Azreen Jamal
18 KiB
18 KiB
Audit Report: give.charityright.org.uk
Date: 9 March 2026
Auditor: Claude Code (automated Playwright audit)
Viewport tested: 1440×900 (desktop), 375×812 (mobile)
Entry URL: https://give.charityright.org.uk → auto-redirects to /sadaqah
Overview
give.charityright.org.uk is the donation micro-site for Charity Right (UK Charity #1155108). It is a single-page, campaign-focused donation portal currently showing a Sadaqah fundraising page. The site allows visitors to:
- Select a donation amount (slider + quick-pick buttons, £3–£15 default range)
- Optionally add UK Gift Aid (with house number + postcode collection)
- Complete payment via Stripe (card + Google Pay)
- Share the campaign
Tech stack clues:
- Custom server-side rendered (SSR) app — no Vue/React/Next fingerprint detected at root
- Stripe.js v3 for payments
- Cloudflare (CDN, challenge platform, Turnstile/hCaptcha)
- Google Tag Manager (GTM-PX5XJXX)
- TikTok Pixel, Facebook Pixel, Google Analytics (multiple GA4 properties), Hotjar 3395285
- CookieHub for consent management
- WAHA (WhatsApp HTTP API) running at
waha.charityright.org.uk— separate service, credentials leaked in console (see Security)
Phase 1 — Homepage Audit
Redirect behaviour
/→/sadaqah(permanent or temporary redirect — not a true homepage, no navigation)
Page title
- ✅
Give Sadaqah — Charity Right— clear, descriptive
Meta tags
| Tag | Value | Issue |
|---|---|---|
<meta name="description"> |
MISSING | ❌ No standard description tag |
<meta property="og:title"> |
Give Sadaqah — Charity Right |
✅ |
<meta property="og:description"> |
50p feeds a child. Give Sadaqah in 30 seconds. |
✅ |
<meta property="og:image"> |
https://www.charityright.org.uk/wp-content/uploads/2026/02/cr-wrong-1.jpg |
⚠️ Cross-domain OG image (WordPress) |
<meta name="robots"> |
MISSING | ⚠️ No robots directives |
<meta name="viewport"> |
width=device-width,initial-scale=1,maximum-scale=1,user-scalable=no,viewport-fit=cover |
⚠️ user-scalable=no disables pinch-zoom — accessibility violation (WCAG 1.4.4) |
Console errors on load
- ✅ 0 JS errors on sadaqah page itself
- 1 WARNING: Hotjar refuses to load (detects headless browser user-agent) — benign in production
Cookie consent
- ✅ CookieHub banner shown on first visit (
dialog "About cookies on this site") - ✅ Three options: "Allow all cookies", "Deny all", "Cookie settings"
- ⚠️ "Cookie settings" link uses
href="#"(dead anchor) — should behrefto settings panel or usebuttonsemantics
Phase 2 — Navigation & Links
The site has no navigation bar or header menu. It is a single campaign page only. There are no internal links to other sections of the give site.
External link found:
https://www.charityright.org.uk/donate/— links to main website (different domain)
Routes tested:
| Path | Result |
|---|---|
/sadaqah |
✅ 200 — Sadaqah donation page |
/zakat |
❌ 404 — "Not Found" blank page |
/fidya |
❌ 404 — "Not Found" blank page |
/qurban |
❌ 404 — "Not Found" blank page |
/kaffarah |
❌ 404 — "Not Found" blank page |
/login |
❌ 404 — "Not Found" blank page |
/register |
❌ 404 — "Not Found" blank page |
/campaigns |
❌ 404 — "Not Found" blank page |
/donate |
❌ 404 — "Not Found" blank page |
/appeal |
❌ 404 — "Not Found" blank page |
Key issue: The 404 page returns no <title> tag and no styled error page — just the raw text "Not Found". There is no redirect to a helpful error page and no way back to a valid URL.
Phase 3 — Donation Flow
Flow architecture
The site uses an inline slide-up payment panel (overlay div#overlay) rather than a separate checkout page. This is a smooth UX pattern.
Step 1: Amount selection
- Slider control: 6 (£6 default, feeds 12 children @ 50p/meal)
- Quick-pick buttons: £3, £6, £9, £12, £15
- ✅ Real-time meal counter updates
- ✅ Clear impact messaging ("Feeds 12 children")
Step 2: Gift Aid
- ✅ Gift Aid toggle button (pre-selected/enabled by default)
- ✅ Calculates HMRC top-up (£6 → £7.50 total)
- House number + postcode fields appear when Gift Aid active
- ⚠️ No validation visible if Gift Aid address fields are left empty when proceeding
- ⚠️ Gift Aid declaration text is small/light — readability concern
Step 3: "Give £6 Sadaqah" button
- Clicking opens a side/bottom panel (
div#overlay.open) - The overlay blocks interaction with the main page while open (correct modal behaviour)
Step 4: Checkout panel ("Complete your Sadaqah")
Fields present:
| Field | Type | Placeholder | Label visible |
|---|---|---|---|
| Full name | textbox |
"As it appears on your card" | ✅ "Full name" |
textbox |
"For your donation receipt" | ✅ "Email" | |
| Card number | Stripe iframe | "Card number" | ✅ "Number" |
| Expiry | Stripe iframe | "MM / YY" | ✅ |
| CVC | Stripe iframe | "CVC" | ✅ |
- "Donate £6" button is
disabledby default — only enabled when Stripe iframe reports complete card details - ✅ Correct — prevents empty form submission
- ⚠️ Clicking "Give £6 Sadaqah" without filling name/email still opens the overlay — those fields have no pre-validation before opening the panel
- ✅ No
<form>element (0 forms found) — form data handled entirely via JS/Stripe Elements - ✅ Google Pay option available in Stripe Elements
- ✅ Trust signals: "🔒 Encrypted · Powered by Stripe" and "256-bit secure · No account needed · UK Charity 1155108"
Empty form submission
- Donate button stays disabled until Stripe card fields are valid — no empty submit possible via UI
- No visible validation errors for empty name/email fields — they appear to be validated client-side by Stripe before enabling the button (TBC)
Donation amount £1 test
- Minimum selectable via slider unclear (minimum appears to be £3 via preset buttons)
- Manual slider minimum not tested — slider defaults to £6
Phase 4 — Mobile Responsiveness (375×812)
Layout
- ✅ Page renders correctly at 375×812
- ✅ Same UI elements visible — no hidden/broken sections
- ✅ Campaign image scales correctly
- ✅ Quick-pick amount buttons visible and tappable
- ✅ Gift Aid toggle renders correctly
- ✅ Checkout panel (overlay) renders at mobile size
- ⚠️
user-scalable=noin viewport meta means users cannot zoom on mobile — this is an accessibility violation for low-vision users - ⚠️ No hamburger menu (site is single-page, so this is acceptable, but there's no navigation at all)
- ✅ No horizontal scroll detected at 375px width
Phase 5 — Performance & Accessibility
Accessibility
| Check | Result | Issue |
|---|---|---|
Images missing alt |
0 | ✅ |
Dead anchors href="#" |
1 | ⚠️ Cookie settings button uses href="#" |
| Unlabelled inputs | 1 | ⚠️ One input has no aria-label or placeholder |
user-scalable=no in viewport |
YES | ❌ WCAG 1.4.4 violation |
Inline onclick handlers |
3 | ⚠️ 3 elements use inline event handlers |
No <nav> landmark |
Confirmed | ⚠️ No navigation landmark (single-page is valid but no skip-to-content) |
No <meta name="description"> |
Confirmed | ❌ SEO/accessibility issue |
Performance
- Page load time: 2,433ms (performance.timing) — acceptable
- External scripts loaded: 9 external
<script src>tags
External scripts inventory:
analytics.tiktok.com— TikTok Pixel (×3 scripts)connect.facebook.net— Facebook Pixel (×2 scripts, including large config JS)static.hotjar.com— Hotjar session recordingwww.googletagmanager.com— GTM (×1) + GA4 gtag (×4 separate GA properties!)cdn.cookiehub.eu— CookieHub consentjs.stripe.com/v3/— Stripe.jsgoogleads.g.doubleclick.net— Google Ads conversion tracking (×2)
⚠️ Performance concern: 4 separate Google Analytics 4 properties (G-1B4QR9YTTB, G-6RGJ9BTW2Q, G-4DB6TJNHZR, AW-876060108, AW-925998688) + GTM + TikTok + Facebook + Hotjar = significant tracking script bloat. Each fires multiple analytics events per page load.
Network errors (analytics): Multiple net::ERR_ABORTED for analytics.google.com POSTs on page navigation — these appear to be in-flight beacons aborted during navigation (non-critical but noisy).
Phase 6 — Key Pages
| Page | Status | Notes |
|---|---|---|
/sadaqah |
✅ 200 | Main and only working page |
/zakat |
❌ 404 | Common Islamic giving category — missing |
/fidya |
❌ 404 | Ramadan-specific — missing |
/qurban |
❌ 404 | Eid-related — missing |
/kaffarah |
❌ 404 | Missing |
/login |
❌ 404 | No user accounts on this domain |
/register |
❌ 404 | No user accounts on this domain |
/campaigns |
❌ 404 | Missing |
The site appears to only have the one /sadaqah route currently live. All other paths return bare 404 responses.
Phase 7 — Security
HTTPS
- ✅ Site is fully HTTPS (
https://give.charityright.org.uk) - ✅ Stripe iframe loads over HTTPS
- ✅ No mixed content detected
- ✅ Cloudflare CDN with challenge platform (
cdn-cgi/challenge-platform)
Forms
- ✅ No
<form>elements found — payment handled entirely via Stripe.js (no raw card data hits the server) - ✅ Stripe tokenisation means card details never touch CharityRight servers
Cookies
| Cookie | Domain | Secure? | HttpOnly? | Concern |
|---|---|---|---|---|
cf_clearance |
.charityright.org.uk |
✅ (HTTPS-only session) | N/A | Cloudflare bot protection |
__stripe_mid, __stripe_sid |
.give.charityright.org.uk |
✅ | Unknown | Stripe session — should be HttpOnly |
cookiehub |
.charityright.org.uk |
✅ | N/A | Consent preferences |
_ga, _ga_* |
.charityright.org.uk |
✅ | N/A | Google Analytics |
_fbp |
.charityright.org.uk |
✅ | N/A | Facebook Pixel |
_ttp |
.charityright.org.uk + .tiktok.com |
✅ | N/A | TikTok tracking |
IDE |
.doubleclick.net |
✅ | N/A | Google Ads |
⚠️ __stripe_mid and __stripe_sid are visible in document.cookie — meaning they are not HttpOnly. Stripe session cookies should ideally be HttpOnly to prevent XSS token theft (though Stripe sets these itself — CharityRight cannot control this).
🚨 CRITICAL: Credentials in Browser Console
From previous browsing session logs captured in the test environment:
[ERROR] SecurityError: Failed to execute 'replaceState' on 'History':
A history state object with URL
'https://waha.charityright.org.uk/dashboard/' cannot be created in a document
with origin 'https://waha.charityright.org.uk' and URL
'https://admin:J59vAcWI56BReJEFCi@waha.charityright.org.uk/dashboard/'.
This is a CRITICAL security issue. The URL https://admin:J59vAcWI56BReJEFCi@waha.charityright.org.uk/dashboard/ contains basic authentication credentials in plaintext (admin:J59vAcWI56BReJEFCi). These were captured in the browser's console log, meaning:
- Anyone with DevTools access to
waha.charityright.org.ukcould see these credentials - The credentials are for the WAHA (WhatsApp HTTP API) admin dashboard
- WAHA controls WhatsApp messaging for the organisation — a breach here could expose donor communications
Immediate action required: Change the WAHA admin password and remove credentials from any hardcoded URLs. Use proper session-based auth instead.
Hub API 401 Errors
Multiple failed requests to hub.quikcue.com/api/user/* (401 Unauthorized):
GET https://hub.quikcue.com/api/user/lifecycle → 401
GET https://hub.quikcue.com/api/user/admin → 401
GET https://hub.quikcue.com/api/user/init → 401
The give.charityright.org.uk site is calling QuikCue's hub API on every page load and receiving 401s. These appear to be unauthenticated calls. This could indicate a misconfigured integration or leftover code from a shared codebase.
Development URL in Production
From console errors: http://localhost:3000/api/pledges → 400 Bad Request
A hardcoded localhost:3000 URL is being called from production. This is a development/staging configuration leak.
Console Errors Summary
| Error | Source | Severity |
|---|---|---|
localhost:3000/api/pledges returning 400 |
Sadaqah page JS | 🔴 High — dev URL in prod |
hub.quikcue.com/api/user/* returning 401 (×8+ times) |
Page load | 🟠 Medium — unnecessary failed requests |
waha.charityright.org.uk credentials in URL |
WAHA dashboard JS | 🔴 Critical — credential leak |
waha.charityright.org.uk/api/* returning 401 |
WAHA dashboard | 🟡 Low — expected if not logged in |
give.charityright.org.uk/favicon.ico returning 404 |
Browser | 🟡 Low — missing favicon |
analytics.google.com ERR_ABORTED (×6) |
Navigation beacons | 🟢 Info — benign race condition |
Summary Table
| # | Issue | Location | Severity | Category |
|---|---|---|---|---|
| 1 | Credentials in URL: admin:J59vAcWI56BReJEFCi in WAHA console error |
waha.charityright.org.uk |
🔴 Critical | Security |
| 2 | localhost:3000/api/pledges called from production |
/sadaqah JS |
🔴 Critical | Config / Security |
| 3 | All routes 404 except /sadaqah — no error page, no redirect |
/zakat, /fidya, etc. |
🟠 High | Navigation |
| 4 | 404 page has no title, no styling, no back link | All 404 responses | 🟠 High | UX |
| 5 | hub.quikcue.com API called 8+ times with 401 on every page load |
/sadaqah |
🟠 High | Performance / Config |
| 6 | Missing <meta name="description"> |
All pages | 🟠 High | SEO |
| 7 | user-scalable=no in viewport meta — disables pinch zoom |
All pages | 🟠 High | Accessibility (WCAG 1.4.4) |
| 8 | 4 separate GA4 properties + 2 Google Ads + TikTok + Facebook + Hotjar | All pages | 🟡 Medium | Performance / Privacy |
| 9 | No Gift Aid address validation before proceeding to checkout | /sadaqah |
🟡 Medium | UX / Data quality |
| 10 | Name/email not validated before overlay opens | /sadaqah checkout |
🟡 Medium | UX |
| 11 | OG image served from WordPress domain (charityright.org.uk/wp-content/) |
/sadaqah |
🟡 Medium | Reliability / Performance |
| 12 | No <meta name="robots"> directive |
All pages | 🟡 Medium | SEO |
| 13 | href="#" on cookie settings anchor |
Cookie banner | 🟡 Medium | Accessibility |
| 14 | 1 unlabelled input (no aria-label, no placeholder) | /sadaqah |
🟡 Medium | Accessibility |
| 15 | 3 inline onclick handlers |
/sadaqah |
🟡 Medium | Code quality |
| 16 | Hotjar not loading (detects headless/bot UA) | All pages | 🟡 Medium | Analytics |
| 17 | Missing favicon (404 on /favicon.ico) |
All pages | 🟢 Low | Branding |
| 18 | No skip-to-content link | All pages | 🟢 Low | Accessibility |
| 19 | No <nav> landmark |
All pages | 🟢 Low | Accessibility |
| 20 | Stripe session cookies not HttpOnly | /sadaqah |
🟢 Low | Security (Stripe-controlled) |
Recommendations (Priority Order)
🔴 Immediate (Critical)
- Rotate WAHA admin credentials —
admin:J59vAcWI56BReJEFCiis exposed in browser console. Change password immediately. Audit who accessed WAHA. - Remove
localhost:3000URL from production build — likely a.envmisconfiguration. The/api/pledgescall should point to the production API endpoint.
🟠 High Priority
- Add styled 404 page with charity branding, navigation back to
/sadaqah, and proper<title>. - Fix
hub.quikcue.comAPI calls — either authenticate them properly or remove them from the give site (wrong codebase/integration). - Add
<meta name="description">— currently onlyog:descriptionis set. - Remove
user-scalable=nofrom viewport meta — replace withuser-scalable=yesto comply with WCAG 1.4.4.
🟡 Medium Priority
- Audit tracking scripts — consolidate 4 GA4 properties if possible, remove duplicates. Each extra script adds load time and GDPR surface area.
- Validate Gift Aid fields before opening checkout overlay — show inline error if Gift Aid is enabled but address fields are empty.
- Validate name/email before showing checkout overlay — currently you can open the payment panel without entering name/email.
- Move OG image to
give.charityright.org.ukCDN — remove cross-domain WordPress dependency. - Replace
href="#"on Cookie Settings with proper button element orhref="javascript:void(0)". - Fix unlabelled input — audit the 1 input missing both
aria-labelandplaceholder.
🟢 Low Priority
- Add favicon to
give.charityright.org.uk. - Add
<meta name="robots" content="index,follow">explicitly. - Add skip-to-content link for keyboard/screen reader users.
Screenshots Captured
| File | Description |
|---|---|
screenshots/cr-homepage.png |
Full page — sadaqah donation page at 1440×900 |
screenshots/cr-donation-form.png |
Full page after clicking "Give £6 Sadaqah" |
screenshots/cr-form-filled.png |
Checkout overlay with name/email filled |
screenshots/cr-form-ready.png |
Checkout overlay with full card details entered, Donate button enabled |
screenshots/cr-overlay-open.png |
Overlay state after form interaction |
screenshots/cr-mobile.png |
Full page at 375×812 mobile viewport |
screenshots/cr-zakat.png |
404 page for /zakat |