FAQ

Does a clean report mean my site is WCAG compliant?

No. Automated testing finds a subset of WCAG failures, and finds them reliably, but it cannot confirm conformance: many criteria depend on meaning and content that only a person can judge. A report with no failures means the automated checks found nothing. The criteria list shows which criteria still need a person. See Reading the Report.

Can I use the report for a VPAT or an accessibility conformance report?

As an input, yes. It gives you the confirmed failures, with evidence, and a criterion-by-criterion list of where automated testing stands. A VPAT also needs the manual review of everything marked Needs manual review and No automated failures, which is outside what any scanner can do.

Why scan a deployed site instead of the code in a pull request?

Accessibility is a property of the rendered page: the colours after your CSS is applied, the names after your components render, the focus order after your scripts run. Checking source code misses most of it and guesses at the rest. Scanning the running site, staging before each release, checks exactly what your users will get.

How is this different from Pentesting?

Both run against domains you have verified, and they share the same verified domains. Pentesting looks for security vulnerabilities and sends attack traffic. An accessibility scan only reads pages, and looks for barriers for people with disabilities. They are bought and run separately.

Will the scan change anything on my site?

It is designed not to. It only opens pages, never submits forms other than signing in once, skips links that would delete, cancel, unsubscribe or sign out, and only clicks buttons that open menus and accordions. Use a test account on staging all the same. See Scope and Safety.

The site check says the scanner is blocked. What do I do?

Your bot protection is serving the scanner a challenge page. Allow requests whose User-Agent contains CodityAccessibilityScanner on the site you are scanning, then select Check site again. Nothing is charged while the check fails.

A reported issue is in a third-party widget we cannot change.

Dismiss it on the issue, with the reason, and it stays dismissed on later scans of that site. To leave a widget out of every scan, add its CSS selector under Ignore these elements on the site.

Why is an issue I fixed not marked as fixed?

An issue only counts as fixed if the new scan checked every page it was on before. If the new scan stopped earlier, used a smaller mode, or could not check one of those pages, the issue is left out of the fixed count rather than claimed as fixed.

What happens if a scan fails?

If it failed because of a problem on Codity's side, a Free re-run appears on the site once Codity has finished retrying, and you are not charged again. If it failed because of the site itself, for example every page refusing the scanner, the scan says why. Fix the cause, confirm with Check site, and run again.

Which WCAG version should I choose?

WCAG 2.2 AA, the default, unless a contract or regulation names an earlier version. 2.2 includes everything in 2.1 and 2.0 except one criterion that was retired (4.1.1 Parsing), and adds checks such as minimum target size.

Who gets the email when a scan finishes?

The person who started the scan. It has the totals and a link to the report.

Can I schedule scans?

Not yet. Scans are run one at a time, from the dashboard, when you choose.