Testing a whole site against WCAG, and standing behind the result
How WCAG-EM's five steps scope, explore, sample, evaluate and report a site, where a fixed test process such as Trusted Tester fits, and what the report has to state.
In short: Agree the scope, the target level and the browsers and assistive technology the site must work with; explore the site; test a structured sample and a random one; give each failure the criterion it fails; and report the date, scope, sample, method and tools, so that someone else could repeat it. The result describes the sample: conformance itself is defined page by page.
01
When you need this
A ticketing company renews a contract next quarter, and the contract asks for WCAG 2.2 at level AA. Its site has 1,240 pages: a home page, event listings, about 1,100 event pages built from one template, venue pages, sign-up, an account area, a checkout on a separate payment domain and a help centre. There are two weeks to test it.
The client's question is "Are we compliant?" Nobody can test 1,240 pages by hand in two weeks, so the answer has to say which pages were tested, how they were chosen, how each one was tested, and what the result does and doesn't say about the pages that weren't.
02
How to do it
W3C's WCAG Evaluation Methodology, WCAG-EM 2.0, sets out five steps. It is a Group Note published on 23 July 2026, and it replaces WCAG-EM 1.0 (2014), which covered websites only: 2.0 covers apps, kiosks and documents too, and uses "view" for a web page, a screen or any equivalent unit. Check https://www.w3.org/TR/wcag-em-2/ for a later edition. The steps usually come in this order, though WCAG-EM says the order can vary with the type of product and the purpose of the evaluation, and it lets the tester go back to an earlier one whenever they learn something new.
- Define the scope (Step 1).
- The product: write down which pages are in, so that every page is plainly in or out, by a list of addresses or a pattern. Name third-party content, mobile and language versions, and parts on another domain that still belong to the product, such as a shop.
- The conformance target: level A, AA or AAA. WCAG-EM notes that AA is the generally accepted and recommended target.
- The accessibility support baseline: the minimum set of operating systems, browsers and assistive technologies the site is expected to work with, agreed with the client. The tester may add combinations later, and the baseline then grows with them.
- Optional extra requirements, agreed up front: every occurrence of an issue rather than examples, testing with disabled users, a set report template.
- Explore the site (Step 2).
- Common views: the home page, sign-in, contact, help and legal pages, usually linked from the header, navigation and footer.
- Essential functionality: what would change the site's purpose if it were removed, such as buying a ticket or creating an account.
- The types of page: different templates, layouts and components, such as date pickers, dialogs and carousels, and error messages and other states.
- The technologies relied upon: HTML, CSS, JavaScript, WAI-ARIA, PDF. WCAG-EM encourages noting the CMS, design system and frameworks too, with versions.
- Other relevant views: the accessibility statement, help and settings, and anything sensitive, such as sign-in, personal details and payment.
- Select a sample (Step 3). Where the whole site can be tested, WCAG-EM recommends doing that and skipping the sampling.
- The structured sample: every common view and other relevant view, plus enough pages to show each essential function, type of page and technology found in Step 2. One page can stand for several of them.
- The random sample: 10% of the structured sample, added to it, drawn from anywhere on the site in no predictable pattern. Record how it was drawn.
- Each complete process: every page of it, along the default path and along the branches that are commonly used and critical to finishing it, such as adding a new delivery address. Record the actions that lead from one page to the next, because the address alone usually won't reach them again.
- Evaluate the sample (Step 4).
- Check each page against the five conformance requirements at the target level, as it first appears, without starting any process. Repeated parts such as the header need checking again only where they look or behave differently.
- Check each complete process by using it: fields, error messages, dialogs and confirmations.
- Compare the random sample with the structured one. If the random pages show a type of content or a finding the structured sample doesn't have, the structured sample wasn't representative: go back to Step 3 and add pages.
- Report the findings (Step 5).
- Document the outcome of every step. This part is required.
- The rest is optional: archive the pages tested and record the tools, browsers, assistive technologies and versions; give an evaluation statement; give a score, which WCAG-EM warns can mislead because no single metric is known to be reliable; give a machine-readable report in EARL.
- W3C's WCAG-EM Report Tool takes the tester through the steps and builds the report from them. Its version 4.1.0, released on 11 August 2026, uses WCAG-EM 2.0's terms.
03
Automated checks, inspection and assistive technology together
WCAG-EM is independent of any tool, and says that most accessibility checks are not fully automatable. No single way of testing covers every criterion, so a test of a page uses three:
| Method | What it settles | What it leaves open |
|---|---|---|
| Automated checks | Rules a tool can decide from the code, on many pages at once: an image with no alt attribute, the contrast of text it can compute, a field with no name |
Whether the words are right, and anything that needs a person to use the page |
| Inspection | The code and what it gives assistive technology: names, roles, the heading outline, focus order, contrast measured with a colour picker | Whether the screen readers in the baseline actually announce and operate it |
| Assistive technology | Whether the content works in the baseline combinations, which is what conformance requirement 4 is about | Only as much as the tester's own skill with each one shows |
What tools find and miss is on automated checks, and what makes a technique accessibility supported is on whether a technique works in the screen readers people use.
The last row has two limits of its own. WCAG-EM assumes a tester with a solid understanding of assistive technologies and of how people with different disabilities use digital products, and allows a team to bring that expertise together when one person doesn't have all of it. A tester who doesn't know a screen reader's reading and typing modes may report a failure that comes from pressing the wrong key. W3C's page on involving users in web projects notes that a very advanced user may know uncommon work-arounds that an average user could not manage, and a fluent tester can get past a barrier the same way without noticing it.
A magnifier's own settings change what the tester sees. ZoomText's focus enhancements draw its own marker on the control that has focus, and its colour enhancements adjust colour, contrast and brightness. With them on, a page that draws no focus indicator still shows one, and contrast judged by eye on the magnified screen is not the page's contrast. Check 2.4.7 Focus Visible and 1.4.3 Contrast (Minimum) with those enhancements off or with no magnifier, then use the magnifier for what it is for, following focus and reading at high zoom. A page with no focus indicator is in missing focus indicators on custom buttons.
04
Trusted Tester: a method with fixed test steps
WCAG-EM says which pages to test and what to report, and leaves the test of each criterion to the tester: W3C's techniques may be used but are not required. A test process fills that gap. The Trusted Tester Section 508 Conformance Test Process for Web, version 5.1.3 (DHS, April 2024), is one, and section508.gov describes it as a manual test approach that gives repeatable results. As of this page's date 5.1.3 is the current version; check section508.gov for a newer one.
- What it tests: the 41 web requirements of Section 508, which are 38 WCAG 2.0 level A and AA success criteria and 3 Section 508 requirements, through 63 test conditions.
- How a condition is decided: each test condition is a statement that is true or false, with fixed steps. The result is Pass, Fail, Does Not Apply, or Not Tested, which is allowed only where the tools can't do the test. Every condition needs a result before the test is complete.
- Tools: ANDI (Accessible Name & Description Inspector), a free bookmarklet that shows what a page gives assistive technology, and the Colour Contrast Analyser, or Accessibility Insights for contrast. The process calls itself essentially a code inspection for accessibility properties.
- Order: it recommends Test 1, conforming alternate versions, first; then auto-playing content, flashing, and keyboard access and focus, which cover the criteria non-interference applies to the whole page. After Test 1, the tester may take the tests in any order.
- What it leaves out: which pages to test. It asks for the scope of testing to be stated, and doesn't say how to choose it.
Two of its facts matter for a WCAG 2.2 target. It tests WCAG 2.0, because Section 508 adopts WCAG 2.0, so the criteria added in 2.1 and 2.2, such as 1.4.10 Reflow and 2.5.8 Target Size (Minimum), need tests of their own. And it records 4.1.1 Parsing as Not Tested, a criterion WCAG 2.2 no longer has. Used together, WCAG-EM chooses the pages and Trusted Tester tests the WCAG 2.0 criteria on each.
05
One criterion for each issue
A finding goes under the criterion whose test it fails, not the one nearest in topic. Three criteria sit close together on every form, and Trusted Tester gives each its own test condition:
| Criterion | What it asks of a field | Trusted Tester |
|---|---|---|
| 3.3.2 Labels or Instructions (A) | A label or instruction is there on screen, and still visible while the field has focus | 5.A, labels provided |
| 2.4.6 Headings and Labels (AA) | The label's words say what to enter | 5.B, labels descriptive |
| 1.3.1 Info and Relationships (A) | The label is tied to the field in the code | 5.C, programmatic label |
So the same form can produce three different findings:
- A "Postcode" label whose
forpoints at the wrongidis a 1.3.1 failure: the words are there and they are right, but they label nothing. Form fields with missing or mismatched labels shows it, and the placeholder that vanishes once someone types, which is 3.3.2. - "Name" on a gift form about two people fails 2.4.6 and only 2.4.6. The label is tied to its field and stays on screen, so the form passes 1.3.1 and 3.3.2; what fails is the words. That is vague form labels that don't say what to enter.
- Headings follow the same split. Trusted Tester tests a heading's words under 2.4.6 (10.A) and its markup and level under 1.3.1 (10.B and 10.C). In headings that don't match the page's sections, section titles styled as
divelements fail 1.3.1, and a heading that says only "More" fails 2.4.6.
When one defect fails two tests, as the empty h2 in that guide fails both, list it under each and say it is one fix. Filing every form issue under 1.3.1, or the same defect under all three, makes a report count failures that aren't there and sends developers to the wrong fix.
A failure or a best practice. A failure is content that doesn't meet a success criterion at the target level. Anything else in a report is a best practice and is labelled as one: a criterion above the target, an advisory technique, a usability problem. Form field help only on a help page or on hover is a real barrier, but its criterion, 3.3.5 Help, is level AAA, so under an AA target it goes in the report as a best practice. WCAG-EM notes that evaluating beyond the target can help plan improvements, and Trusted Tester lets problems outside Section 508, such as a link to the wrong site, go in a comment rather than count as a failure. A finding is not a failure because the page doesn't use a W3C technique either: WCAG-EM doesn't require any particular technique.
06
What the report states
WCAG-EM's Step 5.1 lists what a report includes, and Trusted Tester asks every conformance report built from it to identify its test process, its scope and its test environment:
| Item | What to write | Where it comes from |
|---|---|---|
| Date | The completion date or the period of testing | WCAG-EM 5.1 |
| Who | The evaluator and the client who asked for it | WCAG-EM 5.1 |
| Scope | The pages in and out, the target level, the accessibility support baseline | WCAG-EM 5.1, Trusted Tester |
| Technologies | The technologies relied upon | WCAG-EM 5.1 |
| Sample | The structured pages, the random pages and how they were drawn, each complete process | WCAG-EM 5.1 |
| Method | The methodology and test process, with versions | WCAG-EM 5.1 (optional), Trusted Tester (required) |
| Tools and versions | Testing tools, browsers and add-ons, assistive technology, operating system | WCAG-EM 5.2 (optional), Trusted Tester (required) |
| Outcomes | At least one example of each criterion not met, with issues that repeat marked as such | WCAG-EM 5.1 |
For each failure, WCAG-EM notes that a clear description, steps to reproduce, severity and screenshots help teams fix it, and Trusted Tester asks for where the failure is and, where it can, what caused it. EaseWeb's conformance record is one report built from these items.
An evaluation statement is a different thing from a report. WCAG-EM's Step 5.3 allows one only when every required step was done, every page in the sample meets the target, and the owner commits to keeping it accurate. Even then it is a statement about an evaluation, not a conformance claim for the site, because conformance is defined for each web page: what it takes for a page to conform to WCAG covers what a claim needs.
07
Worked example
The ticketing site, taken through the five steps.
- Scope. All of tickets.example.com, and the checkout on pay.example.com, which is a different domain but part of the product. The seat map is a third party's embed, and it is in scope because it is on the page. The target is WCAG 2.2 AA. The baseline, agreed with the client, is NVDA and JAWS with Chrome on Windows, VoiceOver with Safari on macOS and iOS, and TalkBack with Chrome on Android.
- Exploration. 9 common views (home, sign-in, sign-up, search, help, contact, accessibility statement, terms, privacy). Essential functions: find an event, buy a ticket, create an account, transfer a ticket. Types: the event page template, venue pages, listings, the account dashboard, the seat map, PDF tickets. Technologies: HTML, CSS, JavaScript, WAI-ARIA and PDF.
- Sample. A structured sample of 30 views, a random sample of 3 drawn by a script from the sitemap, and the checkout's 5 steps along with its "add a new card" branch, of which 6 views weren't already in the sample: 39 in all.
- Evaluation. Each view got automated checks, Trusted Tester's conditions for the WCAG 2.0 criteria, separate tests for the 2.1 and 2.2 criteria, and the baseline screen readers. One random page was an old event page with a video, a type the structured sample didn't have, and the video had no captions. So the sample went back to Step 3: 2 more event pages with video were added, and the finding was confirmed on both. The sample ended at 41 views.
- Report. The findings, each under its criterion:
| Finding | Criterion | Guide |
|---|---|---|
| Postcode label pointing at the wrong field, checkout step 2 | 1.3.1 | Form fields with missing or mismatched labels |
| Gift form labels "Name" and "Email", with two people on the form | 2.4.6 | Vague form labels that don't say what to enter |
Event page section titles styled as div elements, on the template |
1.3.1 | Headings that don't match the page's sections |
| No focus indicator on the "Buy" button | 2.4.7 | Missing focus indicators on custom buttons |
| Event videos with no captions | 1.2.2 | |
| Order number help shown only on hover | Best practice (3.3.5, AAA) | Form field help only on a help page or on hover |
The heading failure is in the event template, so the report marks it as repeated: it is on every event page tested, and it is one fix. With the magnifier's focus enhancement on, the "Buy" button looked focused; with it off, the page drew nothing, so the finding went under 2.4.7.
The report gives the date of the last test, the scope, the baseline, all 41 views, the script and seed used for the random draw, the method (WCAG-EM 2.0, with Trusted Tester 5.1.3 for the WCAG 2.0 criteria), and every tool, browser and screen reader with its version. Its answer to "Are we compliant?" is that the 41 views tested don't meet WCAG 2.2 AA, with the failures listed. It makes no claim for the other pages, and no evaluation statement, because not every view in the sample meets the target.
08
Common mistakes
- Calling a sample's result a claim for the whole site. WCAG-EM says a conformance claim can't be made for a whole site from a sample alone, since there may be errors on pages nobody tested. Report what the sample showed; what it takes for a page to conform to WCAG covers claims.
- Skipping the random sample, or never comparing it. The random pages are there to show whether the structured sample missed a type of content. Comparing them is Step 4.3, and a difference sends the tester back to Step 3.
- Testing the first page of a checkout and not the rest. WCAG 2.2's complete-process requirement means no page in the process conforms unless every page does.
- Filing every form issue under 1.3.1. A vague label passes 1.3.1 and fails 2.4.6, as vague form labels shows; a misfiled finding sends the developer to the code when the words need changing.
- Counting an AAA criterion as a failure under an AA target. Report it as a best practice, as with field help.
- Judging focus or contrast through a magnifier's enhancements. They draw their own focus marker and change colours. Check with them off, as missing focus indicators needs.
- A scan reported as a test. A tool decides only some criteria; automated checks lists what it can and can't find.
- A Trusted Tester result reported as WCAG 2.2. It tests WCAG 2.0 A and AA, so the 2.1 and 2.2 criteria need tests of their own.
- No versions in the report. Without the browser, screen reader and tool versions, nobody can repeat the test, and results age as software changes.
09
What the standard says
- WCAG 2.2 §5.2 (required): "In order for a web page to conform to WCAG 2.2, all of the following conformance requirements must be satisfied": the level, full pages, complete processes, only accessibility-supported ways of using technologies, and non-interference. §5.2.3 adds that conformance at a level is not possible "if any page in the process does not conform at that level or better".
- WCAG 2.2 §5.3 (required for a claim, if one is made): "Conformance is defined only for web pages. However, a conformance claim may be made to cover one page, a series of pages, or multiple related web pages." A claim states its date, the guidelines and their address, the level, the pages it covers and the technologies relied upon.
- WCAG-EM 2.0 (advice): a Group Note that "does not in any way add to or change the requirements" of WCAG. It says "WCAG 2 conformance claims cannot be made for entire websites based upon the evaluation of a selected sub-set of web pages and functionality alone". Its steps are written as methodology requirements, and an evaluation statement under it needs every one that isn't optional to be met (Step 5.3).
- Section 508 E205.4 (required for US federal ICT): "Electronic content shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0". The rule sets no testing or sampling method; Trusted Tester is a test process for it, not part of it.
- EN 301 549: WCAG-EM lists V3.2.1 among the standards that incorporate WCAG 2 by reference. What it asks of a website beyond WCAG is on what EN 301 549 asks of a website beyond WCAG.
- JIS X 8341-3:2016: technically equal to WCAG 2.0, and its revision to follow the 2025 ISO/IEC 40500 is expected in 2027, or 2028 at the latest, according to WAIC (September 2026). Its informative Annex JB sets four ways to choose the pages of a site. WAIC's test guidelines (December 2020) recommend combining representative pages with random ones once a site has more than 100 pages, and testing about 40 to 50 pages in all. That is a much larger random share than WCAG-EM's 10% of the structured sample.
10
Limits
This page covers how a site is tested and reported, not which findings to fix first, which is in which findings to fix first, and when to rebuild instead, and not what disabled people find in a usability test, which is in what testing with disabled people finds that an audit doesn't. WCAG-EM names the things that make a sample larger or smaller (the size, age and complexity of the site, how consistent it is, how confident the result must be) but gives no number except the random 10%, so the size of the sample is the tester's judgement, agreed with the client. Which baseline is right for a site is agreed between them too. Whether a report is enough for a contract or a complaint is a question for the client's lawyer.
11
Terms
- accessibility support baseline
- The browsers, assistive technologies and other user agents the site's features must work with, agreed before testing starts.
- structured sample
- Pages picked on purpose so that every common page, essential function, type of page and technology on the site is tested.
- random sample
- Pages drawn from the whole site in no predictable pattern, to show whether the structured sample missed anything.
- complete process
- Every page of a sequence a person has to go through to finish one task, such as a checkout from basket to confirmation.
- test condition
- In Trusted Tester, one statement about the page that is either true or false, with its own steps for deciding which.
- best practice
- Advice beyond the target level that a report may give, but that never counts as a failure.
12
Sources and guides
- Advice WCAG-EM 2.0 (W3C Group Note, 23 July 2026): Evaluation procedure, Steps 1 to 5 (opens in a new tab)
- Advice WCAG-EM 2.0 (W3C Group Note, 23 July 2026): Relation to WCAG 2 conformance claims (opens in a new tab)
- Required WCAG 2.2: 5.2 Conformance requirements (opens in a new tab)
- Required WCAG 2.2: 5.3 Conformance claims (opens in a new tab)
- Advice Trusted Tester Section 508 Conformance Test Process for Web 5.1.3 (DHS, April 2024): Conformance Reporting Requirements; Test 5 Forms; Test 10 Content Structure (opens in a new tab)
- Required Section 508 (36 CFR 1194, Appendix A): E205.4 Accessibility Standard (opens in a new tab)
- Advice WCAG-EM Report Tool (W3C WAI): Version 4.1.0, August 2026 (opens in a new tab)
- Advice JIS X 8341-3:2016 Test Guidelines (WAIC): 2.2 Testing a set of web pages (opens in a new tab)
Guides that show it
- Form fields with missing or mismatched labels A delivery form looks labelled, but one label is loose text, one points at the wrong id and one aria-label differs, so the visible words aren't the names.
- Vague form labels that don't say what to enter A gift card form labels its fields Name, Email and Date, so people can't tell whether it wants their details or the recipient's, or which date it means.
- Form field help only on a help page or on hover A returns form asks for an order number and doesn't say where to find it: the answer is in the help centre, or in a ? that only a mouse pointer can open.
- Headings that don't match the page's sections A recipe page styles its section titles as divs and uses headings for a small title and a rule, so a screen reader's headings list misses the sections.
This page explains a practice, with recreated examples. It is not legal advice, and it is not a finding about a named client.