Behind login
The expensive pages sit behind a session: checkout, payment errors, the customer account. Free scanners never go there. We audit the live flows a real customer walks, on desktop and mobile widths.
Accessibility audits for EU e-commerce and SaaS
Your accessibility problems are behind the login: in checkout, in the account, in the dashboard. That is exactly where we look.
A real WCAG 2.1 AA audit of your live store or app, checkout and account and dashboard included. Nothing installed on your site, no overlay script, no staging environment needed. The audit itself costs nothing. You pay for the code work that follows, and only if you want us to do it.
The European Accessibility Act has applied since 28 June 2025 to e-commerce above the micro threshold (10+ staff and >€2M turnover). This page will not tell you a widget makes that go away, because it doesn't.
Why this audit and not a free scanner
A fix map, not 400 rows
Most failures share a handful of sources: one design token used everywhere, one component repeated on every page. The report groups every finding by its source. Fix six components and three tokens, and hundreds of findings disappear. Your developer spends a day, not a quarter.
Honest about coverage
Automated testing reliably detects roughly 30 to 40% of WCAG failures. The rest needs human judgement: meaningful alt text, keyboard traps, error recovery. That part of our audit is manual, and every finding says so.
What the other audits cannot offer
The four claims below are the ones a competitor cannot answer. Each is either a measurement we publish or a behaviour you can verify in the report itself.
We are the only audit that also ships a browser
Everyone else sells a report, or an overlay that rewrites your page for every visitor. We put nothing on your site at all. Qiksy Legato repairs pages as they load, on the reader’s side, in their own browser. A report tells an owner what is wrong; this also gives the person who cannot use the site a way through while the backlog is still a backlog.
We publish how often our own fixes are right
277,197 repairs across 6,737 domains. We took a random sample of 200 and checked every one by hand: 77.5% correct, 19% neutral, 1% actively wrong. No overlay vendor publishes a figure like that, because publishing it means stating how often the product misleads a blind visitor. Ours is on the data page with the sample and the verdicts.
The report will not say “97% compliant”
A single percentage is about the criteria that were tested, not about whether a person can finish a purchase, and in front of a regulator it is a liability rather than an asset. Our report prints what was NOT checked, keeps “not checked” apart from “not applicable”, and never carries a verdict from a page that was tested onto one that was not.
A named person signs the measurement
Not a line about inclusive practice in a company profile. The report carries the name of the person who walked your site, and states in the same breath that it is a technical assessment and not a certificate of conformance under the European Accessibility Act.
The deliverable: flip through the reports
The first one is real: our own production site, the three findings it returned and the three fixes that shipped the same day. The other five are samples over fictional stores across five verticals, assembled to show the structure and depth of what you receive: the verdict line, the fix map by token and component, the findings with measured evidence. Open any of them in full.
- Verdict in one line
- Coverage: states opened
- Top risks
- Fix map by design token
- Fix map by component
- Keyboard route
- Manual review by a person
- Third-party frame inventory
- Remediation plan 30/60/90
- Accessibility statement draft
- Findings register with evidence
The audit is free. You pay for work, not for a diagnosis
The figure for remediation is named after the audit, computed from its result rather than from a phone call. The report is yours either way, whether you fix it yourself, with someone else, or not at all.
Audit
$0every state
- Every page type and every state: route × viewport × open layer × data × validation
- Behind the login too: checkout, account, dashboard
- Desktop 1440 and mobile 390, WCAG 2.1 AA
- The full HTML report plus CSV for your tracker
- The report is yours. Fix it yourself, with others, or with us, your call
Remediation
$120per state
- Developers fix it in the source, not with a widget on top
- At token level where a token is the source: one template fixes every page of its type
- An acceptance criterion on every item, saying what exactly has to start working
- A re-run with a diff: what closed, what remains
- The price is fixed before the work starts and does not grow along the way
From 25 states $95 each, from 100 states $75. Minimum engagement: 20 states, $2,400.
Acceptance
per roundby a person, not a machine
- A blind specialist walks the fixed states by hand and by voice, on NVDA and VoiceOver
- The whole scenario, from catalogue to a paid order
- The signature stands under named states, never under "the site"
- Did not pass? It goes back to remediation and the round does not count
- A signature, not a badge: "zero errors for the machine" and "a person got through" are different statements
Support
$3,900/year
- A monthly re-run of every state
- A diff report and a warning about regressions after your releases
- Accessibility drifts with every deploy, so this is the one line that has to repeat
- No auto-renewal and no stored card: invoiced 14 days ahead; unpaid simply stops the monitoring
Also available: a draft Accessibility Statement $400 · an EN 301 549 conformance summary for tenders $900. Work outside the register, such as a new feature, a redesign or a third-party vendor, is $140/hour.
Projects we turn down
Six situations where we say no, and say it before an invoice exists. Each of them ends the same way, in a report nobody acts on, and we would rather not be part of that.
You are keeping the overlay
A widget on top is the first thing the report finds, and nothing underneath it can be verified. Take it off, or give the audit to someone willing not to notice it. On day sixty we will say exactly what we said on day one.
Nobody may touch the source
Remediation happens in the repository. If markup and CSS are held by a page builder, a vendor contract or a theme nobody may fork, the fixes have nowhere to land. The free audit still stands; the work does not.
"Just the minimum so nobody sues"
That is not a smaller version of this work, it is a different job. We state what a person cannot do and what it costs to fix; risk is assessed by a lawyer. Ask us for the first one.
The deadline is in two weeks
A site nobody has ever touched needs a quarter, not a fortnight. We would rather lose the order than sign a date we would spend the following month explaining.
Nobody owns it on your side
A report needs someone to hand out the tasks, a developer to fix them and someone to accept them. Where nobody is named, the document is read once and remembered as an expense.
The design is not up for discussion
Some of the findings are contrast, focus and hit area, and they change how the brand looks, slightly and visibly. If the guideline outranks that, the list shrinks to what changes nothing.
Who we do take: a team that will carry the fixes through to a merge. That counts for more than the size of the shop.
What we are measuring right now
A crawler has been walking public sites since August, recording one thing: places that reach a screen reader with no name, such as a button that announces itself as "button" or a link that says "link". These are the totals as of the last hour.
- sites walked
- 30,541
- pages read
- 275,292
- nameless places found
- 10,390,627
- domain zones
- 93
There is no denominator here, and there cannot be. The crawl records what is wrong and never counts what was already right, so none of this is a share of the web. The site list is a queue we assembled, not a random sample.
The lab machine has not reported for several hours. The totals are the last ones measured, not the current ones.
41 domain zones measured
There is no clean country
Every zone deep enough to speak about, meaning at least 1,500 pages across at least 100 sites, and how many elements with no accessible name sit on an average page there. Zone means the domain, never geolocation.
- 55.6
- worst zone (.by)
- 26.4
- best zone (.tw)
- 18.3%
- pages with none, in the best zone
Ordering and spread only. There is no denominator: the crawl records silent elements and never counts the ones that were already right, so nothing here is a share of the web, and a zone is a queue we crawled rather than a sample of that country’s web.
How we test
The unit of work is a state, not a page: route × viewport × open layer × data condition × validation condition. “Cart” is four states. A typical Shopify run covers 25 of the canonical 42: home, collection, product, cart drawer, login, checkout contact, address error, payment declined, thank-you and the rest. Each one goes against WCAG 2.1 AA, with WCAG 2.2 additions reported separately as improvements.
Roughly a third of what reaches the report comes out of the machine pass; the other two thirds come from a person driving every state by hand, with a screen reader on. That split is our own working ratio across runs, not a measured law. The reason behind it is measured, though: an automatic pass can tell that a button has no name, and cannot tell that the name it does have is the wrong one. On our own repair corpus, hand-judged, 77.5% of automatic names were right and 1% stated something false. A false name is worse than no name, and no machine catches it.
So the human pass is not a review of the tool’s output. It is the audit. An audit is not finished, and we do not hand it over, until a person has walked every state in the scope, listened to it, and signed off on each finding. What only a person can settle: whether a name means anything to someone who cannot see the icon, whether an error can actually be recovered from, whether the order of a flow makes sense by ear, and everything behind a login, a payment step or a CAPTCHA.
- Contrast measured with exact ratios, and traced to the design token the colour came from
- Names, roles and labels: every field, button and custom widget
- Keyboard route across 8 key states: traps, order, visible focus, skip link
- Forms three ways, empty submit and one bad field and success: association, focus, announcement
- Focus obscured by sticky headers, and target sizes under 24px: geometry checks almost nobody reports
- Third-party iframes inventoried with what to request from each vendor
What this audit is not
We publish the limits before you ask. No raster analysis: text over photographs and gradients is not confirmed. We do not enter third-party iframes, so payment fields, maps and video players are inventoried rather than tested; under the EAA the obligation stays with the merchant, so the report tells you what to request from each vendor. CAPTCHA-guarded flows are not assessed. We read the accessibility tree, not the behaviour of specific screen readers.
Qiksy is not a law firm and provides no legal advice. The audit is a technical assessment against WCAG 2.1 AA / EN 301 549. It is not a certificate of conformance and not a legal determination under the European Accessibility Act or its national implementations.