Rule catalog · BearScan

Every check we run, with the WCAG criterion or law it’s based on and the evidence it needs. Open a rule’s details to see how it decides and where it approximates. Checks that need a person come with steps to follow.

94 of 94 rules, worst severity first.
Severity	Rule	Category	Evidence needed	Sources
Blocker	A Do Not Sell or Share link is present`ccpa-do-not-sell-link` Details How to fix it Add a "Do Not Sell or Share My Personal Information" link to the homepage. Since January 1, 2026 the CPPA regulations require the opt-out path to take no more steps than the opt-in path, and prohibit a Yes/No control next to a negatively worded statement. Sources Cal. Civ. Code § 1798.135(a)(3); 11 C.C.R. §§ 7013-7015 (opens in a new tab) Statute · US-California · reviewed Oct 5, 2026 · CPPA regulations effective January 1, 2026 require opt-out steps to be the same or fewer than opt-in steps and prohibit a double-negative Yes/No toggle. Approximate A decisions model reads the label of every link and button on the homepage, as rendered, and says which one lets a visitor opt out of sale or sharing or opens their privacy choices, in any wording or language. A control that only appears after interaction is missed and reported for review. Where the owner hasn't declared whether the site sells or shares personal data, advertising trackers or advertising cookies loading on a rendered page, or the privacy policy saying so, count as yes; no advertising on a crawl that reached every page, with a policy that denies a sale or no policy at all, counts as no. A California audience is taken from the privacy policy addressing California residents, or the site's own opt-out link. Method Reads the HTML, once for the whole site. Privacy disclosure · `ccpa-do-not-sell-link` Why blocker The link is a standalone statutory requirement with its own enforcement history, including a $1.5 million Sephora settlement and continuing actions through 2026.	Privacy disclosure · site	Reads the HTML	Cal. Civ. Code § 1798.135(a)(3); 11 C.C.R. §§ 7013-7015 (opens the primary source in a new tab) Sources reviewed Oct 5, 2026
Blocker	Non-essential cookies are gated behind consent`consent-banner-present` Details How to fix it Block all non-essential cookies and storage until the visitor has actively consented. Fire the consent prompt before any analytics or advertising script loads, not after. Sources Directive 2002/58/EC, Article 5(3), as amended by Directive 2009/136/EC (opens in a new tab) Statute · EU / EEA · reviewed Oct 5, 2026 · Prior consent required for non-strictly-necessary terminal storage or access. Consent quality is measured by the GDPR standard. Planet49, C-673/17 (judgment October 1, 2019) (opens in a new tab) Case law · EU (CJEU) · reviewed Oct 5, 2026 · Pre-ticked boxes are not consent, and bundling participation with consent is prohibited. Three holdings this scanner relies on directly. Approximate The page is loaded in a fresh browser and read before anything is clicked. A cookie is advertising or analytics when the script or response that wrote it is on EasyList or EasyPrivacy, or when the Open Cookie Database files its name that way. A cookie neither source knows counts as necessary only when the site's own cookie or privacy policy names it as strictly necessary (read by a decisions model); otherwise it is reported for review, never assumed necessary. Method Loads the page in a browser, on each page. Consent · `consent-banner-present` Why blocker Setting non-essential cookies before consent is unlawful under ePrivacy Article 5(3) across the EU, and is independently actionable under the FTC Act and state privacy statutes in the US.	Consent · page	Loads the page in a browser	Directive 2002/58/EC, Article 5(3), as amended by Directive 2009/136/EC (opens the primary source in a new tab) Planet49, C-673/17 (judgment October 1, 2019) (opens the primary source in a new tab) Sources reviewed Oct 5, 2026
Blocker	A privacy policy is published`legal-privacy-policy-exists` Details How to fix it Publish a privacy policy stating, at minimum: the categories and specific pieces of personal information collected, the categories of sources, the purposes, the categories of third parties it is shared with, whether it is sold or shared, the retention period or criteria for each category, and how a consumer exercises their rights. Sources Cal. Civ. Code § 1798.130(a)(1)-(3), (a)(5) (opens in a new tab) Statute · US-California · reviewed Oct 5, 2026 Regulation (EU) 2016/679, Articles 13 and 14 (opens in a new tab) Statute · EEA / UK · reviewed Oct 5, 2026 California Attorney General, CCPA Frequently Asked Questions (opens in a new tab) Guidance · US-California · reviewed Oct 5, 2026 · The 'doing business in California' test has three prongs and reaches businesses located outside California. Approximate A decisions model reads every page and says which one is the privacy policy, by what it is rather than its URL or wording. A link the model reads as pointing to the policy, when no scanned page read as one, is reported for review rather than failed. Method Reads the HTML, once for the whole site. Privacy disclosure · `legal-privacy-policy-exists` Why blocker A privacy policy is required by CalOPPA for any commercial site collecting California residents' personal information, and by GDPR Articles 13 and 14 for anyone collecting personal data in the EU. Its absence is the most commonly cited privacy defect.	Privacy disclosure · site	Reads the HTML	Cal. Civ. Code § 1798.130(a)(1)-(3), (a)(5) (opens the primary source in a new tab) Regulation (EU) 2016/679, Articles 13 and 14 (opens the primary source in a new tab) California Attorney General, CCPA Frequently Asked Questions (opens the primary source in a new tab) Sources reviewed Oct 5, 2026
Blocker	Form controls are programmatically labelled`wcag-1-3-1-form-labels` Details How to fix it Associate a visible <label for="id"> with every control, or supply an aria-label or aria-labelledby that names it. Sources WCAG 2.2 1.3.1 Info and Relationships (opens in a new tab) Level A Approximate Names are resolved from the markup by the accname computation: aria-labelledby, aria-label, the label element, then title. A name supplied only by CSS-generated content is not visible in markup and may be reported as missing. Method Reads the HTML, on each page. Accessibility: perceivable · `wcag-1-3-1-form-labels` Why blocker An unlabelled control is unusable. A screen-reader user hears the field type and nothing else, so the form cannot be completed.	Accessibility: perceivable · page	Reads the HTML	WCAG 2.2 1.3.1 (opens the primary source in a new tab)
Blocker	All functionality is available from a keyboard`wcag-2-1-1-keyboard` Details How to fix it Make every interactive element reachable and operable with Tab, Shift+Tab, Enter, Space, and the arrow keys. Prefer native controls over custom widgets, and where a custom widget is unavoidable, implement the expected keyboard pattern. Sources WCAG 2.2 2.1.1 Keyboard (opens in a new tab) Level A 28 CFR § 35.200(b) (opens in a new tab) Regulation · US (state and local government) · reviewed Oct 5, 2026 · Incorporates WCAG 2.1 AA by reference. Compliance dates extended to April 26, 2027 (population 50,000+) and April 26, 2028 by the interim final rule at 91 FR 20902. 42 U.S.C. § 12182(b)(2)(A)(ii) (opens in a new tab) Statute · US · reviewed Oct 5, 2026 · Title III effective communication and reasonable modification duties. Survives any technical conformance claim. Approximate A browser presses Tab through the page and lists every element that looks operable (an ARIA widget role, an inline click handler, or a pointer cursor with nothing focusable inside) that Tab never reaches. It does not press Enter or Space on controls, since that would submit forms and follow links, so a control that takes focus but ignores the keyboard is not found, nor is one wired only by a script listener on a plain element with no role or pointer cursor. Method Clicks through the page, on each page. Accessibility: operable · `wcag-2-1-1-keyboard` Why blocker Without keyboard access a motor-impairment user cannot complete the task at all. This is the most commonly cited defect in web accessibility litigation.	Accessibility: operable · page	Clicks through the page	WCAG 2.2 2.1.1 (opens the primary source in a new tab) 28 CFR § 35.200(b) (opens the primary source in a new tab) 42 U.S.C. § 12182(b)(2)(A)(ii) (opens the primary source in a new tab) Sources reviewed Oct 5, 2026
Blocker	No keyboard trap`wcag-2-1-2-no-keyboard-trap` Details How to fix it Ensure focus can always leave a component using standard keys. For composite widgets, follow the documented pattern for moving focus out. Sources WCAG 2.2 2.1.2 No Keyboard Trap (opens in a new tab) Level A Approximate A browser presses Tab through the page. If focus stays on one control through Tab, Shift+Tab and Escape, that is a trap. If it loops among a few controls without reaching the rest, that is reported for review, because a modal dialog does it by design. Widgets that open only after a click are not entered, since the walk never activates anything. Method Clicks through the page, on each page. Accessibility: operable · `wcag-2-1-2-no-keyboard-trap` Why blocker A keyboard trap makes the rest of the page permanently unreachable for a keyboard-only user.	Accessibility: operable · page	Clicks through the page	WCAG 2.2 2.1.2 (opens the primary source in a new tab)
Blocker	No content flashes more than three times per second`wcag-2-3-1-flash` Details How to fix it Remove or slow any animation that flashes more than three times in a one-second period. Sources WCAG 2.2 2.3.1 Three Flashes or Below Threshold (opens in a new tab) Level A Approximate Looks for the mechanisms that usually carry flashing content: video (in the page, in any frame it embeds, or streamed), embedded players and animated GIFs. Flashing produced by CSS or canvas animation is not visible this way, so a page with none of those mechanisms passes on the absence of the usual sources rather than on a measured flash rate. Media is never played, so a page that carries any stays incomplete and names each item to play. Method Reads the HTML, on each page. Accessibility: perceivable · `wcag-2-3-1-flash` Why blocker Flashing above the general flash threshold can trigger a seizure. This is a hard safety limit, not a usability preference.	Accessibility: perceivable · page	Reads the HTML	WCAG 2.2 2.3.1 (opens the primary source in a new tab)
High	Global Privacy Control signals are honoured`ccpa-gpc-honoured` Details How to fix it Read the Sec-GPC header (or navigator.globalPrivacyControl) and, when it is set, do not load advertising pixels or set advertising cookies for that visitor. Sources Cal. Civ. Code § 1798.135; 11 C.C.R. § 7025 (opens in a new tab) Statute · US-California · reviewed Oct 5, 2026 · A Global Privacy Control signal must be honoured as a valid opt-out of sale or sharing. Enforcement continued through 2026. Approximate The homepage is loaded twice in fresh browsers, once plainly and once sending Sec-GPC: 1 with navigator.globalPrivacyControl set. Advertising is what EasyList blocks and the cookies its scripts (or the Open Cookie Database) mark as marketing; EasyPrivacy's analytics are reported for review, because sending data to an analytics provider is a sale only when the provider isn't the site's service provider. Server-side sharing is not seen. Method Clicks through the page, once for the whole site. Privacy disclosure · `ccpa-gpc-honoured` Why high A GPC signal must be honoured as a valid opt-out in California. Failing to honour it is independently actionable, and enforcement has continued through 2026.	Privacy disclosure · site	Clicks through the page	Cal. Civ. Code § 1798.135; 11 C.C.R. § 7025 (opens the primary source in a new tab) Sources reviewed Oct 5, 2026
High	Auto-renewal terms are disclosed before purchase`commerce-auto-renewal-disclosure` Details How to fix it State the recurring amount, the billing frequency, the renewal date, and how to cancel immediately adjacent to the price and before the purchase button. Sources Restore Online Shoppers' Confidence Act, 15 U.S.C. §§ 8401-8405 (opens in a new tab) Statute · US (federal) · reviewed Oct 5, 2026 · Requires clear and conspicuous disclosure of material terms before charging, express informed consent, and a simple mechanism to stop recurring charges. Applies to internet sales. Cal. Bus. & Prof. Code §§ 17600-17606, as amended by AB 2863 (effective July 1, 2025) (opens in a new tab) Statute · US-California · reviewed Oct 5, 2026 · Express affirmative consent, a standalone consent device, cancellation in the same medium as enrollment, acknowledgement email, and change/renewal notice windows. Approximate Runs only on pages a decisions model (TypeSafe's Jev) classified as checkout or pricing; the same model then reads the page, in any language, for what the offer discloses. Readings it isn't sure of ask for review. Method Reads the HTML, on each page. Commerce · `commerce-auto-renewal-disclosure` Why high Auto-renewal pricing and the cancellation method are material terms that must be disclosed before the consumer commits to billing. California's amended statute requires the cost, renewal frequency, and cancellation method before the consumer confirms billing information.	Commerce · page	Reads the HTML	Restore Online Shoppers' Confidence Act, 15 U.S.C. §§ 8401-8405 (opens the primary source in a new tab) Cal. Bus. & Prof. Code §§ 17600-17606, as amended by AB 2863 (effective July 1, 2025) (opens the primary source in a new tab) Sources reviewed Oct 5, 2026
High	A cancellation route is available`commerce-cancellation-path` Details How to fix it Provide a self-service cancellation path in the same medium as signup, reachable in no more steps than signup took, with no interstitial before the cancellation completes. Sources Restore Online Shoppers' Confidence Act, 15 U.S.C. §§ 8401-8405 (opens in a new tab) Statute · US (federal) · reviewed Oct 5, 2026 · Requires clear and conspicuous disclosure of material terms before charging, express informed consent, and a simple mechanism to stop recurring charges. Applies to internet sales. Cal. Bus. & Prof. Code §§ 17600-17606, as amended by AB 2863 (effective July 1, 2025) (opens in a new tab) Statute · US-California · reviewed Oct 5, 2026 · Express affirmative consent, a standalone consent device, cancellation in the same medium as enrollment, acknowledgement email, and change/renewal notice windows. Approximate Runs only on pages a decisions model (TypeSafe's Jev) classified as checkout or pricing; the same model then reads the page, in any language, for what the offer discloses. Readings it isn't sure of ask for review. Method Reads the HTML, on each page. Commerce · `commerce-cancellation-path` Why high Where a site tells a customer they can cancel any time, that statement is a representation the site must be able to honour. Cancellation reachable only by email or phone while signup was instant is the core fact pattern in recent auto-renewal class actions.	Commerce · page	Reads the HTML	Restore Online Shoppers' Confidence Act, 15 U.S.C. §§ 8401-8405 (opens the primary source in a new tab) Cal. Bus. & Prof. Code §§ 17600-17606, as amended by AB 2863 (effective July 1, 2025) (opens the primary source in a new tab) Sources reviewed Oct 5, 2026
High	Cancelling is no harder than subscribing`commerce-cancellation-symmetry` Details How to fix it Reduce cancellation to the same number of steps as signup, in the same channel, with no retention offer standing between the request and completion. Sources Cal. Bus. & Prof. Code §§ 17600-17606, as amended by AB 2863 (effective July 1, 2025) (opens in a new tab) Statute · US-California · reviewed Oct 5, 2026 · Express affirmative consent, a standalone consent device, cancellation in the same medium as enrollment, acknowledgement email, and change/renewal notice windows. Restore Online Shoppers' Confidence Act, 15 U.S.C. §§ 8401-8405 (opens in a new tab) Statute · US (federal) · reviewed Oct 5, 2026 · Requires clear and conspicuous disclosure of material terms before charging, express informed consent, and a simple mechanism to stop recurring charges. Applies to internet sales. Approximate On a pricing or checkout page that offers a subscription, the page and the site's terms and refund pages are read by a decisions model (TypeSafe's Jev) for whether cancelling is offered only by phone, post, email, chat or in person while signing up is online; 80% or more fails. A self-service route is then taken as present, but the number of steps inside the account, and any retention offer, sit behind a sign-in and a paid plan that the scan never creates, so the verdict is reported for review with that reason. Method Reads the HTML, on each page. Commerce · `commerce-cancellation-symmetry` Why high Asymmetry between signup and cancellation is the specific fact pattern behind the recent wave of auto-renewal class actions, and the FTC settled for $7.5 million over a multi-page cancellation flow.	Commerce · page	Reads the HTML	Cal. Bus. & Prof. Code §§ 17600-17606, as amended by AB 2863 (effective July 1, 2025) (opens the primary source in a new tab) Restore Online Shoppers' Confidence Act, 15 U.S.C. §§ 8401-8405 (opens the primary source in a new tab) Sources reviewed Oct 5, 2026
High	No pre-selected paid add-ons`commerce-no-prechecked-addon` Details How to fix it Remove the checked attribute so every optional purchase starts unticked. Sources Restore Online Shoppers' Confidence Act, 15 U.S.C. §§ 8401-8405 (opens in a new tab) Statute · US (federal) · reviewed Oct 5, 2026 · Requires clear and conspicuous disclosure of material terms before charging, express informed consent, and a simple mechanism to stop recurring charges. Applies to internet sales. Cal. Bus. & Prof. Code §§ 17600-17606, as amended by AB 2863 (effective July 1, 2025) (opens in a new tab) Statute · US-California · reviewed Oct 5, 2026 · Express affirmative consent, a standalone consent device, cancellation in the same medium as enrollment, acknowledgement email, and change/renewal notice windows. Custom Communications, Inc. v. FTC, 142 F.4th 1060 (8th Cir. July 8, 2025) (opens in a new tab) Case law · US (8th Circuit) · reviewed Oct 5, 2026 · Vacated the FTC's 2024 Negative Option Rule on procedural grounds. The rule is not in force, so this catalog does not assert its requirements as binding. Approximate Runs only on pages a decisions model (TypeSafe's Jev) classified as checkout or pricing; the same model then reads the page, in any language, for what the offer discloses. Readings it isn't sure of ask for review. Method Reads the HTML, on each page. Commerce · `commerce-no-prechecked-addon` Why high A pre-ticked add-on is treated as consent the customer never gave. The FTC's deceptive-practices theory in this area has produced repeated enforcement, and California's amended auto-renewal law requires express affirmative consent.	Commerce · page	Reads the HTML	Restore Online Shoppers' Confidence Act, 15 U.S.C. §§ 8401-8405 (opens the primary source in a new tab) Cal. Bus. & Prof. Code §§ 17600-17606, as amended by AB 2863 (effective July 1, 2025) (opens the primary source in a new tab) Custom Communications, Inc. v. FTC, 142 F.4th 1060 (8th Cir. July 8, 2025) (opens the primary source in a new tab) Sources reviewed Oct 5, 2026
High	Subscription consent is recorded`commerce-subscription-consent-record` Details How to fix it Persist a timestamped record of each subscription consent, including the price, the terms presented, and the consent mechanism used. How to test it Complete a subscription. Retrieve the stored consent record and confirm it captures the price shown, the renewal terms presented, the channel, and a timestamp. Confirm retention matches the statutory minimum. The record lives in the merchant's own systems, not in the page. No external scan can see what was stored; only the owner can confirm it. Sources Cal. Bus. & Prof. Code §§ 17600-17606, as amended by AB 2863 (effective July 1, 2025) (opens in a new tab) Statute · US-California · reviewed Oct 5, 2026 · Express affirmative consent, a standalone consent device, cancellation in the same medium as enrollment, acknowledgement email, and change/renewal notice windows. Method Needs a person, on each page. Commerce · `commerce-subscription-consent-record` Why high California's amended statute requires consent records to be retained for at least three years or one year after termination, whichever is longer. Without the record, the consent cannot be evidenced.	Commerce · page	Needs a person	Cal. Bus. & Prof. Code §§ 17600-17606, as amended by AB 2863 (effective July 1, 2025) (opens the primary source in a new tab) Sources reviewed Oct 5, 2026
High	Trial-to-paid conversion terms are disclosed`commerce-trial-conversion-disclosure` Details How to fix it State the post-trial price and billing date before the trial starts, and require a separate affirmative action before the trial converts to a paid subscription. Sources Cal. Bus. & Prof. Code §§ 17600-17606, as amended by AB 2863 (effective July 1, 2025) (opens in a new tab) Statute · US-California · reviewed Oct 5, 2026 · Express affirmative consent, a standalone consent device, cancellation in the same medium as enrollment, acknowledgement email, and change/renewal notice windows. Restore Online Shoppers' Confidence Act, 15 U.S.C. §§ 8401-8405 (opens in a new tab) Statute · US (federal) · reviewed Oct 5, 2026 · Requires clear and conspicuous disclosure of material terms before charging, express informed consent, and a simple mechanism to stop recurring charges. Applies to internet sales. Approximate Runs only on pages a decisions model (TypeSafe's Jev) classified as checkout or pricing; the same model then reads the page, in any language, for what the offer discloses. Readings it isn't sure of ask for review. Method Reads the HTML, on each page. Commerce · `commerce-trial-conversion-disclosure` Why high California's amended auto-renewal law extends to free trials that convert to paid and requires express affirmative consent to the conversion, not merely agreement to the trial.	Commerce · page	Reads the HTML	Cal. Bus. & Prof. Code §§ 17600-17606, as amended by AB 2863 (effective July 1, 2025) (opens the primary source in a new tab) Restore Online Shoppers' Confidence Act, 15 U.S.C. §§ 8401-8405 (opens the primary source in a new tab) Sources reviewed Oct 5, 2026
High	Analytics cookies are set without an observed gate`consent-analytics-without-gate` Details How to fix it Ensure analytics storage is withheld until consent is recorded, and treat analytics as an optional consent category rather than a necessary one. Sources Directive 2002/58/EC, Article 5(3), as amended by Directive 2009/136/EC (opens in a new tab) Statute · EU / EEA · reviewed Oct 5, 2026 · Prior consent required for non-strictly-necessary terminal storage or access. Consent quality is measured by the GDPR standard. Approximate Reads the cookies the server sets on its very first response, which no visitor can have consented to yet, and classifies each by name with the Open Cookie Database. Method Reads the HTML, on each page. Consent · `consent-analytics-without-gate` Why high Analytics cookies are not strictly necessary for providing the service, so under ePrivacy they require prior consent. This is the most commonly cited cookie finding.	Consent · page	Reads the HTML	Directive 2002/58/EC, Article 5(3), as amended by Directive 2009/136/EC (opens the primary source in a new tab) Sources reviewed Oct 5, 2026
High	EU visitors receive a consent gate before tracking`consent-eu-gating` Details How to fix it Show the consent gate to every visitor when the site is offered in the EU, and record the consent before loading non-essential scripts. Sources Directive 2002/58/EC, Article 5(3), as amended by Directive 2009/136/EC (opens in a new tab) Statute · EU / EEA · reviewed Oct 5, 2026 · Prior consent required for non-strictly-necessary terminal storage or access. Consent quality is measured by the GDPR standard. Approximate The homepage is loaded from a browser in Europe. A banner counts when autoconsent recognises one or the page exposes the IAB TCF or GPP consent API. Method Clicks through the page, once for the whole site. Consent · `consent-eu-gating` Why high ePrivacy Article 5(3) requires prior consent for any non-essential terminal storage, applied to every EU visitor regardless of where the site is based.	Consent · site	Clicks through the page	Directive 2002/58/EC, Article 5(3), as amended by Directive 2009/136/EC (opens the primary source in a new tab) Sources reviewed Oct 5, 2026
High	No pre-ticked consent boxes`consent-no-prechecked-optin` Details How to fix it Remove the checked attribute from every consent checkbox and require an affirmative action. Sources Planet49, C-673/17 (judgment October 1, 2019) (opens in a new tab) Case law · EU (CJEU) · reviewed Oct 5, 2026 · Pre-ticked boxes are not consent, and bundling participation with consent is prohibited. Three holdings this scanner relies on directly. Approximate Every checkbox the page serves already ticked is read by a decisions model (TypeSafe's Jev), which says whether ticking it consents to marketing, data sharing or tracking, in any language. Method Reads the HTML, on each page. Consent · `consent-no-prechecked-optin` Why high The CJEU held in Planet49 that pre-ticked boxes are never valid consent, and that bundling participation with consent is prohibited.	Consent · page	Reads the HTML	Planet49, C-673/17 (judgment October 1, 2019) (opens the primary source in a new tab) Sources reviewed Oct 5, 2026
High	Refusing consent stops the tracking`consent-reject-honoured` Details How to fix it When the visitor refuses, load no advertising or analytics script, write no such cookie, and stop any already running. Sources Directive 2002/58/EC, Article 5(3), as amended by Directive 2009/136/EC (opens in a new tab) Statute · EU / EEA · reviewed Oct 5, 2026 · Prior consent required for non-strictly-necessary terminal storage or access. Consent quality is measured by the GDPR standard. EDPB, Report of the work undertaken by the Cookie Banner Taskforce (January 17, 2023) (opens in a new tab) Guidance · EU / EEA · reviewed Oct 9, 2026 · Section 3 (type A, no reject button), section 5 (type C, deceptive link design) and section 6 (types D and E, colour and contrast: case by case). Approximate The banner is refused through autoconsent, then the page is watched for a few seconds. Requests EasyList or EasyPrivacy would block, and advertising or analytics cookies written, after the refusal are what count; anything set earlier is the subject of the consent-before-loading rule instead. Method Clicks through the page, once for the whole site. Consent · `consent-reject-honoured` Why high A refusal that changes nothing is no choice at all: storing or reading non-essential cookies after the visitor said no is the plainest breach of ePrivacy Article 5(3), and the easiest for a regulator to show.	Consent · site	Clicks through the page	Directive 2002/58/EC, Article 5(3), as amended by Directive 2009/136/EC (opens the primary source in a new tab) EDPB, Report of the work undertaken by the Cookie Banner Taskforce (January 17, 2023) (opens the primary source in a new tab) Sources reviewed Oct 5, 2026
High	Rejecting is as easy as accepting`consent-reject-parity` Details How to fix it Offer reject on the first layer of the banner, drawn as a button like accept and of comparable size, so refusing takes no more effort than accepting. Sources Directive 2002/58/EC, Article 5(3), as amended by Directive 2009/136/EC (opens in a new tab) Statute · EU / EEA · reviewed Oct 5, 2026 · Prior consent required for non-strictly-necessary terminal storage or access. Consent quality is measured by the GDPR standard. EDPB, Report of the work undertaken by the Cookie Banner Taskforce (January 17, 2023) (opens in a new tab) Guidance · EU / EEA · reviewed Oct 9, 2026 · Section 3 (type A, no reject button), section 5 (type C, deceptive link design) and section 6 (types D and E, colour and contrast: case by case). Approximate The banner is found and answered by DuckDuckGo's autoconsent, which knows several hundred consent platforms. Refusing and accepting are each done in a fresh browser; the clicks each took are counted, and the first control clicked is measured as drawn: size, text size, and whether it has its own background or border. Method Clicks through the page, once for the whole site. Consent · `consent-reject-parity` Why high Making refusal harder than acceptance is the pattern EU regulators treat as invalid consent, and it is the most common finding in cookie-consent enforcement.	Consent · site	Clicks through the page	Directive 2002/58/EC, Article 5(3), as amended by Directive 2009/136/EC (opens the primary source in a new tab) EDPB, Report of the work undertaken by the Cookie Banner Taskforce (January 17, 2023) (opens the primary source in a new tab) Sources reviewed Oct 5, 2026
High	The privacy policy doesn't contradict what the site does`legal-policy-matches-behavior` Details How to fix it Change the sentence that's no longer true, or stop doing what it denies. If the tool was added by your host or a plugin without your knowledge, remove it or disclose it. Sources 15 U.S.C. § 45(a) (FTC Act Section 5) (opens in a new tab) Statute · US (federal) · reviewed Oct 10, 2026 · Deception is a representation, omission or practice likely to mislead a consumer acting reasonably, to the consumer's detriment: FTC Policy Statement on Deception (1983), https://www.ftc.gov/system/files/documents/public_statements/410531/831014deceptionstmt.pdf Cal. Civ. Code § 1798.100(a) (opens in a new tab) Statute · US-California · reviewed Oct 10, 2026 Approximate A decisions model (TypeSafe's Jev) answers fixed yes-or-no questions about the document against what the crawl saw the site load and set, with a probability for each; it can't produce a verdict outside those options. Evidence is a sentence from the document, copied by a language model and kept only when it is verbatim in the text. A contradiction fails only when Jev is at least 0.8 sure and such a sentence denies it; middling probabilities ask for review. Every verdict carries its sentence and probability for a person to check. Method Reads the HTML, on each page. Privacy disclosure · `legal-policy-matches-behavior` Why high A privacy policy that denies something the site does is a deceptive statement to every visitor who reads it, the theory behind FTC Section 5 privacy enforcement, and the notice at collection is then wrong too.	Privacy disclosure · page	Reads the HTML	15 U.S.C. § 45(a) (FTC Act Section 5) (opens the primary source in a new tab) Cal. Civ. Code § 1798.100(a) (opens the primary source in a new tab) Sources reviewed Oct 10, 2026
High	Privacy policy states the required content`legal-privacy-policy-content` Details How to fix it Add the missing sections. California requires the categories collected, the categories of sources, the purposes, the categories of third parties, whether information is sold or shared, the retention period or criteria per category, and the sensitive-information position. Sources Cal. Civ. Code § 1798.130(a)(1)-(3), (a)(5) (opens in a new tab) Statute · US-California · reviewed Oct 5, 2026 Regulation (EU) 2016/679, Articles 13 and 14 (opens in a new tab) Statute · EEA / UK · reviewed Oct 5, 2026 Approximate A decisions model (TypeSafe's Jev) answers whether the policy covers each CPRA section, with a probability. A section counts as covered at 0.7 or above only with a sentence from the policy that is verbatim in the text; it counts as missing at 0.3 or below; in between it asks for review. When the model can't read the policy, the check asks for review. Method Reads the HTML, on each page. Privacy disclosure · `legal-privacy-policy-content` Why high A privacy policy that exists but omits a required category is still a violation; the CPRA enumerated sections are what regulators and plaintiffs check first.	Privacy disclosure · page	Reads the HTML	Cal. Civ. Code § 1798.130(a)(1)-(3), (a)(5) (opens the primary source in a new tab) Regulation (EU) 2016/679, Articles 13 and 14 (opens the primary source in a new tab) Sources reviewed Oct 5, 2026
High	Refund policy states its terms`legal-refund-policy-content` Details How to fix it State the refund window in days, the payment method and timing of the refund, the conditions for eligibility, and how to request one. Sources 15 U.S.C. § 8403(a)(1) (clear and conspicuous disclosure of material terms) (opens in a new tab) Statute · US (federal) · reviewed Oct 5, 2026 Approximate TypeSafe's Jev decides whether each element is covered, with a verbatim sentence as evidence; a section counts as missing only when the model is sure, and anything uncertain, or a policy the model couldn't read, asks for review. Method Reads the HTML, on each page. Legal pages · `legal-refund-policy-content` Why high A refund policy that omits the window or the method leaves the consumer unable to exercise the return right it describes.	Legal pages · page	Reads the HTML	15 U.S.C. § 8403(a)(1) (clear and conspicuous disclosure of material terms) (opens the primary source in a new tab) Sources reviewed Oct 5, 2026
High	A refund or cancellation policy is published`legal-refund-policy-exists` Details How to fix it Publish a refund policy stating the refund window, how a refund is issued and how long it takes, the conditions for a refund, and how to cancel a subscription or order. Sources Restore Online Shoppers' Confidence Act, 15 U.S.C. § 8403(a) (opens in a new tab) Statute · US (federal) · reviewed Oct 5, 2026 Approximate Only required where the site takes payment, because a brochure site has no refund obligation. Where the owner hasn't declared whether it does, the scan decides from what it saw: a checkout page, a card form, a payment processor's script, frame or hosted-checkout link, a priced subscription, or a store platform. Seeing any of them is enough to treat it as taking payment. Seeing none of them never scopes the rule out, because an absence is not a declaration: the rule passes on a published refund policy and otherwise asks for review, saying what was and wasn't seen. Method Reads the HTML, once for the whole site. Legal pages · `legal-refund-policy-exists` Why high Refund terms are a material term that must be disclosed before a charge, and their absence is the core of ROSCA and California auto-renewal class actions.	Legal pages · site	Reads the HTML	Restore Online Shoppers' Confidence Act, 15 U.S.C. § 8403(a) (opens the primary source in a new tab) Sources reviewed Oct 5, 2026
High	Terms of service are published`legal-terms-exists` Details How to fix it Publish terms covering acceptance, acceptable use, intellectual property, warranty disclaimers, limitation of liability, indemnification, governing law and venue, and how the terms may be changed. Sources FTC Act § 5, 15 U.S.C. § 45(a) (unfair or deceptive acts) (opens in a new tab) Guidance · US (federal) · reviewed Oct 5, 2026 · The FTC does not require a terms of service, but enforces the representations made in one. An absent policy is a gap where the site makes contractual claims. Guidance on Web Accessibility and the ADA (March 18, 2022) (opens in a new tab) Guidance · US (Title III) · reviewed Oct 5, 2026 · Carries its own disclaimer that it has no force or effect of law. Cited to document the agency's position, not as an obligation. Approximate A decisions model reads every page and says which one is the terms, by what it is rather than its URL. Many sites legitimately rely on a subscription agreement rather than public terms; a link to one is reported for review. Method Reads the HTML, once for the whole site. Legal pages · `legal-terms-exists` Why high Where a site forms a contract, the terms are the contract. Their absence leaves no agreed rules of engagement and is cited in disputes over subscriptions and charges.	Legal pages · site	Reads the HTML	FTC Act § 5, 15 U.S.C. § 45(a) (unfair or deceptive acts) (opens the primary source in a new tab) Guidance on Web Accessibility and the ADA (March 18, 2022) (opens the primary source in a new tab) Sources reviewed Oct 5, 2026
High	Images have a text alternative`wcag-1-1-1-image-alt` Details How to fix it Add an alt attribute to every image. Use alt="" only when the image is purely decorative and conveys nothing; never omit the attribute. Sources WCAG 2.2 1.1.1 Non-text Content (opens in a new tab) Level A Approximate Fails an image with no alternative. For the rest, the 16 largest distinct images of a rendered page are cut out of a screenshot and a vision model reads each against its alt text: it fails alt text that does not convey the picture, and an empty alt on a picture that carries information, only when the model is at least 85% sure, and asks for review between that and a clear match. Smaller images beyond those 16 are not compared, and an image drawn by CSS is read without an alt attribute to compare. A page whose images could not be read is reported incomplete, never passed. Method Reads the HTML, on each page. Accessibility: perceivable · `wcag-1-1-1-image-alt` Why high A missing alternative is the most common way a screen-reader user loses a page's content outright.	Accessibility: perceivable · page	Reads the HTML	WCAG 2.2 1.1.1 (opens the primary source in a new tab)
High	Prerecorded audio-only and video-only content has an alternative`wcag-1-2-1-media-alternative` Details How to fix it Publish a transcript next to every audio-only recording. For video with no soundtrack, provide a text description of what it shows or an audio track that narrates it. Sources WCAG 2.2 1.2.1 Audio-only and Video-only (Prerecorded) (opens in a new tab) Level A Approximate Finds the media a page carries and whether the word 'transcript' appears near it. Whether a video has a sound track is read from the file's own track list (the first bytes of an MP4 or QuickTime file, fetched without playing it): a video with one is synchronised media and out of this criterion's scope. Whether an alternative is equivalent to what a recording says or shows is a judgement about the content, so remaining media is reported incomplete rather than passed. Embedded players, and files that aren't MP4 or couldn't be fetched, are not read. Method Reads the HTML, on each page. Accessibility: perceivable · `wcag-1-2-1-media-alternative` Why high A podcast with no transcript is silent to a deaf user, and a silent video with no description is blank to a blind one. Either way the content is lost outright.	Accessibility: perceivable · page	Reads the HTML	WCAG 2.2 1.2.1 (opens the primary source in a new tab)
High	Prerecorded video has captions`wcag-1-2-2-captions-prerecorded` Details How to fix it Add a <track kind="captions"> element to every prerecorded video, and keep it in sync with the audio. Sources WCAG 2.2 1.2.2 Captions (Prerecorded) (opens in a new tab) Level A Approximate Checks for the presence of a captions track. Caption accuracy, speaker identification, and non-speech audio are not machine-decidable and are left to manual review. Method Reads the HTML, on each page. Accessibility: perceivable · `wcag-1-2-2-captions-prerecorded` Why high Deaf and hard-of-hearing users cannot access unsynchronised prerecorded video at all, and captions are a recurring element of accessibility complaints.	Accessibility: perceivable · page	Reads the HTML	WCAG 2.2 1.2.2 (opens the primary source in a new tab)
High	Prerecorded video has audio description or a full text alternative`wcag-1-2-3-audio-description-or-alternative` Details How to fix it Provide either an audio-described version (a <track kind="descriptions"> or a described alternate cut) or a full text alternative that covers both what is said and what is shown. Sources WCAG 2.2 1.2.3 Audio Description or Media Alternative (Prerecorded) (opens in a new tab) Level A Approximate Detects a descriptions track or a nearby transcript. A video whose file lists no sound track (read from its container without playing it) is video-only, which 1.2.1 covers, and is out of scope here. A video whose soundtrack already describes every visual needs neither, and whether that is so is a judgement about the content, so the rule never passes a page that carries video with sound. Method Reads the HTML, on each page. Accessibility: perceivable · `wcag-1-2-3-audio-description-or-alternative` Why high A blind user hears the soundtrack only. Anything the video shows but does not say, such as on-screen text, a demonstration or a price, is lost.	Accessibility: perceivable · page	Reads the HTML	WCAG 2.2 1.2.3 (opens the primary source in a new tab)
High	Live audio in synchronised media is captioned`wcag-1-2-4-captions-live` Details How to fix it Caption every live stream in real time, using a human captioner (CART) or a live-captioning service whose accuracy has been checked, and make the captions available in the player. Sources WCAG 2.2 1.2.4 Captions (Live) (opens in a new tab) Level AA Approximate A stream is live when a page fetches an HLS playlist with no end marker or a DASH manifest of type dynamic, or embeds a frame at the address of a live player (YouTube live, Twitch, Vimeo events). The manifest is read for a captions or subtitles track; a stream that lists none fails. The media itself is never played, so how accurate live captions are is not judged, an embedded player's captions cannot be read from its address (reported for review), and a stream that starts only when a visitor clicks play, or on a schedule, is not seen. A page with no live stream is not applicable. Method Loads the page in a browser, on each page. Accessibility: perceivable · `wcag-1-2-4-captions-live` Why high A live stream without captions excludes deaf and hard-of-hearing viewers from the event entirely, and there is no recording to fall back on.	Accessibility: perceivable · page	Loads the page in a browser	WCAG 2.2 1.2.4 (opens the primary source in a new tab)
High	ARIA ID references resolve`wcag-1-3-1-aria-references` Details How to fix it Correct the id references so each points at an element that exists in the document, or remove the attribute. Sources WCAG 2.2 1.3.1 Info and Relationships (opens in a new tab) Level A Method Reads the HTML, on each page. Accessibility: robust · `wcag-1-3-1-aria-references` Why high A dangling aria-labelledby produces an unnamed control, which removes it from the accessibility tree.	Accessibility: robust · page	Reads the HTML	WCAG 2.2 1.3.1 (opens the primary source in a new tab)
High	Content reflows at 320 CSS pixels without horizontal scrolling`wcag-1-4-10-reflow` Details How to fix it Use a responsive layout that collapses to a single column at 320 CSS pixels. Avoid fixed widths, and let tables, maps and code blocks scroll on their own rather than the whole page. Sources WCAG 2.2 1.4.10 Reflow (opens in a new tab) Level AA Approximate The rendered page is resized to 320 CSS pixels wide and measured: the document's width, and every element that extends past the edge outside a scroll container of its own. Overflow caused only by tables, maps, video, code or diagrams is reported for review, since the criterion lets those scroll in two dimensions. A page that decides its layout only at load, not on resize, is measured as it stands. Method Loads the page in a browser, on each page. Accessibility: perceivable · `wcag-1-4-10-reflow` Why high A low-vision user zoomed to 400% sees a 320-pixel viewport. If the page does not reflow, every line has to be scrolled sideways to read.	Accessibility: perceivable · page	Loads the page in a browser	WCAG 2.2 1.4.10 (opens the primary source in a new tab)
High	Audio that plays automatically can be paused or muted`wcag-1-4-2-audio-control` Details How to fix it Do not autoplay sound. If media must start on its own, start it muted, or provide a pause or mute control at the very top of the page. Sources WCAG 2.2 1.4.2 Audio Control (opens in a new tab) Level A Approximate Reads the autoplay, muted and controls attributes, and axe-core's no-autoplay-audio result when the page was rendered. Sound started by script, and a custom pause control outside the element, are not visible in markup. Method Reads the HTML, on each page. Accessibility: perceivable · `wcag-1-4-2-audio-control` Why high Autoplaying sound talks over the screen reader, so a blind user cannot hear the controls they would need to stop it.	Accessibility: perceivable · page	Reads the HTML	WCAG 2.2 1.4.2 (opens the primary source in a new tab)
High	Text has sufficient contrast against its background`wcag-1-4-3-contrast` Details How to fix it Raise the contrast of body text to at least 4.5:1, and of large text (24px, or 18.66px bold) to at least 3:1, by darkening the text or lightening the background. Sources WCAG 2.2 1.4.3 Contrast (Minimum) (opens in a new tab) Level AA Approximate Delegated to axe-core's color-contrast rule, which computes ratios from rendered styles. Text over images, gradients or overlapping elements cannot be measured and is forwarded as incomplete rather than passed. Method Loads the page in a browser, on each page. Accessibility: perceivable · `wcag-1-4-3-contrast` Why high Low-contrast text is unreadable for low-vision users and for everyone in bright light. It is the most frequently detected accessibility defect on the web.	Accessibility: perceivable · page	Loads the page in a browser	WCAG 2.2 1.4.3 (opens the primary source in a new tab)
High	Text resizes without loss of content`wcag-1-4-4-resize-text` Details How to fix it Remove user-scalable=no from the viewport meta tag and set maximum-scale to at least 2. Sources WCAG 2.2 1.4.4 Resize Text (opens in a new tab) Level AA Method Reads the HTML, on each page. Accessibility: perceivable · `wcag-1-4-4-resize-text` Why high Disabling zoom locks out readers who depend on magnification, and viewport zoom-blocking is frequently cited in web accessibility complaints.	Accessibility: perceivable · page	Reads the HTML	WCAG 2.2 1.4.4 (opens the primary source in a new tab)
High	Scrollable regions and frames can be reached from the keyboard`wcag-2-1-1-keyboard-reachable-regions` Details How to fix it Give a scrollable region tabindex="0" and an accessible name, do not set tabindex="-1" on frames that contain controls, and replace server-side image maps with links. Sources WCAG 2.2 2.1.1 Keyboard (opens in a new tab) Level A Approximate Delegated to axe-core's rules tagged for 2.1.1 (scrollable-region-focusable, frame-focusable-content, server-side-image-map). They find structural keyboard barriers; whether every control actually responds to the keyboard stays with the manual 2.1.1 test. Method Loads the page in a browser, on each page. Accessibility: operable · `wcag-2-1-1-keyboard-reachable-regions` Why high Content inside a scroll box or frame that cannot take focus is unreachable for a keyboard user; it is on the page but cannot be read or operated.	Accessibility: operable · page	Loads the page in a browser	WCAG 2.2 2.1.1 (opens the primary source in a new tab)
High	No positive tabindex values`wcag-2-4-3-tabindex-order` Details How to fix it Remove positive tabindex values and reorder the source so the natural sequence is correct. Sources WCAG 2.2 2.4.3 Focus Order (opens in a new tab) Level A Method Reads the HTML, on each page. Accessibility: operable · `wcag-2-4-3-tabindex-order` Why high A positive tabindex hoists an element ahead of everything else and is almost always the cause of a broken focus order.	Accessibility: operable · page	Reads the HTML	WCAG 2.2 2.4.3 (opens the primary source in a new tab)
High	Keyboard focus is visible`wcag-2-4-7-focus-visible` Details How to fix it Give every focusable element a visible focus indicator that meets the contrast requirement against its background, and never remove it without replacing it. Sources WCAG 2.2 2.4.7 Focus Visible (opens in a new tab) Level AA Approximate A browser presses Tab through the page. A stop passes when its computed style has an outline or box shadow; otherwise the pixels around it are compared with focus on the element and with focus taken off it, and identical pixels mean nothing marks the focus. A style focus has just set is read once its transition has finished, so a control revealed by fading in is not read as transparent. Controls too small to compare, or inside frames, are reported for review. Whether the indicator is easy to see against its background is not judged. Method Clicks through the page, on each page. Accessibility: operable · `wcag-2-4-7-focus-visible` Why high A sighted keyboard user who cannot see focus has no way to know where they are on the page.	Accessibility: operable · page	Clicks through the page	WCAG 2.2 2.4.7 (opens the primary source in a new tab)
High	Page language is declared`wcag-3-1-1-page-language` Details How to fix it Set lang on the <html> element to the primary language of the page, for example <html lang="en-US">. Sources WCAG 2.2 3.1.1 Language of Page (opens in a new tab) Level A Method Reads the HTML, on each page. Accessibility: perceivable · `wcag-3-1-1-page-language` Why high Without a declared language a screen reader picks a pronunciation, which can render the whole site unintelligible.	Accessibility: perceivable · page	Reads the HTML	WCAG 2.2 3.1.1 (opens the primary source in a new tab)
High	Errors are identified in text`wcag-3-3-1-error-identification` Details How to fix it On validation failure, place a text message next to the field describing what is wrong, associate it with the field using aria-describedby, and move focus to the first invalid field. Sources WCAG 2.2 3.3.1 Error Identification (opens in a new tab) Level A Approximate Up to four forms per page are submitted empty and then with a wrong value in a browser that stops every write, and the page is read for what it shows. A field marked invalid with no message in text, from the page or from the browser's own validation, fails. A form whose only field is an email address is sent once, to its own site, with a value that is not an address. Forms with a password, a payment card or a file are never submitted. A form made only of selects and checkboxes with nothing required cannot be filled in wrongly and is not applicable. A form that is checked only by its server shows nothing before it is sent, so a page where no form showed an error is reported for review with each form's reason. Method Clicks through the page, on each page. Accessibility: understandable · `wcag-3-3-1-error-identification` Why high A colour change alone is not an error identification, and it is one of the most common defects found in accessibility audits.	Accessibility: understandable · page	Clicks through the page	WCAG 2.2 3.3.1 (opens the primary source in a new tab)
High	Labels and instructions are provided`wcag-3-3-2-labels-instructions` Details How to fix it Tell the user what format a value must take before they enter it: state the expected pattern for phone numbers, dates, and reference numbers rather than rejecting the input afterwards. Sources WCAG 2.2 3.3.2 Labels or Instructions (opens in a new tab) Level A Approximate Fails a field that is constrained by a pattern attribute while carrying no hint at all: no title, no description and no placeholder to tell the visitor the format the browser will insist on. Email, telephone, URL and date fields take the browser's own format and input method, which is the instruction their type gives, so they are not required to carry more. Whether an instruction that is present is adequate is not judged. Method Reads the HTML, on each page. Accessibility: understandable · `wcag-3-3-2-labels-instructions` Why high A field with a name but no format guidance produces avoidable errors, which is the substance of most form-accessibility complaints.	Accessibility: understandable · page	Reads the HTML	WCAG 2.2 3.3.2 (opens the primary source in a new tab)
High	Legal, financial and data submissions can be reviewed, corrected or reversed`wcag-3-3-4-error-prevention` Details How to fix it Before a purchase, contract, account deletion or similar commitment, show a review step with a confirm button, or check the input and let the user correct it, or allow the submission to be reversed for a stated period. Sources WCAG 2.2 3.3.4 Error Prevention (Legal, Financial, Data) (opens in a new tab) Level AA Approximate A checkout page the page classifier identified is read by a decisions model (TypeSafe's Jev) for whether it is where the purchase is made, whether it shows what will be submitted to check and change, whether it asks for a confirmation, and whether it says the order can be cancelled or reversed. Any one of the three safeguards, at 70% or more, passes; none of them, with 80% certainty, on a page that makes the purchase, fails. A review or confirmation on a later page, and commitments behind a sign-in (deleting an account, submitting test answers), are not reachable without submitting, so a page that is not a checkout is not applicable. Method Reads the HTML, on each page. Accessibility: understandable · `wcag-3-3-4-error-prevention` Why high A mistyped quantity or amount submitted with no review step can cost a user money or bind them to a contract they did not intend.	Accessibility: understandable · page	Reads the HTML	WCAG 2.2 3.3.4 (opens the primary source in a new tab)
High	Sign-in does not require a cognitive function test`wcag-3-3-8-accessible-authentication` Details How to fix it Allow paste into username, password and one-time-code fields, do not disable password managers, and offer an alternative to any puzzle or memorisation test (an email link, a passkey, or a CAPTCHA based on object recognition). Sources WCAG 2.2 3.3.8 Accessible Authentication (Minimum) (opens in a new tab) Level AA Approximate A paste event is dispatched to each credential field in the browser and a field whose handler cancels it fails, as does paste blocking written into the markup. The sign-in form's text is read by a decisions model (TypeSafe's Jev) for a memory, transcription or calculation test (80% or more fails). Challenge widgets are identified by their source: reCAPTCHA, hCaptcha and Turnstile test object recognition, which the criterion allows; any other puzzle, or a CAPTCHA image of unknown kind, is reported for review. The password is never submitted, so a step that appears only after a username is accepted, and a one-time code sent afterwards, are not seen. Method Clicks through the page, on each page. Accessibility: understandable · `wcag-3-3-8-accessible-authentication` Why high Blocking paste or password managers forces users with memory or cognitive disabilities to transcribe a password by hand, which can lock them out of their account.	Accessibility: understandable · page	Clicks through the page	WCAG 2.2 3.3.8 (opens the primary source in a new tab)
High	ARIA attributes, ids and nesting are valid`wcag-4-1-2-aria-attributes` Details How to fix it Use only ARIA attributes the element's role allows, with valid values, include every attribute the role requires, keep ids referenced by ARIA unique, and do not nest interactive elements. Sources WCAG 2.2 4.1.2 Name, Role, Value (opens in a new tab) Level A Approximate Takes every axe-core rule tagged for 4.1.2 that the naming, role, hidden-focus and frame rules do not already claim, so an axe rule added for this criterion lands here by default. Method Loads the page in a browser, on each page. Accessibility: robust · `wcag-4-1-2-aria-attributes` Why high An invalid or prohibited ARIA attribute is ignored or misreported by assistive technology, and an interactive element nested inside another is often unreachable, so the control's state or the control itself is lost.	Accessibility: robust · page	Loads the page in a browser	WCAG 2.2 4.1.2 (opens the primary source in a new tab)
High	Hidden content is not focusable`wcag-4-1-2-aria-hidden-focus` Details How to fix it Remove aria-hidden from focusable elements, or make them genuinely unfocusable with the disabled attribute or by removing them from the tab order. Sources WCAG 2.2 4.1.2 Name, Role, Value (opens in a new tab) Level A Method Reads the HTML, on each page. Accessibility: robust · `wcag-4-1-2-aria-hidden-focus` Why high aria-hidden hides content from assistive technology while leaving it in the tab order, so a keyboard user lands on something that is announced as nothing.	Accessibility: robust · page	Reads the HTML	WCAG 2.2 4.1.2 (opens the primary source in a new tab)
High	Controls expose an accessible name and their state`wcag-4-1-2-name-role-value` Details How to fix it Give every link, button, and control visible text, an aria-label, or an aria-labelledby reference. Icon-only controls need an explicit label. A group of buttons where one option is chosen needs that choice exposed: aria-pressed on each button, or radios (role=radio with aria-checked in a radiogroup), or tabs with aria-selected. Sources WCAG 2.2 4.1.2 Name, Role, Value (opens in a new tab) Level A Approximate Names are computed from the rendered markup by the accname algorithm: aria-labelledby, aria-label, the element's content (text, an image's alt, an SVG's title, skipping anything aria-hidden), then title. Links and buttons hidden from assistive technology by aria-hidden or hidden are not counted. A name supplied only by CSS-generated content, or an element hidden only by a stylesheet, is not visible in markup and may be reported as unnamed. State is checked on groups of two to ten sibling buttons, tabs or role=link elements of one role that are not all drawn alike, compared by computed colours, borders, weight, decoration, shadow, outline and pseudo-element indicators with the pointer away and nothing focused. In up to eight such groups per page a control drawn like another (in a pair, either) is pressed by the pointer, with every write and navigation stopped and the page let settle. The group is a toggle only if the selected look moves onto the pressed control: every property that changed on exactly one other control swapped with the pressed one's, or, where several can be on, the pressed control alone took on another control's look. It is then put back as found. A toggle passes when Chromium reports the pressed control as pressed, selected or checked, it carries aria-current, or an accessible name in the swap changed; it fails when no control in the group had any such state before or after, or when the group has such states but the control that now looks selected does not carry one. A press that goes to another page, opens a window, dialog or menu, or changes the group any other way is not a toggle. A press that could not be read (covered, a write stopped, a page still changing, a group redrawn) leaves the rule incomplete. Native links, radio buttons and checkboxes are not pressed, and a group whose selected option is marked only by a separate element (a pill that slides behind the buttons) looks alike in every computed style and is not seen. Method Reads the HTML, on each page. Accessibility: robust · `wcag-4-1-2-name-role-value` Why high A button with no name is announced as just "button", which conveys nothing about what it does; a toggle that shows its selected option only by colour leaves a screen-reader user unable to tell which option is on.	Accessibility: robust · page	Reads the HTML	WCAG 2.2 4.1.2 (opens the primary source in a new tab)
High	Status messages are exposed without focus`wcag-4-1-3-status-messages` Details How to fix it Wrap the status message in a region with an appropriate aria-live value, or move focus deliberately if the message is the expected result of the action. Sources WCAG 2.2 4.1.3 Status Messages (opens in a new tab) Level AA Approximate Text that appears on a page that is left alone for ten seconds, and text that appears after forms are submitted wrongly in a browser that stops every write, is checked for being inside an aria-live region or a status, alert or log role, or for focus having moved to it. Text that was neither is read by a decisions model (TypeSafe's Jev) for whether it is a status message (a confirmation, an error, a result count) rather than content; 80% or more fails. Statuses that follow actions the scan never takes (adding to a cart, saving, signing in) are not observed, so a page with none that it could provoke passes on what was observed, and a page with no form, no live region and nothing that appeared is not applicable. Method Clicks through the page, on each page. Accessibility: robust · `wcag-4-1-3-status-messages` Why high A confirmation message that is not announced leaves a screen-reader user unsure whether their action registered.	Accessibility: robust · page	Clicks through the page	WCAG 2.2 4.1.3 (opens the primary source in a new tab)
Medium	Total price and mandatory fees are shown before purchase`commerce-total-price-disclosure` Details How to fix it Show the total the customer will be charged, inclusive of mandatory fees, before the final purchase action. Sources 16 C.F.R. Part 464 (Rule on Unfair or Deceptive Fees) (opens in a new tab) Regulation · US (federal) · reviewed Oct 5, 2026 · Effective May 12, 2025. Governs disclosure of total prices and mandatory fees in live-event ticketing and short-term lodging. Restore Online Shoppers' Confidence Act, 15 U.S.C. §§ 8401-8405 (opens in a new tab) Statute · US (federal) · reviewed Oct 5, 2026 · Requires clear and conspicuous disclosure of material terms before charging, express informed consent, and a simple mechanism to stop recurring charges. Applies to internet sales. Approximate A decisions model reads the page for a price and for a stated total including fees, in any wording. Totals assembled at the final step after address entry are not visible here and are reported for review. Method Reads the HTML, on each page. Commerce · `commerce-total-price-disclosure` Why medium Obscuring or misrepresenting a total price is deceptive. The FTC's fees rule makes this explicit for ticketing and lodging, and the same theory is widely enforced in checkout flows generally.	Commerce · page	Reads the HTML	16 C.F.R. Part 464 (Rule on Unfair or Deceptive Fees) (opens the primary source in a new tab) Restore Online Shoppers' Confidence Act, 15 U.S.C. §§ 8401-8405 (opens the primary source in a new tab) Sources reviewed Oct 5, 2026
Medium	Consent dialogs disclose cookie purposes and duration`consent-banner-disclosure` Details How to fix it State each cookie category, its purpose, its lifetime, and any third-party access, and keep the full list reachable from the banner. Sources Planet49, C-673/17 (judgment October 1, 2019) (opens in a new tab) Case law · EU (CJEU) · reviewed Oct 5, 2026 · Pre-ticked boxes are not consent, and bundling participation with consent is prohibited. Three holdings this scanner relies on directly. Approximate The banner's own text, captured as it was answered, is read by a decisions model (TypeSafe's Jev) for whether it states purposes and lifetimes, in any language. Detail behind a 'more information' link isn't read and is reported for review. Method Clicks through the page, once for the whole site. Consent · `consent-banner-disclosure` Why medium Planet49 requires the information given with consent to include how long a cookie lives and whether third parties can access it. Omitting it invalidates the consent.	Consent · site	Clicks through the page	Planet49, C-673/17 (judgment October 1, 2019) (opens the primary source in a new tab) Sources reviewed Oct 5, 2026
Medium	A cookie policy is published`consent-cookie-policy-exists` Details How to fix it Publish a cookie policy listing the categories of cookies, their purposes, their providers, their lifetimes, and how to change consent. Sources Directive 2002/58/EC, Article 5(3), as amended by Directive 2009/136/EC (opens in a new tab) Statute · EU / EEA · reviewed Oct 5, 2026 · Prior consent required for non-strictly-necessary terminal storage or access. Consent quality is measured by the GDPR standard. Method Reads the HTML, once for the whole site. Privacy disclosure · `consent-cookie-policy-exists` Why medium ePrivacy transparency obligations are commonly discharged by a cookie policy; without one, the required information is not provided at all.	Privacy disclosure · site	Reads the HTML	Directive 2002/58/EC, Article 5(3), as amended by Directive 2009/136/EC (opens the primary source in a new tab) Sources reviewed Oct 5, 2026
Medium	An accessibility statement is published`legal-accessibility-statement` Details How to fix it Publish an accessibility statement naming the standard being followed (for example WCAG 2.1 AA), the conformance status including known gaps, how to report a barrier, and a commitment to respond. Sources 42 U.S.C. § 12182(b)(2)(A)(ii) (opens in a new tab) Statute · US · reviewed Oct 5, 2026 · Title III effective communication and reasonable modification duties. Survives any technical conformance claim. Guidance on Web Accessibility and the ADA (March 18, 2022) (opens in a new tab) Guidance · US (Title III) · reviewed Oct 5, 2026 · Carries its own disclaimer that it has no force or effect of law. Cited to document the agency's position, not as an obligation. Approximate A statement's adequacy depends on whether it names a standard, states known gaps, and gives a working route to report a problem. Presence is checked; adequacy is reported for review. Method Reads the HTML, once for the whole site. Legal pages · `legal-accessibility-statement` Why medium An accessibility statement and a named contact are now standard injunctive-relief items in accessibility consent decrees, independent of any technical conformance.	Legal pages · site	Reads the HTML	42 U.S.C. § 12182(b)(2)(A)(ii) (opens the primary source in a new tab) Guidance on Web Accessibility and the ADA (March 18, 2022) (opens the primary source in a new tab) Sources reviewed Oct 5, 2026
Medium	The cookie policy accounts for the trackers the site uses`legal-cookie-policy-matches-behavior` Details How to fix it List every analytics, advertising and session-recording tool in the cookie policy with its purpose and lifetime, and correct any statement that says the site doesn't use them. Sources Directive 2002/58/EC, Article 5(3), as amended by Directive 2009/136/EC (opens in a new tab) Statute · EU / EEA · reviewed Oct 5, 2026 · Prior consent required for non-strictly-necessary terminal storage or access. Consent quality is measured by the GDPR standard. Approximate A decisions model (TypeSafe's Jev) answers fixed yes-or-no questions about the document against what the crawl saw the site load and set, with a probability for each; it can't produce a verdict outside those options. Evidence is a sentence from the document, copied by a language model and kept only when it is verbatim in the text. A contradiction fails only when Jev is at least 0.8 sure and such a sentence denies it; middling probabilities ask for review. Every verdict carries its sentence and probability for a person to check. Method Reads the HTML, on each page. Consent · `legal-cookie-policy-matches-behavior` Why medium ePrivacy consent is only informed when the cookie policy describes what is actually stored and read. A tracker the policy omits or denies makes every consent given on that basis uninformed.	Consent · page	Reads the HTML	Directive 2002/58/EC, Article 5(3), as amended by Directive 2009/136/EC (opens the primary source in a new tab) Sources reviewed Oct 5, 2026
Medium	The privacy policy names the services the site shares data with`legal-policy-discloses-third-parties` Details How to fix it Add each service to the policy's sharing section: who it is, what it receives, and why. Analytics and advertising tools need naming even when they set no cookies. Sources Cal. Civ. Code § 1798.130(a)(1)-(3), (a)(5) (opens in a new tab) Statute · US-California · reviewed Oct 5, 2026 Regulation (EU) 2016/679, Articles 13 and 14 (opens in a new tab) Statute · EEA / UK · reviewed Oct 5, 2026 Approximate A decisions model (TypeSafe's Jev) answers fixed yes-or-no questions about the document against what the crawl saw the site load and set, with a probability for each; it can't produce a verdict outside those options. Evidence is a sentence from the document, copied by a language model and kept only when it is verbatim in the text. A contradiction fails only when Jev is at least 0.8 sure and such a sentence denies it; middling probabilities ask for review. Every verdict carries its sentence and probability for a person to check. Method Reads the HTML, on each page. Privacy disclosure · `legal-policy-discloses-third-parties` Why medium California requires a privacy policy to list the categories of third parties personal information is disclosed to, and GDPR the recipients. A tracker or processor the policy never mentions is a gap in that list.	Privacy disclosure · page	Reads the HTML	Cal. Civ. Code § 1798.130(a)(1)-(3), (a)(5) (opens the primary source in a new tab) Regulation (EU) 2016/679, Articles 13 and 14 (opens the primary source in a new tab) Sources reviewed Oct 5, 2026
Medium	Prerecorded video has audio description`wcag-1-2-5-audio-description` Details How to fix it Provide an audio-described version of every prerecorded video, either as a <track kind="descriptions"> or as an alternate cut with described audio, unless the original soundtrack already conveys every visual. Sources WCAG 2.2 1.2.5 Audio Description (Prerecorded) (opens in a new tab) Level AA Approximate Detects a descriptions track. A video whose file lists no sound track (read from its container without playing it) is not synchronised media and is out of scope. A video whose soundtrack already describes every visual needs no separate description, and that is a judgement about the content, so the rule never passes a page that carries video with sound. Method Reads the HTML, on each page. Accessibility: perceivable · `wcag-1-2-5-audio-description` Why medium At AA a transcript alone no longer suffices: a blind user watching alongside others needs the visual information in the soundtrack itself.	Accessibility: perceivable · page	Reads the HTML	WCAG 2.2 1.2.5 (opens the primary source in a new tab)
Medium	Lists, tables and ARIA structures are marked up correctly`wcag-1-3-1-semantic-structure` Details How to fix it Use <ul>, <ol> and <dl> with only their permitted children, associate data cells with real header cells, and give ARIA composite roles the parent and child roles they require. Sources WCAG 2.2 1.3.1 Info and Relationships (opens in a new tab) Level A Approximate Takes every axe-core rule tagged for 1.3.1 (list, listitem, definition-list, dlitem, aria-required-children, aria-required-parent, td-headers-attr, th-has-data-cells, and the experimental table and heading checks). Structure conveyed only visually, such as bold text styled as a heading, is beyond them, which is what the experimental p-as-heading check reports as unconfirmed. Each paragraph it flags is read by a decisions model (TypeSafe's Jev) with the text before and after it: at 80% sure it is a heading of what follows it fails, at 80% sure it is not (a label, a lead-in, a line inside a card or an illustration) it is cleared, and in between it asks for review. A flagged paragraph with no letters in it (a large figure such as a price or a count), or one hidden from assistive technology, is left out. Method Loads the page in a browser, on each page. Accessibility: perceivable · `wcag-1-3-1-semantic-structure` Why medium A list that is not a list, or a table cell tied to the wrong header, reads as a jumble of unrelated text to a screen-reader user.	Accessibility: perceivable · page	Loads the page in a browser	WCAG 2.2 1.3.1 (opens the primary source in a new tab)
Medium	Data tables expose their headers`wcag-1-3-1-table-headers` Details How to fix it Use <th> for header cells, give each a scope attribute, and give every data table a <caption> describing what it contains. Sources WCAG 2.2 1.3.1 Info and Relationships (opens in a new tab) Level A Method Reads the HTML, on each page. Accessibility: perceivable · `wcag-1-3-1-table-headers` Why medium Without header association a screen-reader user hears an undifferentiated stream of numbers.	Accessibility: perceivable · page	Reads the HTML	WCAG 2.2 1.3.1 (opens the primary source in a new tab)
Medium	Reading order follows the visual order`wcag-1-3-2-meaningful-sequence` Details How to fix it Keep DOM order matching the visual reading order; correct the source order rather than fighting it with positioning, flex order or grid placement. Sources WCAG 2.2 1.3.2 Meaningful Sequence (opens in a new tab) Level A Approximate In the rendered page, the children of every container are laid out and put in the order a sighted reader meets them (rows top to bottom, left to right, or right to left in a right-to-left container). Where that differs from the markup order, which is the order a screen reader reads, the pieces are put to a decisions model (TypeSafe's Jev) in both orders: it fails when sure the markup order loses the meaning, and asks for review when unsure. Fixed and sticky layers, inline text and tables are left out, and text drawn by CSS content is not seen. Method Loads the page in a browser, on each page. Accessibility: perceivable · `wcag-1-3-2-meaningful-sequence` Why medium A DOM order that fights the visual order makes content read in the wrong sequence.	Accessibility: perceivable · page	Loads the page in a browser	WCAG 2.2 1.3.2 (opens the primary source in a new tab)
Medium	Instructions do not rely on shape, position, colour or sound alone`wcag-1-3-3-sensory-characteristics` Details How to fix it Name the control in every instruction ("select Continue") and use shape, position, colour or sound only as an addition to that name. Sources WCAG 2.2 1.3.3 Sensory Characteristics (opens in a new tab) Level A Approximate Every block of text on the page (up to 300 distinct ones per scan) is read by a decisions model (TypeSafe's Jev), in any language, for whether it identifies something only by shape, size, position, orientation, colour or sound rather than also naming it. It fails at 80% or more and asks for review between 50% and 80%. Wording inside images and in text that only a script writes after load is not read. Method Reads the HTML, on each page. Accessibility: perceivable · `wcag-1-3-3-sensory-characteristics` Why medium An instruction like "press the round button on the right" means nothing to a screen-reader user, who cannot perceive shape or position.	Accessibility: perceivable · page	Reads the HTML	WCAG 2.2 1.3.3 (opens the primary source in a new tab)
Medium	Content works in both portrait and landscape`wcag-1-3-4-orientation` Details How to fix it Remove CSS or script that forces a single orientation, and do not show a 'please rotate your device' message unless one orientation is genuinely essential (a piano app, a cheque deposit). Sources WCAG 2.2 1.3.4 Orientation (opens in a new tab) Level AA Approximate The rendered page is shown at a phone's portrait and landscape sizes, and the text visible in each is read by a decisions model (TypeSafe's Jev), in any language, for a request to rotate the device or a statement that the page can't be used that way. How much text shows in each is compared too. A lock applied by script to the device's real orientation, which a resized window does not trigger, is not seen; axe-core's CSS check for it runs separately. Method Loads the page in a browser, on each page. Accessibility: perceivable · `wcag-1-3-4-orientation` Why medium A user with a device mounted to a wheelchair cannot rotate it. A site locked to one orientation is unusable for them.	Accessibility: perceivable · page	Loads the page in a browser	WCAG 2.2 1.3.4 (opens the primary source in a new tab)
Medium	Styles do not lock the page to one orientation`wcag-1-3-4-orientation-lock` Details How to fix it Remove orientation media queries that rotate or hide the page, unless a single orientation is essential to the content. Sources WCAG 2.2 1.3.4 Orientation (opens in a new tab) Level AA Approximate axe-core's css-orientation-lock is experimental, so what it finds is reported as incomplete rather than failed. It reads CSS only; locks applied by script stay with the manual 1.3.4 test. Method Loads the page in a browser, on each page. Accessibility: perceivable · `wcag-1-3-4-orientation-lock` Why medium A user with a device mounted to a wheelchair cannot rotate it. A site locked to one orientation is unusable for them.	Accessibility: perceivable · page	Loads the page in a browser	WCAG 2.2 1.3.4 (opens the primary source in a new tab)
Medium	Fields that collect personal data identify their purpose`wcag-1-3-5-input-purpose` Details How to fix it Add an autocomplete attribute using a token from WCAG 2.2 section 7 to every field that collects the user's own information, for example autocomplete="email", "given-name", "postal-code" or "tel". Sources WCAG 2.2 1.3.5 Identify Input Purpose (opens in a new tab) Level AA Approximate Validates autocomplete tokens against the purpose list in WCAG 2.2 section 7; an unrecognised token fails, matching axe-core's autocomplete-valid. The criterion applies only to fields about the user, so every field without a token is read by a decisions model (TypeSafe's Jev) from its label, name and placeholder, in any language, for what it asks the visitor to enter: it fails a field it is at least 80% sure collects the visitor's own name, address, email, phone, card or birth date, naming the token to add, and exempts one it takes to be about something else (search, a coupon, a gift recipient). Anything between asks for review. Method Reads the HTML, on each page. Accessibility: perceivable · `wcag-1-3-5-input-purpose` Why medium Autofill is what lets users with motor or memory impairments complete a form without retyping. Without a recognised purpose, the browser cannot offer it.	Accessibility: perceivable · page	Reads the HTML	WCAG 2.2 1.3.5 (opens the primary source in a new tab)
Medium	Links in running text are distinguishable without colour`wcag-1-4-1-link-distinguishable` Details How to fix it Underline links that sit inside paragraphs, or give them a non-colour cue such as a weight change, and keep at least 3:1 contrast between link and body text. Sources WCAG 2.2 1.4.1 Use of Color (opens in a new tab) Level A Approximate Delegated to axe-core's link-in-text-block rule, which compares computed link styles with the surrounding text. It covers links only; other uses of colour remain with the manual 1.4.1 test. Method Loads the page in a browser, on each page. Accessibility: perceivable · `wcag-1-4-1-link-distinguishable` Why medium A link marked only by a slightly different colour is invisible to many colour-blind readers, who then miss the action entirely.	Accessibility: perceivable · page	Loads the page in a browser	WCAG 2.2 1.4.1 (opens the primary source in a new tab)
Medium	Colour is not the only visual means of conveying information`wcag-1-4-1-use-of-color` Details How to fix it Pair every colour-coded state with text, an icon, or a shape change so it survives without colour perception. Sources WCAG 2.2 1.4.1 Use of Color (opens in a new tab) Level A Approximate A vision model is shown the top of the rendered page in colour and again in greyscale and says whether anything is conveyed by colour alone (status dots, required markers, error borders, chart series, a hue-only legend). It fails only at 85% or more and says what it saw; between that and clearly fine it asks for review. Separately, the page's sentences are read by a decisions model (TypeSafe's Jev) for instructions that identify something by colour alone, which fail at 80% or more. Only the first screen is photographed, so colour-only meaning further down the page is found only through its wording. Links in running text are checked by axe-core under their own rule. Method Loads the page in a browser, on each page. Accessibility: perceivable · `wcag-1-4-1-use-of-color` Why medium A low-vision or colour-blind user loses meaning that a sighted user takes for granted.	Accessibility: perceivable · page	Loads the page in a browser	WCAG 2.2 1.4.1 (opens the primary source in a new tab)
Medium	Controls and meaningful graphics have 3:1 contrast`wcag-1-4-11-non-text-contrast` Details How to fix it Give input borders, focus indicators, icons that carry meaning, and chart elements at least 3:1 contrast against what is next to them. Sources WCAG 2.2 1.4.11 Non-text Contrast (opens in a new tab) Level AA Approximate Text fields, selects and icon-only buttons are measured from computed styles: the best of each field's border and fill, or of the nearest enclosing element that draws the field's boundary (a wrapper around the input and its button), against what it sits on, and the shapes of an inline SVG icon against its background, with translucent layers composited. Under 3:1 fails. A control over an image, gradient or shadow, a field with no border or fill of its own and nothing around it that draws one, a custom-drawn checkbox or radio, and image icons are cut out of a screenshot instead and a vision model says whether their boundary or shape reaches 3:1; it fails at 85% or more. Native checkboxes and radios are taken as meeting it, the focus indicator's colour and the checked states of custom widgets are not measured, and graphics other than the 16 largest images are not read. Method Loads the page in a browser, on each page. Accessibility: perceivable · `wcag-1-4-11-non-text-contrast` Why medium A text field whose border is barely visible, or a chart line in pale grey, cannot be found or read by a low-vision user.	Accessibility: perceivable · page	Loads the page in a browser	WCAG 2.2 1.4.11 (opens the primary source in a new tab)
Medium	Content survives increased text spacing`wcag-1-4-12-text-spacing` Details How to fix it Avoid fixed heights on text containers and do not set letter-, word- or line-spacing with !important inline styles; let containers grow with their content. Sources WCAG 2.2 1.4.12 Text Spacing (opens in a new tab) Level AA Approximate The rendered page is measured, then measured again with the criterion's overrides applied (line height 1.5 times the font size, paragraph spacing 2 times, letter spacing 0.12 times, word spacing 0.16 times). Text that is cut off by a container that clips it, or that overlaps other text, and did not before, fails. Overlap is judged line by line, from the rendered text nodes (a link that wraps has one box per line, not one box covering what lies between; text hidden from sight, such as a visually-hidden note inside a link, is not rendered text). It is measured twice: only what both measurements find fails, and a page whose two measurements differ asks for review. Up to 700 text elements are compared; content that only moves out of view without being clipped or overlapped is not counted as lost. axe-core's avoid-inline-spacing finds inline styles that lock spacing and is folded in. Method Loads the page in a browser, on each page. Accessibility: perceivable · `wcag-1-4-12-text-spacing` Why medium Readers with dyslexia often override spacing. If the layout clips or overlaps when they do, the text they adjusted becomes unreadable.	Accessibility: perceivable · page	Loads the page in a browser	WCAG 2.2 1.4.12 (opens the primary source in a new tab)
Medium	Content shown on hover or focus is dismissible, hoverable and persistent`wcag-1-4-13-content-on-hover-or-focus` Details How to fix it Let Escape dismiss tooltips and hover menus without moving focus, keep them open while the pointer is over them, and do not close them on a timer. Sources WCAG 2.2 1.4.13 Content on Hover or Focus (opens in a new tab) Level AA Approximate A browser moves a real pointer over up to 24 likely triggers (declared tooltips and popups, menu items, buttons, links, images) and Tabs through up to 40 stops, noting content that appears. For each of up to three that do, it presses Escape (dismissible, required only when the content covers other text), moves the pointer along a path onto the new content (hoverable), and leaves the pointer or focus still for 4 seconds (persistent). The page's transitions and animations are made instant for this, so content is read where a fade or slide ends rather than midway; while they ran, a menu still fading out from one trigger was credited to the next. Tooltips drawn by CSS pseudo-elements are checked for dismissal only. Triggers beyond those tried, and content that appears after a longer delay, are not seen; the 4-second wait finds a timer that closes it sooner, not one set to 10 seconds. Method Clicks through the page, on each page. Accessibility: perceivable · `wcag-1-4-13-content-on-hover-or-focus` Why medium A tooltip that covers what a magnifier user is reading, and vanishes when they move the pointer onto it, makes both the tooltip and the content beneath it unusable.	Accessibility: perceivable · page	Clicks through the page	WCAG 2.2 1.4.13 (opens the primary source in a new tab)
Medium	Text is presented as text, not as an image of text`wcag-1-4-5-images-of-text` Details How to fix it Replace images of text with real text styled in CSS. Logos and text whose particular presentation is essential are exempt. Sources WCAG 2.2 1.4.5 Images of Text (opens in a new tab) Level AA Approximate The 16 largest distinct images of a rendered page (pictures, inline SVG and CSS background images) are cut out of a screenshot and a vision model says how likely each is mostly text that could have been live text, and how likely it is a logotype, brand or product mark, badge, seal or certification mark, screenshot or chart, which are exempt (it also says which kind of mark it took it for). It fails at 85% or more when the image is not probably a logo, and asks for review from 50%. Smaller images beyond the 16 are not read. Method Loads the page in a browser, on each page. Accessibility: perceivable · `wcag-1-4-5-images-of-text` Why medium Text baked into an image cannot be resized, recoloured or re-spaced by a low-vision user, and it blurs when magnified.	Accessibility: perceivable · page	Loads the page in a browser	WCAG 2.2 1.4.5 (opens the primary source in a new tab)
Medium	Single-character shortcuts can be turned off or remapped`wcag-2-1-4-character-key-shortcuts` Details How to fix it Require a modifier key (Ctrl, Alt, Cmd) for keyboard shortcuts, or offer a setting to turn them off or remap them, or limit them to when the relevant component has focus. Sources WCAG 2.2 2.1.4 Character Key Shortcuts (opens in a new tab) Level A Approximate With nothing focused, a browser presses each letter, capital, digit and common symbol key (76 in all) one at a time, and the page counts as having reacted if its address, title, text, open dialogs or focus changed, or a handler cancelled the key. A key pressed while the page was changing by itself is skipped and counted. A reaction fails the page: the protections the criterion allows (a setting to turn it off or remap it, or a shortcut that works only while its own component has focus) are not visible from the page, so a site that keeps such a setting on another page should record it. Shortcuts that need two keys in sequence, and keys pressed while a widget has focus, are not tried. Method Clicks through the page, on each page. Accessibility: operable · `wcag-2-1-4-character-key-shortcuts` Why medium Speech-input users dictate words as keystrokes. A page that acts on bare letter keys fires commands every time they speak.	Accessibility: operable · page	Clicks through the page	WCAG 2.2 2.1.4 (opens the primary source in a new tab)
Medium	Time limits can be extended`wcag-2-2-1-timing-adjustable` Details How to fix it Allow the time limit to be turned off, adjusted, or extended, and warn the user when it is about to expire. Sources WCAG 2.2 2.2.1 Timing Adjustable (opens in a new tab) Level A Method Reads the HTML, on each page. Accessibility: operable · `wcag-2-2-1-timing-adjustable` Why medium An unadjustable time limit can end a session mid-transaction, losing work the user cannot recreate.	Accessibility: operable · page	Reads the HTML	WCAG 2.2 2.2.1 (opens the primary source in a new tab)
Medium	Moving, blinking and auto-updating content can be paused`wcag-2-2-2-pause-stop-hide` Details How to fix it Give carousels, tickers, autoplaying video and animations that last more than five seconds a visible pause control, and remove <marquee> and <blink>. Sources WCAG 2.2 2.2.2 Pause, Stop, Hide (opens in a new tab) Level A Approximate The page is loaded fresh and left alone from 3 to 13 seconds. CSS animations that are still running or repeat for more than five seconds, marquee and blink elements, GIFs, and any region whose text or style changes by itself twice (or once, inside a carousel library or a carousel-role region) count as moving. The buttons and links in or around each, and anywhere on the page, are put to a decisions model (TypeSafe's Jev) for whether one pauses, stops or hides it: none, with 80% certainty, fails. A page with no script, frame, animation or media is not waited on. Video and audio are never played by the scan, so an autoplaying video without native controls can only be reported for review; essential motion (a progress indicator) is exempted only by its progressbar role. axe-core flags <marquee> and <blink>. Method Clicks through the page, on each page. Accessibility: operable · `wcag-2-2-2-pause-stop-hide` Why medium Motion that cannot be stopped pulls attention away from the task for users with attention disorders, and an auto-advancing carousel moves text before a slow reader finishes it.	Accessibility: operable · page	Clicks through the page	WCAG 2.2 2.2.2 (opens the primary source in a new tab)
Medium	A mechanism exists to bypass repeated blocks`wcag-2-4-1-bypass-blocks` Details How to fix it Add a skip link as the first focusable element, and use header, nav, main, and footer landmarks so the structure is exposed. Sources WCAG 2.2 2.4.1 Bypass Blocks (opens in a new tab) Level A Approximate A skip link passes, and so do landmarks (a main landmark and at least one other), which are WCAG's own sufficient technique for this criterion. Where nothing repeats the rule is not applicable, and axe-core's page-level check is not consulted: a site of one page that links to no other page of its own, or a page with no header, navigation or sidebar and fewer than 5 links. A page with no such region but more links than that may still hold an unmarked navigation block, so axe-core's result stands there. Whether the skip link's target exists is checked by axe-core. Method Reads the HTML, on each page. Accessibility: operable · `wcag-2-4-1-bypass-blocks` Why medium Without a skip link or landmark structure, a keyboard user traverses the same navigation on every page.	Accessibility: operable · page	Reads the HTML	WCAG 2.2 2.4.1 (opens the primary source in a new tab)
Medium	Focused elements are not hidden by sticky content`wcag-2-4-11-focus-not-obscured` Details How to fix it Add scroll-padding equal to the height of sticky headers and footers, and make sure banners and chat launchers do not cover focusable content, or can be dismissed. Sources WCAG 2.2 2.4.11 Focus Not Obscured (Minimum) (opens in a new tab) Level AA Approximate A browser presses Tab through the page with the cookie banner and any sticky layers as they load. At each stop five points inside the focused element are hit-tested; if all of them land on something that is not part of the element, it is entirely covered. Partly covered passes, as the criterion allows. A layer that appears only later (a chat launcher opened on a timer) is not seen. Method Clicks through the page, on each page. Accessibility: operable · `wcag-2-4-11-focus-not-obscured` Why medium A sticky header, cookie banner or chat widget that covers the focused element leaves a keyboard user unable to see where they are.	Accessibility: operable · page	Clicks through the page	WCAG 2.2 2.4.11 (opens the primary source in a new tab)
Medium	The page has a descriptive title`wcag-2-4-2-page-titled` Details How to fix it Give every page a unique <title> that names its topic first and the site second, for example "Returns policy - Acme". Sources WCAG 2.2 2.4.2 Page Titled (opens in a new tab) Level A Approximate Fails a missing or empty <title>. A present title is read by a decisions model (TypeSafe's Jev) with the page's heading and opening, in any language: one it is sure says nothing about the page (a template default, a bare site name on a content page) fails, one it is sure describes the page passes, and anything in between asks for review. Method Reads the HTML, on each page. Accessibility: operable · `wcag-2-4-2-page-titled` Why medium The title is the first thing a screen reader announces and the only label on a browser tab. Without it, a user with several tabs open cannot tell which page is which.	Accessibility: operable · page	Reads the HTML	WCAG 2.2 2.4.2 (opens the primary source in a new tab)
Medium	Focus order preserves meaning and operability`wcag-2-4-3-focus-order` Details How to fix it Ensure tab order follows the visual order. Remove positive tabindex values, which override source order and are almost always the cause. Sources WCAG 2.2 2.4.3 Focus Order (opens in a new tab) Level A Approximate A browser presses Tab through the page and records each stop with its label and where it sits on the page. A decisions model (TypeSafe's Jev) says whether that order follows a meaningful sequence; it fails only when sure it does not, and anything in between is reported for review. Dialogs and other widgets that move focus deliberately are judged from the order alone, not from what the page intends. Method Clicks through the page, on each page. Accessibility: operable · `wcag-2-4-3-focus-order` Why medium A scrambled focus order makes a form or navigation unusable even though every control technically works.	Accessibility: operable · page	Clicks through the page	WCAG 2.2 2.4.3 (opens the primary source in a new tab)
Medium	Link text describes where the link goes`wcag-2-4-4-link-purpose` Details How to fix it Write link text that names the destination ("Read the returns policy"), or give generic links an aria-label that does. Every link needs some accessible name. Sources WCAG 2.2 2.4.4 Link Purpose (In Context) (opens in a new tab) Level A Approximate Fails links with no accessible name. Every link label is read by a decisions model (TypeSafe's Jev), in any language, for whether it says where it goes on its own. A generic one is then read again with the words 2.4.4 lets supply its purpose (its sentence, list item or table cell, and the heading before it): it fails at 80% sure those words do not say where it goes, and asks for review between that and 70% sure they do. Context supplied only by aria-describedby or the page's layout is not read. Method Reads the HTML, on each page. Accessibility: operable · `wcag-2-4-4-link-purpose` Why medium Screen-reader users navigate by pulling up a list of links. A list of "Read more, Read more, Click here" tells them nothing.	Accessibility: operable · page	Reads the HTML	WCAG 2.2 2.4.4 (opens the primary source in a new tab)
Medium	Headings and labels describe their topic or purpose`wcag-2-4-6-headings-and-labels` Details How to fix it Rewrite headings to name the section's content and labels to name exactly what to enter ("Email for your receipt", not "Input 1"). Sources WCAG 2.2 2.4.6 Headings and Labels (opens in a new tab) Level AA Approximate Every heading and every form field label on the page is read by a decisions model (TypeSafe's Jev), in any language, for whether it tells a reader what its section covers or what to enter. A name fails only when the model is sure it does not; one it is unsure of is reported for review. Headings and labels that are empty are found by axe-core instead, and a label drawn only by an image is not read. A scan reads up to 2500 distinct texts; a page holding one past that is reported as not read, never as clear. Method Reads the HTML, on each page. Accessibility: operable · `wcag-2-4-6-headings-and-labels` Why medium Screen-reader users skim a page by its headings and fill forms by their labels. Vague ones force them to read everything to find anything.	Accessibility: operable · page	Reads the HTML	WCAG 2.2 2.4.6 (opens the primary source in a new tab)
Medium	Multipoint and path gestures have a single-pointer alternative`wcag-2-5-1-pointer-gestures` Details How to fix it Pair every pinch, multi-finger or swipe gesture with buttons that do the same thing with a single tap, such as zoom buttons on a map or previous and next arrows on a carousel. Sources WCAG 2.2 2.5.1 Pointer Gestures (opens in a new tab) Level A Approximate The page's own touch and pointer-move handlers are recorded as it loads, and up to eight elements that have them (plus known carousel and map libraries, canvases and elements with a touch-action) get a real one-finger swipe and a two-finger pinch at their centre through the browser's touch input; one covered at its centre by something else (a canvas drawn behind a hero's text) is left out, since the gesture would land on what covers it. Where the widget responds (its text, address or pixels change), the buttons and links in or beside it are put to a decisions model (TypeSafe's Jev) for whether one does the same with a click, such as next and previous or zoom in and out: none, with 80% certainty, fails. Handlers attached to the document itself, widgets that respond only to a longer gesture, and a gesture the page reads from raw coordinates without changing anything visible are not found. Method Clicks through the page, on each page. Accessibility: operable · `wcag-2-5-1-pointer-gestures` Why medium Users with a head pointer, mouth stick or tremor cannot pinch or swipe along a path. If that is the only way, the function is unavailable to them.	Accessibility: operable · page	Clicks through the page	WCAG 2.2 2.5.1 (opens the primary source in a new tab)
Medium	Accessible name contains the visible label`wcag-2-5-3-label-in-name` Details How to fix it Make the accessible name start with, or at least contain, the control's visible text. An aria-label that replaces the visible wording is the usual cause. Sources WCAG 2.2 2.5.3 Label in Name (opens in a new tab) Level A Approximate For up to 400 visible links, buttons and fields, the text a person can see on the control (hidden, clipped and off-screen text left out; a field's own label) is compared with the accessible name Chromium computes for it, ignoring case, punctuation and spacing. A name that does not contain the visible words fails. A label drawn only by an image or an icon font has no text to compare, and a control past the first 400 is not compared. axe-core's experimental label-content-name-mismatch is folded in. Method Loads the page in a browser, on each page. Accessibility: robust · `wcag-2-5-3-label-in-name` Why medium Voice-control users speak the visible label; if it is not in the accessible name, the command silently fails.	Accessibility: robust · page	Loads the page in a browser	WCAG 2.2 2.5.3 (opens the primary source in a new tab)
Medium	Dragging has a single-pointer alternative`wcag-2-5-7-dragging-movements` Details How to fix it Provide a click or tap alternative for every drag: arrow buttons to reorder lists, clickable positions on sliders, a file picker beside a drop zone. Sources WCAG 2.2 2.5.7 Dragging Movements (opens in a new tab) Level AA Approximate The page's drag handlers are recorded as it loads. Draggable elements with a dragstart handler, drop zones, and custom sliders are listed without anything being dragged. A native range input passes; a custom slider passes if clicking along its track moves it; a drop zone passes if a file input sits beside it. Otherwise the buttons and links in or beside it are put to a decisions model (TypeSafe's Jev) for whether one does the same with clicks (move up or down, step a value, choose a file): none, with 80% certainty, fails. Dragging done with raw pointer events and no drag handler or slider role is not found. Method Clicks through the page, on each page. Accessibility: operable · `wcag-2-5-7-dragging-movements` Why medium Users who cannot hold a button down while moving cannot drag. A slider, sortable list or upload area that only accepts dragging locks them out.	Accessibility: operable · page	Clicks through the page	WCAG 2.2 2.5.7 (opens the primary source in a new tab)
Medium	Pointer targets are large enough`wcag-2-5-8-target-size` Details How to fix it Give interactive targets at least 24 by 24 CSS pixels, or provide equivalent spacing so that a 24-pixel circle centred on each target does not overlap another target. Sources WCAG 2.2 2.5.8 Target Size (Minimum) (opens in a new tab) Level AA Approximate Delegated to axe-core's target-size rule, which measures rendered boxes. The spacing alternative is not machine-checked and needs a manual pass. Method Loads the page in a browser, on each page. Accessibility: operable · `wcag-2-5-8-target-size` Why medium Small targets are hard to hit for users with tremor or limited dexterity and are a frequent complaint subject.	Accessibility: operable · page	Loads the page in a browser	WCAG 2.2 2.5.8 (opens the primary source in a new tab)
Medium	Passages in another language are marked with their language`wcag-3-1-2-language-of-parts` Details How to fix it Wrap each passage in a different language in an element with a valid lang attribute, for example <span lang="fr">. Proper names and words that have entered the surrounding language are exempt. Sources WCAG 2.2 3.1.2 Language of Parts (opens in a new tab) Level AA Approximate axe-core's valid-lang fails lang attributes that are not real language codes. The page's blocks of text (up to 300 distinct ones per scan) are each read by a decisions model (TypeSafe's Jev) for whether they are in the language the page declares; a passage in another language with no lang attribute fails at 80% or more, and so does one whose lang attribute names a language it is not written in. Proper names, brands, technical terms and single borrowed words are exempt, as WCAG exempts them. A page with no declared language has nothing to compare against (see 3.1.1). Method Loads the page in a browser, on each page. Accessibility: understandable · `wcag-3-1-2-language-of-parts` Why medium A screen reader reads a French quotation on an English page with English pronunciation, which is often unintelligible.	Accessibility: understandable · page	Loads the page in a browser	WCAG 2.2 3.1.2 (opens the primary source in a new tab)
Medium	Focusing an element does not change context`wcag-3-2-1-on-focus` Details How to fix it Only change context on an explicit action such as click, Enter or a submit button, never on focus. Sources WCAG 2.2 3.2.1 On Focus (opens in a new tab) Level A Approximate A browser presses Tab through the page, doing nothing else, and watches for the page navigating or opening a window. Either one is caused by focus alone. A focus handler that opens an in-page dialog, submits nothing visible or moves focus elsewhere is not detected, and a stop is not checked until Tab lands on it. Method Clicks through the page, on each page. Accessibility: understandable · `wcag-3-2-1-on-focus` Why medium A keyboard user tabbing through a page cannot avoid focusing each control. If focus alone submits a form or opens a new page, they lose their place.	Accessibility: understandable · page	Clicks through the page	WCAG 2.2 3.2.1 (opens the primary source in a new tab)
Medium	Changing a setting does not unexpectedly change context`wcag-3-2-2-on-input` Details How to fix it Pair selects, radio groups and checkboxes with an explicit Go or Apply button, or warn the user before the control in text that changing it will take effect immediately. Sources WCAG 2.2 3.2.2 On Input (opens in a new tab) Level A Approximate Up to 12 selects, radio buttons, checkboxes and sliders outside sign-in and payment forms are changed in a browser that stops every navigation and write, and the page is watched for an attempt to load another page, open a window, submit a form, open a dialog or move focus. When one does, the text around the control is read by a decisions model (TypeSafe's Jev) for a warning beforehand: no warning, with 80% certainty, fails. Text fields are not changed, controls beyond the first 12 are not tried, and the value is set by script (the same change and input events a keyboard or pointer fires), so a handler that tests for a trusted event is not triggered. Method Clicks through the page, on each page. Accessibility: understandable · `wcag-3-2-2-on-input` Why medium A select menu that navigates as soon as the value changes sends a keyboard user away while they are still arrowing through the options.	Accessibility: understandable · page	Clicks through the page	WCAG 2.2 3.2.2 (opens the primary source in a new tab)
Medium	Error messages suggest how to fix the input`wcag-3-3-3-error-suggestion` Details How to fix it When validation fails and the fix is known, say it in the error: "Enter the date as DD/MM/YYYY", "Password needs at least 12 characters". Do not do so where it would weaken security. Sources WCAG 2.2 3.3.3 Error Suggestion (opens in a new tab) Level AA Approximate Up to four forms per page are submitted empty and then with a wrong value (an email without an @, letters in a phone number) in a browser that stops every write, so the messages seen are the ones the page's scripts and the browser's validation show before anything would be sent. A form whose only field is an email address is sent once, to its own site, with a value that is not an address. Forms with a password, a payment card or a file are never submitted. A form made only of selects and checkboxes with nothing required cannot be filled in wrongly and is not applicable. Each message that appears is read by a decisions model (TypeSafe's Jev) for whether it says what is wrong or what to enter; one that only says something failed, with 80% certainty, fails. A message the browser itself writes is accepted. A form that is checked only by its server shows nothing, and is reported for review with that reason. Method Clicks through the page, on each page. Accessibility: understandable · `wcag-3-3-3-error-suggestion` Why medium Telling a user only that a field is 'invalid' leaves people with cognitive or visual disabilities guessing, and many abandon the form.	Accessibility: understandable · page	Clicks through the page	WCAG 2.2 3.3.3 (opens the primary source in a new tab)
Medium	Information already entered is not asked for again`wcag-3-3-7-redundant-entry` Details How to fix it Prefill or offer to reuse information the user already gave in the same process (a 'billing same as shipping' option, a carried-forward email), except where re-entry is essential such as confirming a new password. Sources WCAG 2.2 3.3.7 Redundant Entry (opens in a new tab) Level A Approximate Each form's fields are read in order by a decisions model (TypeSafe's Jev) for any that ask again for something an earlier field of the same form already asked (a confirm-email box, a second copy of an address) without a checkbox offering to reuse it; 80% or more fails. A password confirmation is exempt. Repetition across the steps of a process is not visible without completing a step, which the scan never does, so a page that is one step of a multi-step process and repeats nothing within itself is reported for review with that reason. Method Reads the HTML, on each page. Accessibility: understandable · `wcag-3-3-7-redundant-entry` Why medium Re-entering an address or account number is error-prone and tiring for users with memory or motor impairments, and a frequent reason they abandon multi-step forms.	Accessibility: understandable · page	Reads the HTML	WCAG 2.2 3.3.7 (opens the primary source in a new tab)
Medium	Frames have an accessible name`wcag-4-1-2-iframe-title` Details How to fix it Add a title attribute to every iframe that describes its contents. Sources WCAG 2.2 4.1.2 Name, Role, Value (opens in a new tab) Level A Method Reads the HTML, on each page. Accessibility: perceivable · `wcag-4-1-2-iframe-title` Why medium An unnamed frame is announced only as "frame", leaving the user unable to tell what is inside it.	Accessibility: perceivable · page	Reads the HTML	WCAG 2.2 4.1.2 (opens the primary source in a new tab)
Medium	ARIA roles are valid`wcag-4-1-2-valid-role` Details How to fix it Correct the role value to one defined in the ARIA specification, or remove it and rely on native HTML semantics. Sources WCAG 2.2 4.1.2 Name, Role, Value (opens in a new tab) Level A Method Reads the HTML, on each page. Accessibility: robust · `wcag-4-1-2-valid-role` Why medium An unrecognised role is ignored by assistive technology, so the intended semantics are lost.	Accessibility: robust · page	Reads the HTML	WCAG 2.2 4.1.2 (opens the primary source in a new tab)
Low	The accessibility statement says what it should`legal-accessibility-statement-content` Details How to fix it Name the standard being followed (for example WCAG 2.2 AA), state the conformance status and known gaps, give a way to report a barrier, and commit to a response time. Sources 42 U.S.C. § 12182(b)(2)(A)(ii) (opens in a new tab) Statute · US · reviewed Oct 5, 2026 · Title III effective communication and reasonable modification duties. Survives any technical conformance claim. Guidance on Web Accessibility and the ADA (March 18, 2022) (opens in a new tab) Guidance · US (Title III) · reviewed Oct 5, 2026 · Carries its own disclaimer that it has no force or effect of law. Cited to document the agency's position, not as an obligation. Approximate TypeSafe's Jev decides whether each element is present, with a verbatim sentence as evidence; anything uncertain, or a statement the model couldn't read, asks for review. Method Reads the HTML, on each page. Legal pages · `legal-accessibility-statement-content` Why low A statement that exists but names no standard, hides known gaps, or gives no way to report a barrier does little of what a consent decree asks of it.	Legal pages · page	Reads the HTML	42 U.S.C. § 12182(b)(2)(A)(ii) (opens the primary source in a new tab) Guidance on Web Accessibility and the ADA (March 18, 2022) (opens the primary source in a new tab) Sources reviewed Oct 5, 2026
Low	Privacy policy states when it was last updated`legal-privacy-policy-dated` Details How to fix it State the date the policy was last updated near the top of the document. Sources Cal. Civ. Code § 1798.130(a)(1)-(3), (a)(5) (opens in a new tab) Statute · US-California · reviewed Oct 5, 2026 Approximate A decisions model reads the policy for a last-updated or effective date in any format or language, and a quote of it is kept only when it is verbatim in the text. Method Reads the HTML, on each page. Privacy disclosure · `legal-privacy-policy-dated` Why low The CPRA requires the date the policy was last updated, and an undated policy makes it impossible to show what a consumer agreed to.	Privacy disclosure · page	Reads the HTML	Cal. Civ. Code § 1798.130(a)(1)-(3), (a)(5) (opens the primary source in a new tab) Sources reviewed Oct 5, 2026
Low	Pages can be found in more than one way`wcag-2-4-5-multiple-ways` Details How to fix it Offer at least two of: site navigation, a search function, an HTML site map, or a table of contents linking every page. Sources WCAG 2.2 2.4.5 Multiple Ways (opens in a new tab) Level AA Approximate Looks on the homepage for navigation (a navigation landmark, or three or more links in its header or navigation), search (a search input, landmark or form, or a link or button the decisions model reads as search) and a link it reads as a site map. Two of those is accepted as two ways without verifying that each reaches every page. A second way offered on any sampled layout of the site (a search, site map, index, or a page listing a section or the whole site, read by the decisions model from the link labels) completes a homepage that offers one. A site of one page is not applicable. With one way and a complete crawl, whose homepage links were all read, it fails; a truncated crawl or unread links ask for review. Pages that are steps in a process are not exempted. Method Reads the HTML, once for the whole site. Accessibility: operable · `wcag-2-4-5-multiple-ways` Why low Users who cannot use one navigation method, such as a deep menu, need another, such as search or a site map. The cost of missing one is friction rather than exclusion.	Accessibility: operable · site	Reads the HTML	WCAG 2.2 2.4.5 (opens the primary source in a new tab)
Low	Actions fire on release, not on press`wcag-2-5-2-pointer-cancellation` Details How to fix it Trigger actions on click or pointerup rather than mousedown, touchstart or pointerdown, so moving off the target before releasing cancels it. Sources WCAG 2.2 2.5.2 Pointer Cancellation (opens in a new tab) Level A Approximate Up to 30 on-screen buttons, links and elements the page attached press handlers to are hovered, then pressed with the pointer held down and released somewhere else. A control whose press changes the address, opens a window or dialog, opens or closes a menu, or changes the page's text before release fails. Focus moving is the browser's own and is ignored, as are writes, which are blocked. Controls beyond the first 30 and controls hidden until another is used are not pressed; an action on press that is essential (a keyboard on screen, a game) is not exempted. Method Clicks through the page, on each page. Accessibility: operable · `wcag-2-5-2-pointer-cancellation` Why low Acting on the down-event removes the chance to slide off a mistaken press, which users with motor impairments rely on.	Accessibility: operable · page	Clicks through the page	WCAG 2.2 2.5.2 (opens the primary source in a new tab)
Low	Motion-triggered functions have a control and can be disabled`wcag-2-5-4-motion-actuation` Details How to fix it Provide an on-screen control for anything triggered by shaking, tilting or moving the device, and a setting to turn motion response off. Sources WCAG 2.2 2.5.4 Motion Actuation (opens in a new tab) Level A Approximate The page's device motion and orientation handlers (and any Accelerometer or Gyroscope sensor it creates) are recorded as it loads. With none, the criterion does not apply. With some, a series of strong shakes and tilts is dispatched to it and its text, address and dialogs are compared. A page that does not react passes; one that does is reported for review, because whether the same function is on a visible control and whether motion can be switched off is in the application's own settings. Listeners added after a user action, or by a script that waits for a permission prompt, are not found. Method Clicks through the page, on each page. Accessibility: operable · `wcag-2-5-4-motion-actuation` Why low A user whose device is mounted, or who has tremors, cannot shake or tilt it deliberately, and may trigger the function by accident.	Accessibility: operable · page	Clicks through the page	WCAG 2.2 2.5.4 (opens the primary source in a new tab)
Low	Repeated navigation appears in the same order on every page`wcag-3-2-3-consistent-navigation` Details How to fix it Render the header, main menu and footer from shared templates so their items keep the same relative order on every page. Sources WCAG 2.2 3.2.3 Consistent Navigation (opens in a new tab) Level AA Approximate One page of each distinct layout is sampled (up to 60), and the links in each header, navigation and footer are lined up by destination. A breadcrumb trail (marked up as one, or made only of the page's own ancestors beside its current entry) is page-specific and is left out. Links shared by two or more pages must keep their relative order. Navigation that only appears in a page's body copy, or a menu opened by script that the fetched markup does not contain, is not seen. Method Reads the HTML, once for the whole site. Accessibility: understandable · `wcag-3-2-3-consistent-navigation` Why low Users with low vision or cognitive disabilities learn where navigation is. Reordering it between pages makes them relearn it each time.	Accessibility: understandable · site	Reads the HTML	WCAG 2.2 3.2.3 (opens the primary source in a new tab)
Low	Components with the same function are identified the same way`wcag-3-2-4-consistent-identification` Details How to fix it Use the same label, icon and alt text for the same function everywhere it appears: search, cart, account, download, and so on. Sources WCAG 2.2 3.2.4 Consistent Identification (opens in a new tab) Level AA Approximate Compares the accessible names (visible text, aria-label, icon alt text) of the links in each sampled layout's header, navigation, footer and sidebar, and of its search controls. A destination that goes by different names on different pages is put to a decisions model (TypeSafe's Jev), which says whether the names identify one function. Controls elsewhere on a page, and icons with no accessible name, are not compared. Method Reads the HTML, once for the whole site. Accessibility: understandable · `wcag-3-2-4-consistent-identification` Why low A search button labelled 'Search' on one page and 'Find' on another makes a screen-reader user wonder whether it is the same function.	Accessibility: understandable · site	Reads the HTML	WCAG 2.2 3.2.4 (opens the primary source in a new tab)
Low	Help is consistent across pages`wcag-3-2-6-consistent-help` Details How to fix it Place help in the same relative order on every page of the site. Sources WCAG 2.2 3.2.6 Consistent Help (opens in a new tab) Level A Approximate One page of each distinct layout is sampled (up to 60). A decisions model (TypeSafe's Jev) says, in any language, which links and controls in the header, navigation, footer and sidebar are a way to get help; each is then compared with every item it shares a page with. Help placed only in a page's body copy is not seen. Method Reads the HTML, once for the whole site. Accessibility: understandable · `wcag-3-2-6-consistent-help` Why low Moving help between pages makes it harder to find, and inconsistency compounds across a large site.	Accessibility: understandable · site	Reads the HTML	WCAG 2.2 3.2.6 (opens the primary source in a new tab)