VPAT for a website

Scoping and testing an ACR for a website or web application.

Web content is the case the standards were written for, and the case automated tooling handles best. It is also the case where scope decisions quietly determine whether the document is any use to the buyer.

Which pages to cover

You are not testing every URL. You are testing a representative sample that covers every distinct template and every key user journey. For most products that is somewhere between ten and thirty pages:

The entry points: home, pricing, sign-up, sign-in.
One page per distinct template — a list view, a detail view, a settings form, a dashboard, a modal-heavy flow.
The journeys that matter: registration, checkout, search, the main task your product exists to do.
Error and empty states, which are routinely missed and routinely broken.

Say in the ACR which pages you tested. A reviewer who cannot tell what was covered treats the document as covering nothing in particular.

Content behind a login

Most of a web application is behind authentication, and that is usually where the real accessibility problems live. An ACR that only covers the marketing site while the product itself sits behind a sign-in is the single most common way these documents mislead.

Test the authenticated product. If you cannot, say exactly what was excluded and why. A scoped, honest document beats a broad, hollow one.

What a scan can and cannot tell you

An automated pass over your pages will find missing alternative text, unlabelled form fields, insufficient contrast, invalid ARIA, and broken heading structure — quickly, and across more pages than a person would check. It will not tell you whether an alternative text is accurate, whether the focus order makes sense, or whether your custom combo box behaves the way a screen reader user expects. Those need a person.

Standards to expect

For web content, WCAG 2.1 Level AA is the usual bar — it is what the ADA Title II rule requires of US public entities by 26 April 2027 for populations of 50,000 or more, and 26 April 2028 for smaller entities. Buyers subject to that deadline increasingly ask their software vendors for evidence, which is why the request landed on you.

This is the case we cover best

We scan your product's public pages, collect the evidence, and hand back a draft ACR in the ITI structure: detected failures with the rule and the markup that triggered them, and a specific question for every criterion a machine cannot judge. Your reviewer makes the calls and signs it. $299 per product, or $249/month to have it re-run every quarter and on release.