About the scan
What it does, what it cannot do, and how it behaves towards the sites it reads. Published because the scanner names this page in its user agent, so anyone who finds it in their logs can find out what it was.
What it checks
Two things. First, whether an accessibility statement exists and whether it contains what Annex V asks for: how the requirements are met, a way to report a barrier, the enforcement authority, evidence of monitoring, and whether a disproportionate burden is claimed. Second, a small set of markup failures that static HTML answers definitely, such as a missing language attribute or an image with no alt attribute at all.
The statement is found from the links on the page and, failing that, from the conventional addresses used in the page's own language.
What it cannot check
Colour contrast, keyboard operation, focus visibility and reflow at 320 pixels all need a rendered page with its stylesheets applied, and this reads the HTML your server returns. Those criteria are named in every report so that their absence is not read as a pass.
If a site is drawn by JavaScript, the markup checks examined a shell. The report says so rather than reporting a clean result it has not earned.
Blocked is not the same as absent
Bot protection at large retailers frequently fingerprints the connection rather than the user agent, so an ordinary request is refused where a browser succeeds. When that happens the report says we could not tell, never that no statement exists. Reporting a refusal as an absence would be an accusation the scan cannot support.
How it behaves
- One page, plus at most five further requests to find a statement.
- Eight-second timeout per request, two megabyte cap per response.
- Identifies itself in the user agent, with a link to this page.
- Refuses private and reserved addresses, so it cannot be used to reach something inside a network it should not.
- Reads only. It submits no forms and follows no action.