Coverage reasons

A results file records whether each engine covered each target completely, partly or not at all, and gives at least one reason when it did not cover it completely. Each reason is a code, which this page lists with what it means, and a detail, whose content depends on the code. A summary cora prints, such as cora scan’s list of the targets it did not scan, gives each code in words, which this page lists under In summaries, with the detail after them in parentheses; the Markdown summary cora writes gives the words, then the code and the detail. Baselines and the gate says how the gate counts a target that was not scanned.

Codes are an open set: a results file written by a newer release of cora may hold a code this page does not list, and cora shows a code it does not know as it is.

navigation-failed

The target’s page did not load, so cora scanned nothing there and every engine’s coverage of it is skipped. The browser could not load it, such as when the server could not be reached; it answered with an HTTP status of 400 or more; or it kept navigating while cora waited for it to settle or scanned it, as a redirect loop or a page that reloads itself does.

Detail: HTTP <status> for an HTTP status of 400 or more, such as HTTP 404; The page kept navigating while it was scanned for a page that kept navigating; and otherwise the first line of the browser’s error, such as one naming net::ERR_CONNECTION_REFUSED, with credentials in URLs redacted.

In summaries: the page did not load

redirected

The target’s page settled on another page than the one requested, such as a sign-in page after a session expired, so cora did not scan the target as itself and every engine’s coverage of it is skipped. A change of scheme alone, such as http to https on one host, is not a redirect. cora scans a landing page on the requested host as a target of its own, as Redirects and failures describes, and the gate counts the target as scanned when the run scanned the page it landed on.

Detail: The URL the page landed on, with its credentials redacted as results files store URLs.

In summaries: the page redirected to another page

page-unresponsive

The page stopped answering while cora waited for it to settle, such as behind an open JavaScript dialog like an alert() or a script that never yields, so cora scanned nothing there and every engine’s coverage of it is skipped.

Detail: The first line of cora’s error, such as The page stopped answering while cora waited for it to settle.

In summaries: the page stopped answering

unsupported-page

The page is not one cora can scan, so cora scanned nothing there and every engine’s coverage of it is skipped: it reported a viewport of no size, or answered a script cora runs in it in a shape cora does not expect, such as when the page replaced a built-in the script calls.

Detail: The first line of cora’s error, which names what cora could not use, such as The page's answer when cora read its viewport is invalid:, with credentials in URLs redacted.

In summaries: the page could not be scanned

combination-mismatch

The page reported a viewport other than the one cora planned the target at, so cora scanned nothing there and every engine’s coverage of it is skipped. A target records exactly the browser and viewport it was planned in, which the page must show.

Detail: What the page reported, then what was planned, such as Observed at 800 by 600, planned at 1280 by 720.

In summaries: the page showed another viewport than the one planned

timed-out

Loading, waiting for or scanning the target did not finish in the time cora allows it, the config’s page.timeout or, for cora-mcp’s scans, mcp.callTimeout when that comes first, so cora recorded the target as not scanned and every engine’s coverage of it is skipped. cora scan visits the target again first when the config’s page.retries allows.

Detail: The setting whose time ran out, with its value, and the step that was running, as a sentence such as page.timeout (60000 ms) passed while running the axe engine.

In summaries: the scan ran out of time

not-ready

The page never became ready by the config’s page.waitFor, so cora scanned nothing there and every engine’s coverage of it is skipped: the readiness function threw, or the readiness selector is not valid CSS. A page the wait outlasts is timed-out instead.

Detail: The first line of the function’s error, with credentials in URLs redacted, or a sentence naming the selector, such as The readiness selector "main >" is not valid CSS.

In summaries: the page never became ready

disallowed-by-robots

A crawl did not follow its link to the page, because the site’s robots.txt disallows the page for CORA, whose product token is VisperoCORA, or for every crawler where no group names CORA, as RFC 9309 sets out. So cora scanned nothing there, every engine’s coverage of it is skipped, and the gate counts it as not scanned. A robots.txt that answered with a server error or HTTP 429, or could not be fetched, disallows every page on its origin. A crawl reads no robots.txt on the origin of the config’s baseUrl, and none at all with its ignoreRobotsTxt on, which cora scan --crawl-ignore-robots-txt turns on for the crawls on its command line. A page a target names, a crawl’s start page and a page a redirect lands on are scanned whatever robots.txt says, but in a sharded run a landing page it disallows that another shard owns is scanned by neither shard, and the run is incomplete.

Detail: The rule that disallows the page and its line, such as Disallow: /admin/ on line 7 of https://example.com/robots.txt; for a robots.txt that disallows every page, why, such as https://example.com/robots.txt answered HTTP 503, or https://example.com/robots.txt could not be fetched: and the first line of the browser’s error; or, for a fetch that ran out of time, the setting and the step, such as page.timeout (60000 ms) passed while fetching https://example.com/robots.txt.

In summaries: the site’s robots.txt disallows the page, and the crawl’s ignoreRobotsTxt is off

input-unavailable

An engine needs something from the browser, an input, that cora could not give it on the target, so the engine did not run there and its coverage is skipped. The other engines still run.

Detail: What cora could not give the engine, such as the live page, with one reason for each missing input.

In summaries: an engine could not get what it needs from the browser

engine-error

An engine failed on the target, such as when the page crashed or answered the engine’s script in a shape it does not expect, or it reported its coverage inconsistently, so that engine’s coverage of the target is skipped. The other engines still run.

Detail: The first line of the engine’s error, with credentials in URLs redacted, or, for inconsistent coverage, a sentence naming the engine and what it reported, such as The engine axe reported partial coverage without a reason.

In summaries: an engine failed

scoped

The scan was limited to part of the page by include or exclude selectors, which cora-mcp’s scan tools take, so the engine’s coverage of the target is partial. The elements the config’s page.exclude leaves out are recorded under excluded-by-config instead.

Detail: include followed by the included selectors, then exclude followed by the excluded ones, separated by a semicolon when there are both, such as include main, #side; exclude .ad.

In summaries: the scan was limited to part of the page

excluded-by-config

The config’s page.exclude left elements of the page out, such as a third-party widget the project does not own, so no rule evaluated them or what they hold, and the engine’s coverage of the target is partial. The rest of the page was scanned, and the baseline still counts the page as scanned completely.

Detail: The config’s selectors that matched an element on the page, in the config’s order, separated by commas, such as #chat-widget, iframe.video-embed.

In summaries: the config left elements of the page out

frame-not-scanned

The engine scanned the page but not one of its iframes, such as one it could not reach or whose scan failed, so its coverage of the target is partial. Each iframe it could not scan has a reason of its own; the frames inside one are not scanned either and have none.

Detail: The iframe’s URL, with credentials redacted and a data: URL cut to its scheme and media type, then (name="…") with the iframe’s name when it has one. Both are cut short when they are long.

In summaries: an iframe was not scanned

parse-error

An engine that checks source files rather than pages could not check a file, such as one it could not parse, so that file’s coverage is skipped.

Detail: The engine’s message about the file, such as Parsing error: Unexpected token (12:3).

In summaries: an engine could not check the source