WCAG audit services for websites and web apps

A website accessibility audit that tells you where your site or web application fails WCAG, which of your findings a reviewer will look at first, and what to fix. Manual testing, a named conformance target agreed before we start, and every issue tied to the criterion it fails.

What an accessibility audit from us includes

The same work is requested under several names: a website accessibility audit, a digital accessibility audit, an ADA compliance audit, WCAG compliance testing. It is one engagement with six outputs, and most teams arrive because a buyer, a lawyer or a deadline asked a question they cannot yet answer with evidence.

Manual expert testing

A person works through your site with a keyboard and a screen reader, on the flows that carry your revenue, because the questions that decide conformance are judgement calls a scanner cannot make.

Assistive technology coverage

JAWS, NVDA and VoiceOver, keyboard-only operation, and magnification, run against the pages and components we agreed in scope.

Findings mapped to criteria

Every issue is tied to the specific WCAG success criterion it fails, with its location and how it was observed, so a developer can reproduce it without a meeting.

A prioritized remediation plan

Ranked by two things: how badly an issue blocks a real user, and how quickly a reviewer will find it.

A report that serves two readers

Detailed enough to become tickets, clear enough for a buyer, a lawyer or a procurement team to read without a translation layer.

A retest that closes findings

After your team ships the fixes we re-check each issue and update its status, which is what turns a list of problems into evidence of resolution.

Which standard your audit is measured against

Procurement forms and legal teams ask for this work under several names, and all of it is measured against a specific version of one standard. Buying against the wrong one is the most expensive mistake in this process, and it happens before any testing starts. The version you are measured against is decided by your obligation, not by preference.

How the version is decided by your obligation

  • State and local government bodies are measured against WCAG 2.1 Level AA under the Department of Justice web rule. The deadline is April 26, 2027 for entities with a total population of 50,000 or more, and April 26, 2028 for those under 50,000 and for special district governments. A school district is not a special district government, so it follows the population of the jurisdiction it serves. These dates come from the interim final rule published on April 20, 2026, and we check them against ada.gov before every engagement.
  • Section 508 binds federal agencies, not their suppliers directly. You inherit it through the contract and through FAR Subpart 39.2, and what it points at is WCAG 2.0 Level A and AA, not 2.1 or 2.2. Read the solicitation before you scope anything: an agency is free to ask for a higher bar, and remediating criteria your contract never named is where budget quietly disappears.
  • Private businesses have no version named for them in US federal law. WCAG is still the benchmark courts and enterprise buyers reach for, and if you sell into the European Union the European Accessibility Act points at EN 301 549, which names WCAG 2.1 Level AA and has applied since June 28, 2025. So the practical question is which version to target, not whether to use one.
  • The versions stack. Content that conforms to WCAG 2.2 also conforms to 2.1 and 2.0, so a newer target generally satisfies an older requirement while the reverse is not true. One exception is worth knowing: WCAG 2.2 removed success criterion 4.1.1 Parsing, so if your contract names 2.0 or 2.1 we still test and report it.

Selling into federal agencies puts you under Section 508 compliance, which is measured against the older WCAG version by design. We confirm which framework applies to you before the engagement starts, so you never buy an audit against the wrong law.

How we scope an audit before testing starts

The W3C publishes an evaluation methodology for WCAG conformance, WCAG-EM. It is a Working Group Note rather than a standard, and it is the closest thing the field has to an agreed procedure. Its first step is not testing. It is three decisions, in writing: the boundary of the product, defined so that for each view it is unambiguous whether it falls inside the evaluation; the conformance level the work is measured to; and the assistive technologies and browsers the result is claimed against.

Read that as a buyer rather than as an engineer. A proposal that names neither is not quotable, not comparable against a second quote, and not defensible later when a reviewer asks what the report actually covered. You cannot score findings against a target nobody named.

So we settle both before anything is tested, and both appear on the front of the report. Ours reads like this: everything under app.example.com, tested to WCAG 2.1 Level AA, with JAWS, NVDA and VoiceOver as the assistive technology baseline.

How coverage is decided, and why it is not a page count

The second thing buyers get wrong is treating coverage as a page count. Sites do not fail evenly across pages. They fail by template, by component, and by flow, which is why twenty instances of the same layout tell you no more than one.

What goes into the sample

  • A sample-based audit tells you what the sample showed, which is why the report states its coverage rather than declaring the whole product conformant. That distinction is the methodology's own, and it is the reason a credible firm will not hand you a compliance certificate. A structured sample that reflects your common views, the essential functionality, the types of pages on the site, and the technologies the product relies on. That is a deliberate spread across what your product is made of, not a walk through the top of the navigation.
  • A further random sample on top of it, sized at ten per cent of the structured selection. It exists to catch what the structured logic missed: if the random pages fail in ways the chosen ones did not, the sample was wrong and the evaluation widens.
  • Complete processes tested end to end. A checkout, an application, an onboarding sequence. If one step in the chain fails, the whole process fails no matter how clean the other screens are.
  • A written statement of what was left out, so nobody has to infer the boundary from the findings.

For a large product this is good news financially. Sampling done properly means you are not paying to test two hundred instances of one template, you are paying for coverage of what is structurally distinct.

What automated accessibility testing cannot decide

Website accessibility testing splits into two halves, and only one of them can be automated. Automated accessibility testing is useful and we run it. It clears the machine-detectable problems fast, and it belongs in your build. The trouble starts when their output is presented as a conformance verdict, which is what a same-day audit usually is.

The W3C is unusually blunt about this for a standards body: some accessibility checks cannot be automated and require manual intervention, tools cannot do it all, and in some cases tools return results that are simply inaccurate. That last part is the one vendors never quote. The problem is not only what a scanner misses, it is what a scanner reports that is not true, and someone has to know enough to overrule it.

Consider what a machine is being asked to judge. Whether alternative text describes the image or names the file. Whether focus order matches the visual order closely enough to follow. Whether an error is announced when it appears and says what to do about it. Whether a custom dropdown built from generic markup can be operated at all without a mouse. Those are questions about meaning and sequence, and no amount of parsing settles them.

Accessibility testing for web applications and SaaS platforms

Most of what we audit is not a brochure site. It is a product: a SaaS platform, a customer portal, an internal dashboard, a booking or claims workflow, an application with roles and permissions. Accessibility behaves differently there, because the interface is assembled at runtime and the barriers live in the parts a crawler never reaches.

A scanner walks pages. A product is not pages, it is states. The failures that matter sit behind a login, inside a multi-step form, in a filter that rewrites results without announcing them, in a modal that traps focus, in a data table that a screen reader reads as a wall of numbers. We test the product the way a person with a disability would actually use it, signed in and working through the flows that carry your revenue.

What we test inside a web application

  • Authenticated areas: account settings, dashboards, admin views, and anything gated behind a login.
  • Multi-step workflows: onboarding, checkout, applications, claims, and booking paths tested end to end rather than screen by screen.
  • Dynamic components: menus, modals, tabs, combo boxes, filters, toasts, and live regions that change without a page load.
  • Data-heavy interfaces: sortable tables, charts, and reporting views where structure decides whether the content is readable at all.
  • Role and permission variants, where the same screen behaves differently depending on who is signed in.

Findings from a product audit map to WCAG the same way, so the same engagement supports an ACR built on the VPAT® template when a buyer asks for one, which for most software vendors is how the question arrives in the first place.

What you receive from a web accessibility audit

  • The scope, written down: which product and version, which templates, components and flows were inside the evaluation, and what was deliberately outside it.
  • The conformance target, stated once at the front, so every finding can be scored against it.
  • Each finding tied to the specific success criterion it fails, not to a loose category like images or forms.
  • Location and evidence for each issue, enough for a developer to reproduce it without asking us.
  • Remediation guidance specific enough to become a ticket, ordered by impact rather than by page.
  • A retest after you ship, updating each finding's status, so the document ends its life as a record of resolution.

Because every finding is criteria-mapped, one audit serves every downstream requirement, whether that is ADA website compliance, an ACR for a buyer, or a federal review, instead of paying for the same testing three times.

How to tell an audit from a scan with a logo on it

  • No named standard or version. WCAG compliant with nothing after it means nobody has decided what is being measured.
  • A page count instead of a sampling rationale. We audit 25 pages answers a question about invoicing, not about coverage.
  • No mention of keyboard or screen reader testing. If the method section lists only tool names, the method is the tool.
  • Findings grouped by theme rather than mapped to criteria. Those cannot be scored, handed to a buyer, or defended.
  • No retest in the scope. A firm that does not want to come back and verify is telling you something about its confidence.
  • A guarantee of compliance. Nobody can promise that outcome, and offering it is the clearest sign the standard is not understood.

You can usually sort this out from the proposal, before any money moves. Our reports are built to survive this checklist, because they are read by procurement reviewers, opposing counsel and enterprise security teams, and none of them are gentle readers.

What an accessibility audit costs and how long it takes

Accessibility testing services are quoted from scope, not from a rate card. We scope the product first, confirm which standard your obligation names, and then quote a fixed number, so you know what is included before testing begins. The price follows the number of distinct templates and flows, the platforms in scope, the conformance target, and whether remediation support and a retest are included.

A focused website accessibility audit of your key journeys is a matter of weeks once access and scope are confirmed. Larger products with multiple roles, dashboards and integrations take longer, particularly when remediation and retesting are part of the engagement. If you are working against a legal deadline, a procurement request or a launch, tell us the date and we will scope the fastest credible path to it.

We are proud of our customers

Common questions about accessibility audits and testing

What do we receive at the end of the audit?
A findings report written for implementation: every issue with its location, the success criterion it fails, severity, steps to reproduce and fix direction. Plus a statement of coverage, naming the templates, components and flows tested, and an executive summary for stakeholders.
What is the difference between a WCAG audit and an automated scan?
An automated scan can identify some accessibility issues, but it cannot determine whether a website or web application is truly usable for people with disabilities. A WCAG audit includes manual testing, keyboard-only testing, screen reader testing, magnification review, and evaluation of real user flows. ADACP uses automated tools as a starting point, but the audit is built around human review and criteria-mapped findings.
Do I need WCAG 2.1 or WCAG 2.2?
It depends on your legal, procurement, or customer requirement. WCAG 2.1 Level AA is specifically referenced in the ADA Title II web and mobile app rule for state and local governments. WCAG 2.2 is the newer W3C recommendation and may be the better target for future-facing accessibility work. ADACP confirms the right standard before testing begins so your audit matches the requirement you are actually facing.
How is scope decided, and do you test every page?
No, and testing every page would waste the budget. We test the templates and reusable components that repeat across the product, plus the journeys that carry the business: sign-in, search, forms, checkout, account. Anything unusual, such as authenticated areas, mobile apps or documents, is agreed during scoping.
Can our developers work straight from the report?
That is what it is written for. Each finding carries the criterion, the location, reproduction steps and fix direction, so a developer can act without first translating an audit into tickets. We can also walk the team through the findings if that speeds things up.
Do you retest after we ship the fixes?
Yes. We re-check the findings, confirm what is resolved, flag anything that regressed, and update your conformance status. Without that step, fixed is an assumption rather than a fact.
Can the same audit support ADA compliance or a VPAT?
Yes, and that is deliberate. Because every finding is mapped to a success criterion, the same evidence feeds ADA compliance work and the ACR behind a VPAT. You do not pay for the same testing three times under three different names.
Do you also make the fixes?
We provide implementation-ready remediation direction and verify the result; the changes are made by your development team. If you need hands-on help, raise it in the consult and we will scope support around your team rather than assume it.
How long does a web accessibility audit take?
Most focused web accessibility audits can be completed in a matter of weeks once access, scope, and testing environments are confirmed. Larger websites, web applications, or products with multiple roles and workflows may take longer, especially if remediation and retesting are included. If you are working against a legal deadline, procurement request, VPAT requirement, or launch date, ADACP can help define the fastest credible path to complete testing and documentation.
How much does a web accessibility audit cost?
The cost of a web accessibility audit depends on the size of the website or web application, the number of templates and user flows, the WCAG version being tested, the platforms in scope, and whether remediation support or retesting is included. A focused audit of key pages and flows will cost less than a complex SaaS platform, enterprise portal, or application with multiple user roles. ADACP scopes the work first and provides a fixed quote so your team knows exactly what is included.
Can you test web applications and SaaS platforms?
Yes. ADACP tests websites, web applications, SaaS platforms, portals, dashboards, forms, and interactive workflows. For web applications, accessibility issues often appear in dynamic components, menus, modals, search tools, filters, account areas, checkout flows, and other paths that automated scans may miss. We test the product the way real users experience it and map findings to WCAG.

Who does this work

David LoPresti

Founder and CEO, ADA Compliance Professionals

David LoPresti founded ADA Compliance Professionals and works directly with software vendors, technology manufacturers, higher education institutions, and government contractors, translating WCAG requirements into practical implementation and verification processes. That is what this engagement delivers: manual and assistive-technology testing of your real user journeys, every finding tied to the success criterion it fails with steps to reproduce it, a remediation plan ranked by user impact, and a retest that records what your team resolved.

Get a clear picture of your website accessibility

Tell us what is driving the audit: a deadline, a complaint, a buyer requirement, or a release you want tested properly, and we will scope it with you on a call.

Schedule a consult (opens in new tab)