Accessibility Record Section 508 & WCAG 2.1 AA

Scan a website

Opens the page in a real browser, checks it the way people with disabilities actually use it, and tells you in plain English what is wrong and what to do about it.

Paste a web address, for example example.gov or https://example.gov/services. For a page that needs signing in, use Test a page that needs signing in below.

Not sure where to start?

More options

Leave this at 1 to test only the address above. Higher numbers follow links to other pages on the same site. Each extra page takes about 10–20 seconds.

How to find those other pages

Following links tests whatever the first page happens to link to, which tends to be the pages a site has already paid attention to. A sitemap is the site’s own list of everything it publishes, so it is usually a fairer sample. If there is no sitemap, links are used instead and the report says so.

What to check
Test a page that needs signing in

Treat what you paste here like a password. It lets anyone who has it act as you on that site. It is used for this one test, is never saved, and never appears in the report or in anything you download.

To test a page only signed-in people can see, this needs the same proof of who you are that your own browser uses. Your browser will hand you the whole thing in one go:

  1. Sign in to the site in your own browser, the way you normally would.
  2. Press F12 to open your browser’s developer tools, then choose the Network tab.
  3. Reload the page. A list appears; the top row is the page itself.
  4. Right-click that top row, choose Copy, then Copy as cURL. Some browsers word it slightly differently, and any of the “as cURL” choices will do.
  5. Paste it in the box below. However long it looks, paste all of it.

You may have seen advice to open the Console and type document.cookie. That will not show the part that keeps you signed in — browsers deliberately hide it from the page — so anything copied that way is missing the one thing this needs.

If that did not work, fill it in by hand

For sites that expect a token rather than a cookie. One per line, as Name: value.

Only for the grey pop-up some sites show before the page loads, not for a normal sign-in form. This is the other site’s password, never the one you use here — if your browser offers to fill it in for you, that is the wrong password.

What this tests, and what it cannot

Automated testing finds roughly a third of accessibility problems. It can tell you an image has no description; it cannot tell you whether the description that is there is any good. It can tell you a form field has no label; it cannot tell you whether the error message a user sees makes sense.

So every test also lists the things that need a person to look at them. They are listed rather than left out, because a report that only shows what a machine can find quietly implies the rest is fine. If you need to make a formal claim — a VPAT or an Accessibility Conformance Report — that list is the work you still owe.

Section 508 and WCAG 2.1 are not the same thing

The 2017 Section 508 Refresh incorporates WCAG 2.0 Level A and AA by reference. WCAG 2.1 added twelve further A/AA criteria — reflow, text spacing, non-text contrast and others — that Section 508 does not require, but that the Department of Justice’s 2024 ADA Title II rule does require of state and local government. Findings are tagged with which obligation they fall under so the two can be tracked separately.