Manifest position 979 · CrUX rank bucket 1000

https://www.roblox.com

Coverage complete

Coverage-complete public-surface audit. Authenticated home, account settings, purchase/checkout, creation tools, native game launch completion, and destructive account flows were not covered because no test credentials or purchase authorization were supplied.

Attempts

1 / 3

Judged checks

58 / 58

Blocked

Not run

This report has no published overall score. Blocked and not-run checks are not passes. A coverage-complete report means every check has a judged outcome; it does not mean every check passed.

All 58 atomic check outcomes

Principle / check	Status	Confidence	Evidence or reason
respect-user-preferences `respects-color-scheme`	pass	high	The dark-preference screenshot uses dark surfaces and computed color-scheme is “light dark”; CSS contains prefers-color-scheme rules.
respect-user-preferences `respects-reduced-motion`	pass	high	Under emulated reduce, matchMedia is true, no active animations remain, and captured CSS includes prefers-reduced-motion rules.
respect-user-preferences `respects-contrast`	pass	high	Lighthouse contrast audit passed and the prefers-contrast screenshot keeps text and controls legible against dark surfaces.
implement-natural-interactions `view-transitions`	issues	high	DOM and CSS captures across the home, charts, login, and game templates contain no view-transition-name, @view-transition, or View Transition API use. F01 low: Navigations do not preserve visual continuity.
implement-natural-interactions `scroll-driven-animations`	not-applicable	high	The audited templates do not present scrollytelling, parallax, or other scroll-linked animation to evaluate.
implement-natural-interactions `physical-gestures`	issues	high	The game DOM contains Back/Next carousel controls, while captured CSS has no scroll-snap or overscroll-behavior rules. F02 low: The media carousel exposes buttons but no native swipe or snap affordance.
provide-guided-navigation `scroll-state-aware-chrome`	pass	high	Screenshots show persistent global navigation across home, login, charts and detail templates without covering content.
provide-guided-navigation `anchored-positioning`	pass	high	Charts filter controls and carousel controls remain attached and within the viewport in desktop and 360px captures; no overlay drift was observed.
provide-guided-navigation `directs-attention`	pass	high	Clear headings, selected filters, See All links, and prominent login/signup actions establish the next step on each template.
maximize-content-reduce-noise `no-intrusive-interruptions`	issues	high	Desktop screenshots show the notice covering roughly the lower half of the signup, login, charts, and game surfaces; on 360px it occupies much of the first viewport. F03 medium: The cookie notice dominates and obscures the primary task on every public template.
maximize-content-reduce-noise `semantic-dismissible-primitives`	issues	high	Rendered DOM contains no <dialog>, role=dialog, or aria-modal element even though the cookie panel visually overlays and blocks underlying content. F04 medium: The blocking cookie notice is not exposed as a semantic dialog.
maximize-content-reduce-noise `reduced-chrome`	issues	high	Desktop screenshots show the notice covering roughly the lower half of the signup, login, charts, and game surfaces; on 360px it occupies much of the first viewport. F03 medium: The cookie notice dominates and obscures the primary task on every public template.
adapt-to-the-form-factor `responsive-no-horizontal-scroll`	pass	high	All four 360px layout captures report horizontalOverflowPx 0.
adapt-to-the-form-factor `component-level-responsiveness`	pass	high	The signup, navigation, charts and detail layouts reflow to 360px without horizontal overflow and with reordered controls.
adapt-to-the-form-factor `input-modality-aware`	pass	high	Focused login controls visibly change border color and the login button receives a 1px auto outline; mobile controls are at least about 36–44px high.
support-core-task-success `clear-purpose-and-primary-action`	pass	high	The first view clearly labels signup or login and charts/detail pages use explicit H1 headings and actions.
support-core-task-success `primary-flow-completion`	issues	high	The home DOM has signup inputs and a type=button submit control but no containing <form>; the no-JS crawler receives only 1% of rendered content. F05 high: Signup is not a native form and depends entirely on JavaScript.
support-core-task-success `clear-system-state-and-recovery`	pass	high	Login DOM includes a polite live region adjacent to password feedback and the site exposes explicit login, signup and navigation recovery paths.
be-fast-and-stable `good-core-web-vitals`	issues	high	Lighthouse measured FCP 5.3s, LCP 23.3s, TBT 310ms and performance 0.50; the independent trace measured LCP 11.43s. F06 high: The unauthenticated landing experience loads far too slowly.
be-fast-and-stable `visual-stability`	issues	high	The layout primitive observed CLS 0.327 on home, 0.321 on login, and 0.302 on the game detail page at 360px. F07 high: Late rendering causes severe layout movement on key templates.
be-fast-and-stable `efficient-main-thread`	issues	high	Lighthouse measured FCP 5.3s, LCP 23.3s, TBT 310ms and performance 0.50; the independent trace measured LCP 11.43s. F06 high: The unauthenticated landing experience loads far too slowly.
be-fast-and-stable `efficient-resource-delivery`	issues	high	HAR captured 211 requests and 4,761,272 transferred bytes, including 114 scripts (3,472,865 bytes) and 26 stylesheets; Lighthouse estimates 3,060ms render-blocking savings. F08 high: The landing page ships an excessive critical network graph.
be-fast-and-stable `trim-unused-and-duplicate-code`	issues	high	Lighthouse estimates 1,526 KiB unused JavaScript and 118 KiB unused CSS; AngularJsUtilities alone wastes about 466 KiB while React bundles are also loaded. F09 high: Most of the initial JavaScript and CSS is unused.
be-inclusive `names-roles-labels`	pass	high	Lighthouse accessibility scored 1.00; login fields have associated sr-only labels and navigation icon buttons have aria-labels.
be-inclusive `sufficient-contrast`	pass	high	Lighthouse color-contrast audit passed and visual captures show strong text/control contrast.
be-inclusive `structure-and-focus`	pass	high	Lighthouse accessibility and heading checks passed; DOM includes H1s, a Skip to Main Content control, and focused controls show a border/outline change.
be-inclusive `legible-text`	pass	high	Desktop, mobile and Arabic screenshots show readable text sizes, line lengths and spacing without clipping.
be-inclusive `zoom-reflow-targets-and-media`	pass	high	Viewport metadata is present and all tested 360px layouts reflow without horizontal overflow; no timed media requiring captions is present.
follow-best-practices `no-console-errors`	issues	high	Lighthouse captured a realtime CORS failure, ERR_FAILED, and a 401 from rotating-client-service during a clean load. F10 medium: The landing page logs runtime and network errors.
follow-best-practices `sound-document-and-assets`	pass	high	Lighthouse confirms a valid doctype and image aspect ratios; DOM captures include viewport metadata and structured headings.
follow-best-practices `browser-platform-hygiene`	issues	high	Lighthouse reports an unload event listener in Sentry.js and two bfcache failure reasons, including UnloadHandlerExistsInMainFrame. F11 medium: Deprecated unload handling blocks the back/forward cache.
be-discoverable `title-and-description`	pass	high	Home, login, charts and game detail all expose route-specific titles or a clear brand title and meta descriptions in raw HTML.
be-discoverable `crawlable-and-mobile-friendly`	issues	high	Discoverability captures found only 1% raw-content coverage on home and 2% on Charts; Charts renders only a navigation shell and “Please enable Javascript” without JS. F12 high: Important public listing content is invisible to non-JavaScript crawlers.
be-discoverable `canonical-and-indexing-signals`	pass	high	Home has canonical and hreflang links; robots.txt is valid and declares localized and games sitemaps; audited responses returned 200.
be-discoverable `structured-and-shareable-metadata`	pass	high	Home includes Organization JSON-LD plus Open Graph/Twitter metadata, while the game route preserves title, H1 and description in raw HTML.
be-private-and-secure `secure-transport-and-headers`	issues	high	Cookie audit found 5 insecure cookies, including GuestData and RBXEventTrackerV2 without Secure and with 400-day lifetimes; the page is HTTPS. F13 high: Several first-party cookies are sent without Secure and use SameSite=None.
be-private-and-secure `data-minimisation-and-third-parties`	issues	high	Tracker evidence observed 16 non-main origins, PerimeterX endpoints, Sentry, metrics and heartbeat requests; HAR attributes 203 requests and 4.74MB to origins classified outside www.roblox.com, mostly Roblox CDNs plus external services. F15 medium: The guest landing page has a broad third-party and telemetry footprint.
be-private-and-secure `in-context-permissions-and-modern-auth`	pass	high	No permission prompt fired on load; login metadata and autocomplete include WebAuthn/passkey support and the secrets scan found no exposed sensitive credentials.
be-private-and-secure `defensive-browser-policies`	issues	high	Headers evidence found CSP with unsafe-inline, no X-Content-Type-Options, no Referrer-Policy, and no Permissions-Policy. F14 high: Browser security policy coverage is incomplete and CSP permits inline script.
be-resilient `progressive-enhancement`	issues	high	No-JS captures show home and Charts as near-empty shells (1% and 2% raw coverage); signup has no native form submission path. F16 high: Core public and signup content has no useful JavaScript-free baseline.
be-resilient `resilient-runtime-behaviour`	pass	high	Repeated route captures rendered stable navigation and controls; charts and detail templates remained usable after asynchronous content loading.
be-resilient `offline-and-installable`	not-applicable	high	Roblox is a networked game platform whose audited public web entry routes are not intended as an offline or installable PWA.
be-resilient `network-and-http-failure-states`	pass	high	Login form includes an aria-live feedback region and public routes preserve navigation and alternate account paths when a task cannot proceed.
be-internationalised `lang-dir-and-logical-properties`	pass	high	English pages use lang=en; /ar uses lang=ar and the 360px Arabic screenshot correctly mirrors and aligns the interface RTL.
be-internationalised `locale-aware-data`	pass	high	The site publishes 17 localized alternates and the Arabic route localizes labels, placeholders and consent copy rather than merely translating isolated text.
be-internationalised `time-zone-correctness`	not-applicable	high	No event scheduling, local-time promise, or user-visible time-zone-sensitive data appears on the audited public templates.
be-trustworthy `no-dark-patterns`	pass	high	Cookie Decline All and Accept All actions have comparable prominence, gender is explicitly optional, and no confirm-shaming copy was observed.
be-trustworthy `humane-error-handling`	pass	high	Login inputs have labels and a nearby aria-live=polite feedback region; signup guidance avoids real-name use and communicates password length before submission.
be-trustworthy `trustworthy-input-assistance`	issues	high	Login username correctly uses “username webauthn”, but password has no autocomplete=current-password; signup username uses the nonstandard token signup-username. F17 medium: Authentication autocomplete tokens are incomplete or invalid.
be-trustworthy `safe-commercial-and-account-flows`	pass	high	Login is a dedicated form with username WebAuthn autocomplete, alternate one-time-code/account recovery paths, and no hidden charge or forced purchase in audited flows.
be-sustainable `optimised-assets`	issues	high	Images audit found 9/9 without width and height, all 9 below-fold images not lazy-loaded, 8 without srcset, and two oversized store badges; Lighthouse separately estimated 206 KiB image savings. F18 medium: Several images lack sizing, lazy loading, and responsive delivery.
be-sustainable `no-wasteful-work`	issues	high	HAR and tracker evidence include pageHeartbeat and analytics requests during initial load while 114 scripts are fetched and LCP remains delayed. F19 medium: The guest page starts background telemetry and excessive work before the core task is usable.
be-sustainable `third-party-and-media-budget`	issues	high	The HAR records 4.76MB across 211 requests before signup, with 3.47MB of scripts and 0.79MB of images; Lighthouse total-byte-weight is only 0.50. F20 high: The initial guest page exceeds a proportionate resource budget.
be-agent-ready `structured-agent-capabilities`	not-applicable	high	The primary product task launches interactive 3D experiences in a native client; exposing autonomous WebMCP actions on the audited public routes is not an appropriate requirement.
be-agent-ready `on-device-inference`	not-applicable	high	The audited signup, login, charts and game-detail routes have no user task that requires on-device language-model or summarization capability.
be-memory-efficient `no-leak-under-repeated-interaction`	pass	high	After ten programmatic login submissions, heap self-size decreased from 58,962,813 to 57,566,365 bytes; no retained-growth signal appeared.
be-memory-efficient `bounded-footprint`	issues	high	Baseline heap summary contains 865,301 nodes, 3,604,843 edges, and 58,962,813 bytes self-size before a login attempt. F21 medium: The login route has a very large initial heap footprint.
be-memory-efficient `no-detached-dom-or-unbounded-listeners`	pass	high	Baseline/post heap constructor summaries showed no Detached* constructor among top retainers and total self-size fell after repeated interaction.

Provenance

Canonical report: results/atomic/reports/0979-www_roblox_com.json
Report SHA-256: bfea629750174bd745f10dc4e27fba2f3beb8ef2895054933a8e64eb366963c2
Local retained report: runs/2026-07-17T17-27-24-856Z/atomic-reports/www_roblox_com/2026-07-24T06-52-21-594Z/report.json
Local evidence root: runs/2026-07-17T17-27-24-856Z/atomic-reports/www_roblox_com/2026-07-24T06-52-21-594Z
Catalog SHA-256: sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7

Raw screenshots, HARs, traces, heaps, and other browser artifacts are retained at the local evidence root and intentionally are not committed. Artifact paths in the canonical report are relative to that root.