Scanning one page is not an accessibility audit: how to scope an audit of a single flow

A clean scan is not a pass

An automated accessibility scanner finds some real problems, such as poor colour contrast, controls with no label and duplicate identifiers. Playwright's accessibility testing page says it plainly: automated checks can detect some common problems, and many accessibility problems can only be discovered through manual testing. W3C's guidance says the same thing at a higher level: no tool alone can determine whether a site meets accessibility standards, and knowledgeable human evaluation is required. So a scan with no findings tells you the scanner found nothing it knows how to find. It does not tell you that a person using only a keyboard can complete your checkout.

• Use scanners as one input and keep their output with the report.
• Never describe a clean scan as accessible or compliant.

Scope by flow, not by page

W3C's explanation of conformance says that conformance applies to whole pages, and that when a page is a step in a multi-step process, all the pages in the process must conform at the level for any of them to claim it. For a shop, that means everything from choosing a product through to payment. An audit that tests only the checkout page can say something true about that page and nothing about whether a customer can reach it. Choose the journey that matters most, list every page and state in it, including error states, and test each. If the journey is large, split it into separate flows with their own lists instead of sampling.

• List each page and each state, such as validation errors and confirmation screens, before testing starts.
• Test with a test account and test-mode payment, never with real customer data.

What to check by hand

W3C's Easy Checks give a first set of manual tests: a descriptive page title, text alternatives for images, headings that are real headings, contrast of at least 4.5 to 1 for normal text, text that can be enlarged to 200 percent without losing content, keyboard access with a visible focus, labelled form controls with clear errors, control over moving content and alternatives for multimedia. The page itself warns that these cover just a few issues and a page could seem to pass them and still have significant barriers. WCAG 2.2 adds Level A and AA criteria that matter in flows: Focus Not Obscured (Minimum), Target Size (Minimum), Dragging Movements, Accessible Authentication (Minimum), Redundant Entry and Consistent Help. It also added three AAA criteria, which the audit job does not cover, and removed 4.1.1 Parsing.

• Complete the whole flow with the keyboard alone and note where focus is lost or a control cannot be reached.
• Check every step against the criteria new in 2.2, including Redundant Entry and Accessible Authentication (Minimum), reading their exact wording in the specification rather than relying on their names.

State what you tested, and how the paid job is accepted

A conformance claim in W3C's terms has a defined scope and cannot exclude part of a page or claim a level the content does not fully meet. That is a formal statement, and it is a different thing from a list of barriers. The audit job produces the list: one flow of up to eight pages or states, tested against the applicable WCAG 2.2 A and AA criteria with scans, keyboard use, text resized to 200 percent and one agreed screen reader and browser pairing. The report carries a criteria matrix, a method statement naming browsers, assistive technologies and dates, and a first-fixes list. The matrix marks each criterion as barrier found, no barrier found in the tested conditions, not applicable or not tested; it never says pass, because an audit finds barriers and does not certify conformance. The report states on its first page that it is not a conformance statement, certification or legal opinion and that it describes only the tested conditions. Acceptance includes your developer reproducing three findings of their choice (or every finding, if there are fewer than three) from the written steps alone. Send the flow and a test address; do not send passwords or customer data.