What a website accessibility audit actually includes

Published October 2026 · All Reach Audit

"Accessibility audit" can mean anything from a free automated scan to weeks of expert testing. Here's what a real audit of a small business website should include, so you can compare offers and know what you're paying for.

1. Agreeing on scope

A good audit starts by naming exactly what will be tested: which pages or page templates (home, menu or collection, product, about, contact), which customer journeys (browse to cart, start an online order, make a reservation), and which standard. In the US, the most commonly referenced technical standard is the W3C's Web Content Accessibility Guidelines (WCAG) 2.1, Level AA. The W3C publishes a methodology for this kind of evaluation, WCAG-EM, which centers on defining scope and picking a representative sample of pages.

2. Automated scanning

Software checks each in-scope page for problems a machine can detect reliably: missing alt text, low contrast, unlabeled form fields, buttons with no name, missing page language. It's fast and consistent, and it's a good way to find repeated template problems.

It's also limited. Deque, the company behind the widely used open-source axe-core engine, reported that automated tests found about 57% of issues by volume in its first-time audits, and only covered 16 of the 50 WCAG 2.1 A/AA success criteria (Deque coverage report). WebAIM puts it bluntly: "Absence of detected errors does not indicate that a page is accessible or conformant" (WebAIM Million 2026).

3. Manual testing by a person

This is the part that separates an audit from a scan. A tester uses the site the way disabled customers do:

Keyboard only: can you reach and use every menu, button, pop-up and form with Tab, Enter, Space and Escape? Is there always a visible focus outline? Does focus get trapped anywhere? (WebAIM keyboard guide)
Screen reader: with VoiceOver on Mac or iPhone, or NVDA on Windows, are headings, images, prices, product options, cart updates and error messages announced sensibly?
Zoom and reflow: does the page still work at 200% and 400% zoom without content overlapping or getting cut off?
Judgment calls: is the alt text actually useful? Do link names make sense? Are error messages clear?
Third-party pieces: ordering, reservation and review widgets get tested in the flows customers actually use, even though the vendor may have to fix them.

The W3C's Easy Checks page is a good way to try a few of these yourself.

4. The report

A useful report is written for the people who'll fix things. It should include:

A short summary with priorities: what to fix first and why
Each issue tied to a WCAG criterion, with severity, where it occurs and how many times
A plain-English explanation of who it affects
A concrete fix, ideally with example code
A clear statement of what was and wasn't tested

5. Fixes and re-testing

An audit is only worth something if things get fixed. Ask whether re-testing is included after you or your developer make changes, and whether the auditor can do the fixes. Because sites change constantly with new products, apps and theme updates, ongoing monitoring helps keep problems from piling back up.

Red flags

"Guaranteed compliance", "ADA certified" or "lawsuit-proof" claims. No audit or tool can guarantee legal compliance.
An "audit" that's only an automated scan, with no manual testing.
A fix that's only an overlay widget (see what the FTC's 2025 order means for overlays).
No defined scope, so you can't tell what was actually tested.

What our audits include

Our small-site audit covers up to 25 pages or templates against WCAG 2.1 AA. It includes automated scanning plus manual keyboard, screen-reader and zoom testing, a prioritized report with code fixes, a draft accessibility statement, a walkthrough call and one re-test within 60 days, for $1,500. See all services and prices.

Sources

Want to know where your site stands?

Send us your website address and we'll email you a free preliminary scan of a few public pages.

Request a free scan