Accessibility Testing (WCAG 2.1) Isn't Optional Anymore: A Practical Compliance Checklist
Automated scanners catch roughly a third of real accessibility issues. Here's the manual testing checklist that catches the rest, and why enterprise procurement now requires it.
Accessibility Has Moved From 'Nice to Have' to Legal and Commercial Risk
Web accessibility lawsuits under ADA and equivalent international regulations have risen sharply, and procurement teams at larger enterprises increasingly require WCAG 2.1 AA conformance as a vendor requirement before they'll sign a contract at all. Treating accessibility as a post-launch nice-to-have now carries direct legal exposure and closes off enterprise sales, not just a smaller potential user base.
Automated Scanning Catches Roughly a Third of Real Issues
Tools like Axe or Lighthouse's accessibility audit reliably catch missing alt text, insufficient color contrast, and missing form labels: objective, programmatically detectable violations. What they structurally cannot catch: whether a screen reader's reading order actually makes logical sense, whether a custom component is genuinely operable by keyboard alone, or whether an interactive widget's ARIA implementation matches its actual behavior. Automated scanning is a floor, not a compliance certification.
The Manual Testing That Actually Matters
Keyboard-only navigation through every interactive flow (can you complete checkout, login, and form submission using only Tab, Enter, and arrow keys), screen reader testing with actual assistive technology (NVDA, JAWS, or VoiceOver, not just automated ARIA validation), and testing at 200% browser zoom for low-vision users are the checks that catch what automated tools miss, and where the majority of genuine usability failures for disabled users actually live.
Building It Into the Development Workflow, Not a Pre-Launch Audit
A one-time accessibility audit before launch catches a snapshot; new features ship without the same scrutiny within weeks unless the practice is embedded. We integrate automated accessibility linting into CI (failing the build on new critical violations) and require keyboard-navigation verification as part of pull request review for any new interactive component: the same discipline as functional code review.
The Practical Checklist We Run Against Every Engagement
Semantic HTML before ARIA (native elements are accessible by default; ARIA is a patch for when semantic HTML genuinely can't express the interaction), sufficient color contrast ratios verified programmatically, full keyboard operability with visible focus indicators, meaningful alt text (not filename-derived placeholder text), and correctly associated form labels and error messages. Covering these five consistently resolves the large majority of real-world WCAG 2.1 AA findings.
Frequently asked questions
How do I test a website for WCAG 2.1 compliance?
Use three kinds of check. Run an automated scanner to catch the easy failures such as missing alt text, low contrast and unlabelled form fields. Then go through the key pages with the keyboard only, checking focus order and visible focus. Finally, use a screen reader on the main journeys, such as sign-up and checkout. Scanners find only part of the problems, so the manual steps matter. Record each failure against the WCAG success criterion it breaks, and retest after the fixes.
What is new in WCAG 2.2 compared with 2.1?
WCAG 2.2 keeps the 2.1 rules and adds nine success criteria. They cover things like keeping the focused element visible, the size of click targets, dragging alternatives, not asking people to re-enter information, and sign-in methods that do not rely on remembering or retyping a password. Testing against 2.2 is the safer target for a new project.
Need Expert Technology Implementation?
Our team builds websites, custom software and blockchain systems, tests web apps and APIs, and runs hosting, SEO and AI data work. Tell us what you are planning.
Related service: Web Application Testing
Related Technical Insights
Deep dives into cloud SaaS, AI data, and cybersecurity.