How the scanner works, and where it stops

Most accessibility tools oversell what they can detect. This page is the opposite of that.

What it does

The scanner requests one page exactly as a browser would, reads the HTML your server returns, and runs a set of structural checks against it. Nothing is executed, nothing is stored on your site, and no login is required or accepted. A scan normally takes two to four seconds.

What it checks

Roughly twenty checks, all mapped to specific WCAG 2.1 success criteria, covering:

• Images with no alternative text, and alt text that carries no information
• Links and buttons with no accessible name — the icon-only cart, search and social controls
• Form fields with no label, including the placeholder-instead-of-label pattern
• Missing document language, missing page title, untitled frames
• Pinch-to-zoom disabled on mobile
• Duplicate ids, broken ARIA references, invalid roles, content hidden from screen readers but still focusable
• Heading structure, missing main landmark, missing skip link
• Data tables with no header cells, positive tabindex, autoplaying audio, video with no captions

What it cannot check, and why

Automated testing catches somewhere around half of WCAG failures. Static analysis of served HTML — which is what this is — catches less than a full browser-driven tool would. The honest list:

• Colour contrast. The most common failure on the web, affecting 83.9% of home pages. Deciding it needs the page rendered with all of its CSS. Chrome's built-in Lighthouse audit and the free WAVE extension both do this well — please go and run one.
• Keyboard operation. Traps, unreachable menus, invisible focus. You can test the important part yourself in five minutes: put the mouse away and try to complete a purchase using only Tab, Enter and the arrow keys.
• Anything JavaScript builds after load. Cart drawers, modals, cookie banners, single-page app views. If your site is client-rendered, the scan will say so on the report rather than quietly reporting a clean result.
• Whether it is actually usable. Reading order, announcement quality, whether a form's error handling makes sense. These are human judgements and always will be.

You can read the code

The check engine is open source under an MIT licence: github.com/bol-ship-it/stepless-scanner. Every claim this scanner makes about your site comes from src/checks.js. If you think a check is wrong, you can see exactly what it does and say so.

That is not generosity, it is the only consistent position. We spend a page arguing that you should not trust a black box that promises to fix your accessibility problems. It would be strange to then ask you to trust a black box that promises to find them.

Why there is no score

A single number implies a threshold, and a threshold implies that passing it means something legally or practically. Neither is true. A page can score highly on every automated tool and still be impossible to check out on with a screen reader. Scores are what got the overlay industry into trouble; we report findings and gaps instead.

On overlay widgets

An overlay is a script that loads on your page and attempts to patch accessibility problems in the visitor's browser. They are heavily marketed on the promise of instant compliance. In practice the underlying markup is unchanged, many disabled users report that overlays actively interfere with the assistive technology they already use, and businesses running them have still been sued. The scanner detects the major vendors and reports what remains broken underneath.

This is not a claim that any particular vendor is unlawful or fraudulent. It is a statement about what the technology can and cannot do: a script running in the browser cannot fix markup that was never sent, and it cannot make a judgement about whether alt text is meaningful.

Being polite to your server

One request per scan, identified as SteplessScanner/1.0, with a 15 second timeout and a 3 MB read limit. Scans are rate limited per visitor. If your host blocks non-browser requests you will get a clear error saying so rather than a misleading clean report.

Run a free scan