The latest articles on DEV Community by QA-lab URL Review (@qalaburlreview). https://dev.to/qalaburlreview https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4187607%2F8903d3e2-7e69-4cc6-a349-bc7b939d6158.png https://dev.to/qalaburlreview en QA-lab URL Review Sun, 18 Oct 2026 22:59:59 +0000 https://dev.to/qalaburlreview/20-kinds-of-test-cases-a-public-page-already-tells-you-about-1m8l https://dev.to/qalaburlreview/20-kinds-of-test-cases-a-public-page-already-tells-you-about-1m8l <p>Before anyone writes a single automated test, a public page has already told you a lot: what it answers over https, which links it exposes, whether its fields have labels, which headers it sends, how long the document takes to arrive.</p> <p>Most first test plans stop at "the happy path works". Here is the list I use instead when I read a page for the first time. Each kind has one example case, written the way I would hand it to a team.</p> <ul> <li> <strong>Functional</strong> (<code>FN-01</code>): The reviewed URL answers over https</li> <li> <strong>Content</strong> (<code>CT-01</code>): The meta description is present and short enough to read</li> <li> <strong>Links</strong> (<code>LK-01</code>): Same-host links discovered from the start page resolve</li> <li> <strong>Forms</strong> (<code>FM-01</code>): Visible fields have labels</li> <li> <strong>Accessibility</strong> (<code>A11Y-01</code>): Images expose a text alternative</li> <li> <strong>Security</strong> (<code>SEC-01</code>): HTTPS is the only way in</li> <li> <strong>Privacy</strong> (<code>PR-01</code>): A privacy notice is linked from the page</li> <li> <strong>SEO</strong> (<code>SEO-01</code>): Title, description, canonical, and social tags agree</li> <li> <strong>GEO</strong> (<code>GEO-01</code>): AI answer and search crawlers may read the site</li> <li> <strong>Performance</strong> (<code>PF-01</code>): The HTML document arrives inside a stated budget</li> <li> <strong>Load</strong> (<code>LD-01</code>): An authorised baseline could repeat the document fetch</li> <li> <strong>Mobile</strong> (<code>MB-01</code>): The layout holds at a phone width</li> <li> <strong>Internationalization</strong> (<code>I18N-01</code>): The lang attribute matches the copy a person reads</li> <li> <strong>Resilience</strong> (<code>RS-01</code>): A missing path returns a deliberate not-found page</li> <li> <strong>Compatibility</strong> (<code>CMP-01</code>): The page still explains itself when scripts do not run</li> <li> <strong>Media</strong> (<code>MED-01</code>): Video exposes captions or a transcript path</li> <li> <strong>Analytics</strong> (<code>AN-01</code>): Analytics tags wait for a recorded choice when the page asks for consent</li> <li> <strong>Commerce</strong> (<code>CM-01</code>): A catalog or payment marker is covered without placing an order</li> <li> <strong>Visual</strong> (<code>VIS-01</code>): Images reserve their box before they paint</li> <li> <strong>Platform</strong> (<code>PLAT-01</code>): The public Salesforce path stays available without an org login</li> <li> <strong>API</strong> (<code>API-01</code>): A public API description is listed without calling the API</li> </ul> <h2> How to use the list </h2> <ol> <li>Read the public response first: status, headers, the HTML that arrives before any script runs.</li> <li>Follow the same-host links you can see, a couple of levels deep, and note what each one answers.</li> <li>Keep only the kinds you will actually run. A list nobody runs is worse than a short one.</li> <li>Name the tool for each case (Playwright, Cypress, Robot, Selenium, WebdriverIO, Appium, JMeter, Gatling, axe-core, Lighthouse, k6) so the case is ready to become code.</li> <li>Treat security headers as signals, not proof. A missing header is a question for the owner, not a finding of a break-in.</li> </ol> <h2> What this list is not </h2> <p>It is not a certification and not a penetration test. Reading a public page does not sign in, submit forms, or generate load, so anything behind a login or under real traffic still needs its own plan.</p> <p><em>This article was created with the help of AI and checked for accuracy before publishing.</em></p> testing qa webdev a11y