. F03 medium: The cookie interruption is implemented as fixed generic containers rather than a native dismissible top-layer primitive. |
maximize-content-reduce-noisereduced-chrome | pass | high | Public templates emphasise product content with a compact global navigation and no dense application chrome. |
adapt-to-the-form-factorresponsive-no-horizontal-scroll | pass | high | Every tested route reported horizontalOverflowPx 0 and scrollWidth 360 for clientWidth 360. |
adapt-to-the-form-factorcomponent-level-responsiveness | pass | high | Grid, clamp(), responsive picture sources and component media queries recompose cards and split sections cleanly across the sampled templates. |
adapt-to-the-form-factorinput-modality-aware | pass | high | The first visible link accepted focus with a visible auto outline; authored controls include focus/focus-visible styles and carousel buttons expose keyboard state. |
support-core-task-successclear-purpose-and-primary-action | pass | high | Each route clearly states its purpose and exposes relevant next actions such as Log In, Sign Up or product discovery alongside descriptive headings. |
support-core-task-successprimary-flow-completion | pass | high | Prominent calls to action have real href destinations (zero empty/# links in the homepage probe), and all four representative destination routes loaded successfully. |
support-core-task-successclear-system-state-and-recovery | pass | high | Carousel controls expose current/disabled state, FAQs disclose state through buttons, and the security route provides recovery/protection guidance. |
be-fast-and-stablegood-core-web-vitals | issues | high | Lighthouse measured performance 0.57, FCP 8.2 s and LCP 12.1 s (CLS 0.033, TBT 0 ms). A separate unthrottled trace measured 546 ms LCP, showing the risk is network/device-sensitive rather than main-thread blocking. F04 high: Cold mobile loading is far outside the recommended LCP range. |
be-fast-and-stablevisual-stability | pass | high | All five post-load layout observations recorded CLS 0; Lighthouse’s independent mobile run recorded CLS 0.033. |
be-fast-and-stableefficient-main-thread | pass | high | Trace recorded zero long tasks and 0 ms TBT; Lighthouse also measured 0 ms TBT under mobile throttling. |
be-fast-and-stableefficient-resource-delivery | issues | high | HAR records 94 requests and 1,136,155 transferred bytes: 44 scripts (713,120 bytes), 19 stylesheets and multiple VeryHigh-priority parser-inserted stylesheets. F05 medium: The entry page loads a large, fragmented critical network surface. |
be-fast-and-stabletrim-unused-and-duplicate-code | issues | high | Lighthouse estimates 231 KiB unused JavaScript and 30 KiB unused CSS; the component bundle is 53% unused and GTM is 64% unused. F06 medium: A substantial share of shipped JavaScript and CSS is unused on the homepage. |
be-inclusivenames-roles-labels | issues | high | Lighthouse accessibility found label-content-name-mismatch on the regional banner and carousel controls, including visible “Send” with aria-label “Go to page 1 of 4”. F07 medium: Several visible control labels do not match their accessible names. |
be-inclusivesufficient-contrast | pass | high | Lighthouse found no colour-contrast violation and the prefers-contrast screenshot preserved readable foreground/background separation. |
be-inclusivestructure-and-focus | issues | high | The rendered page exposes two h1 elements for one phrase, then the cookie banner jumps from page h3 content to h4; Lighthouse flags heading-order. The evaluate probe found only a nav landmark and no main landmark. F08 medium: Heading and landmark structure is inconsistent on the homepage. |
be-inclusivelegible-text | pass | high | Headlines and body copy remain legible with responsive clamp-based typography and no clipped text in the sampled mobile screenshots. |
be-inclusivezoom-reflow-targets-and-media | issues | high | The evaluate probe measured visible carousel indicator buttons as small as 8×8 CSS pixels, below a robust touch target, although all tested pages reflowed without horizontal overflow at 360 px. F09 medium: Some carousel pagination controls expose very small hit areas. |
follow-best-practicesno-console-errors | pass | high | The Lighthouse errors-in-console audit passed with an empty item list. |
follow-best-practicessound-document-and-assets | pass | high | The page has HTML doctype, UTF-8, en-GB language, viewport metadata and correct image aspect ratios; representative routes loaded with HTTP 200. |
follow-best-practicesbrowser-platform-hygiene | pass | high | The site uses semantic links/buttons, responsive images, font-display swap and modern CSS; no deprecated document primitive failure was observed. |
be-discoverabletitle-and-description | pass | high | All sampled routes expose descriptive titles; home and BNPL include descriptive meta text, and crawler evidence retains title/description without JavaScript. |
be-discoverablecrawlable-and-mobile-friendly | issues | high | Discoverability evidence reports 56% rendered-word coverage in raw HTML and no h1 in raw HTML, while the rendered page has two h1 elements. Detail routes retain 67–74% and their h1. F10 medium: The homepage loses significant primary content when JavaScript is unavailable. |
be-discoverablecanonical-and-indexing-signals | pass | high | Homepage canonical resolves to /uk/home; Lighthouse reports valid canonical, valid robots.txt and no indexing block. |
be-discoverablestructured-and-shareable-metadata | pass | high | Homepage exposes four JSON-LD blocks and BNPL exposes five; route titles/descriptions are product-specific and suitable for sharing. |
be-private-and-securesecure-transport-and-headers | issues | high | Headers evidence shows HSTS preload and nosniff, but CSP allows unsafe-inline for scripts/defaults and no Referrer-Policy header is present. CSP frame-ancestors mitigates the absent X-Frame-Options header. F11 high: Strong transport headers are weakened by permissive script policy and missing referrer policy. |
be-private-and-securedata-minimisation-and-third-parties | issues | high | HAR attributes 84 of 94 requests and 1,032,165 of 1,136,155 bytes to third-party origins; tracker evidence finds GTM plus repeated Datadog and PayPal telemetry requests. F12 medium: Most homepage traffic is third-party or cross-origin telemetry and shared infrastructure. |
be-private-and-securein-context-permissions-and-modern-auth | pass | high | No permission prompt was triggered on public routes; login/signup are explicit same-origin actions and no password form is embedded in marketing content. |
be-private-and-securedefensive-browser-policies | issues | high | Cookie evidence found all 10 cookies flagged: nine SameSite=None and the first-party _dd_s telemetry cookie without Secure. Authentication-like cookies were HttpOnly and no sensitive client secret was found. F13 medium: Cookie policy is broader than needed and one telemetry cookie is not Secure. |
be-resilientprogressive-enhancement | pass | high | All four crawler-tested pages return substantive server HTML rather than empty app shells; detail pages preserve h1 and 67–74% content coverage. |
be-resilientresilient-runtime-behaviour | issues | high | Lighthouse reports three bfcache failure reasons, led by Cache-Control: no-store on the main resource and no-store responses requested by JavaScript. F14 medium: The homepage cannot use the back/forward cache. |
be-resilientoffline-and-installable | not-applicable | high | These public marketing and regulated financial-product pages do not present an installable/offline experience as a core user promise; authenticated wallet-app resilience was outside this unauthenticated scope. |
be-resilientnetwork-and-http-failure-states | pass | high | Representative routes returned 200 with no HAR HTTP errors; public pages include stable server-rendered content and explicit navigation destinations. |
be-internationalisedlang-dir-and-logical-properties | pass | high | Documents declare en-GB/ltr, CSS uses margin-inline, padding-inline and inset-inline, and includes RTL-specific rules. |
be-internationalisedlocale-aware-data | pass | high | UK routes use en-GB copy, UK product/legal terminology and pound-denominated financial context rather than a mismatched locale. |
be-internationalisedtime-zone-correctness | not-applicable | high | No time-zone-sensitive date/time scheduling or display appeared on the representative public routes. |
be-trustworthyno-dark-patterns | pass | high | Cookie controls offer Accept and Decline side by side; BNPL copy identifies the product as a loan and links detail/eligibility information without a preselected purchase action. |
be-trustworthyhumane-error-handling | pass | high | Public routes avoid blame-oriented errors and direct users to security/protection and FAQ material; no broken-route or HTTP error surfaced. |
be-trustworthytrustworthy-input-assistance | pass | high | No data-entry form is presented on the representative marketing routes, so users are not exposed to misleading validation or unsupported autofill; task entry uses explicit links. |
be-trustworthysafe-commercial-and-account-flows | pass | high | BNPL terms identify Pay in 3 as an interest-free loan and expose eligibility/credit-score FAQs; account actions are explicit and route to PayPal authentication. |
be-sustainableoptimised-assets | issues | high | Image probes found the homepage hero JPEG oversized at 780 natural vs 351 displayed pixels with no width/height attributes; the debit-card JPEG also lacks dimensions and is not lazy despite being below the fold. F15 medium: Prominent imagery lacks intrinsic dimensions and modern negotiated formats. |
be-sustainableno-wasteful-work | pass | high | No long main-thread tasks or persistent reduced-motion animations were observed, and repeated scrolling changed heap self-size by only 10,448 bytes. |
be-sustainablethird-party-and-media-budget | issues | high | Third-party resources account for about 91% of transferred bytes, including 114,607 bytes for GTM and repeated background RUM calls; total load is 1.14 MB for a marketing entry page. F16 medium: The page has no effective third-party byte/request budget. |
be-agent-readystructured-agent-capabilities | not-applicable | high | The unauthenticated marketing site exposes content and navigation, not a declared agent-operated task surface; authenticated account/payment actions were outside scope. |
be-agent-readyon-device-inference | not-applicable | high | No AI inference feature is offered on the representative routes, so on-device inference is not applicable. |
be-memory-efficientno-leak-under-repeated-interaction | pass | high | Heap self-size changed from 30,684,019 to 30,694,467 bytes (+0.034%) after ten end-to-end scroll cycles, with no unbounded constructor growth. |
be-memory-efficientbounded-footprint | pass | high | Heap self-size is about 30.7 MB and remained stable after exercise; no single unexpected application constructor dominates the summary. |
be-memory-efficientno-detached-dom-or-unbounded-listeners | pass | high | Heap summaries show no Detached* constructor among top retained constructors; closures rose only 146 and total self-size stayed effectively flat after repetition. |
Provenance
Canonical report: results/atomic/reports/0945-www_paypal_com.json
Report SHA-256: 091bed6bded7cbc80250e1bd25dcc9639eda2c5cd925d02a3c3872c6c694677c
Local retained report: runs/2026-07-17T17-27-24-856Z/atomic-reports/www_paypal_com/2026-07-24T01-20-51-965Z/report.json
Local evidence root: runs/2026-07-17T17-27-24-856Z/atomic-reports/www_paypal_com/2026-07-24T01-20-51-965Z
Catalog SHA-256: sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7
Raw screenshots, HARs, traces, heaps, and other browser artifacts are retained at the local evidence root and intentionally are not committed. Artifact paths in the canonical report are relative to that root.