Reviewed October 22, 2026

What a website accessibility audit actually covers

Stores commission audits expecting a verdict and receive a spreadsheet of issues they cannot prioritize. Knowing what an audit examines, automated scans versus manual testing, and what the deliverable should look like makes the purchase far more useful.

Two audits wearing one name

Most accessibility audits combine two very different methods. Automated scanning runs software across your pages and catches the mechanical failures: missing alt text, empty links and buttons, contrast violations, missing form labels, broken heading structure. Good tools find roughly a third of issues this way, reliably and cheaply, and they are excellent at regression checking afterward.

Manual testing is the other half: an auditor working through your key journeys with a keyboard alone and with screen readers, checking whether focus order makes sense, whether interactive components announce themselves properly, and whether the experience holds together in practice. The issues that generate complaints and legal exposure are disproportionately manual findings, because they involve meaning and behavior, not just markup.

The scope: pages and journeys

A credible audit does not test every page. It tests templates and journeys: homepage, collection, product, cart, checkout, account, and any high value flow like store locators or booking. One product template fixed properly repairs thousands of product pages at once, which is why audits are structured around templates rather than page counts.

Ask what is included before you buy. An audit limited to automated scans of ten URLs is a different product from one with manual screen reader passes through checkout, and the prices differ accordingly. Also ask which standard and level the audit tests against: WCAG 2.1 AA is the common reference point in US legal contexts, and an audit against a vaguer standard is hard to act on or defend.

What the deliverable should contain

A useful report lists each issue with its location, the success criterion it maps to, a plain language description of who it blocks and how, a screenshot or recording where behavior matters, and a severity rating you can triage by. Vague entries like images not accessible, repeated forty times, waste your developer's hours and your money.

The report should also state what was tested and how: devices, browsers, assistive technologies, and the exact pages and states covered, including logged in and mobile views where relevant. That methods section is what makes the document credible if it is ever read by a regulator, a plaintiff's expert, or your own new developer in eighteen months.

What an audit is not

An audit is a snapshot and a map, not a certification and not a shield by itself. It does not make you compliant; fixing the findings and keeping them fixed through future site changes is what builds the defensible position. An audit also cannot sample everything, so a clean report means no issues found in scope, not no issues exist.

Treat the audit as the start of a maintenance habit: scan automatically on a schedule, retest key journeys after redesigns, and keep the reports. Stores that can show that pattern are in a fundamentally different position from stores holding one old PDF, whatever the PDF says.

Related reading

If this topic is useful, these earlier guides go deeper on connected questions: Alt text audits: the gaps that show up again and again, What an accessibility statement page should actually include, and How website accessibility claims get tested: what auditors and plaintiffs look for.

Frequently asked questions

How long does an accessibility audit take?

For a typical ecommerce storefront, one to three weeks depending on scope and how much manual testing is included. Automated only scans return in days but cover far less. Timelines should be quoted against a defined page and journey list, not the whole site.

How much of an audit can automation do?

Automated tools reliably catch around a third of common issues: the markup level problems. The rest, keyboard behavior, focus management, screen reader announcements, meaningful reading order, require human testing with assistive technology. Any audit promising full coverage from a scan alone is overselling.

Which standard should the audit test against?

WCAG 2.1 AA is the reference most US businesses use, because it is what courts and settlement agreements commonly cite. Confirm the audit states its standard and version explicitly in the report.

If my audit comes back clean, am I protected?

A clean audit means no issues were found within the tested scope at that time. It is strong evidence of diligence, but protection comes from the ongoing pattern: fixing what audits find and retesting as the site changes, documented over time.