EU Conformance Hub

What we scan — and what we don't

An accessibility report that overstates its own coverage is worse than no report, because you will act on it. Here is exactly what the scanner does.

What we test

  • Rule set: axe-core, running the WCAG 2.0/2.1 level A and AA tags plus a set of best-practice rules. This is the same open rule set used inside many regulators' own testing tools.
  • Rendering: a real headless Chromium browser at 1366×900. JavaScript executes, so single-page apps and client-rendered content are tested as a user would receive them.
  • Pages: we start at the URL you give us and follow same-site links. Free scan: up to 10 pages, 2 levels deep. Full report: no depth limit, up to 500 pages.
  • Ordering: URLs that look like search, product, cart, checkout, account, login or contact pages are tested first, so a short scan lands on the pages that decide liability.
  • Cookie banners: where an obvious accept control is present we click it, because a consent wall otherwise hides the page we came to test.

What we cannot test — and this matters

Automated testing reliably detects roughly a third of WCAG 2.1 AA success criteria. No scanner detects more, whatever its marketing says. The following require a human, and are covered by the Full EAA Conformance Audit:

  • Whether a keyboard user can actually complete a purchase, and in a sensible order
  • Whether alt text is correct, not merely present ("image123.jpg" passes a scanner)
  • Whether a screen reader announces a custom component in a way that makes sense
  • Whether error messages explain how to recover
  • Video captions and audio description quality
  • Whether content is understandable — reading level, instructions, cognitive load
  • Anything behind a login, a paywall, or a payment step we cannot complete

A clean automated result is not a conformance claim, and we will never write one into your report.

What we do not touch

  • We do not submit forms, create accounts, or complete purchases.
  • We do not attempt to log in, and we never ask for credentials.
  • We do not test anything outside the domain you enter.
  • We do not probe for security vulnerabilities. This is not a penetration test.
  • We do not store your page content beyond the short HTML fragments quoted as evidence in the report.

How we behave on your servers

  • We identify ourselves honestly: Mozilla/5.0 (compatible; ConformanceHubBot/1.0; +https://www.conformancehub.eu/scan-scope)
  • We read and obey robots.txt, including any crawl-delay you set.
  • One page at a time, with a 350ms pause between requests. A free scan is 10 page loads — less traffic than a single real visitor browsing.
  • Media and font files are blocked at the network layer; we test markup, not bandwidth.
  • Each scan runs in an isolated process on our infrastructure with a hard time budget. Nothing runs on your servers.

If you would rather we did not scan a particular path, disallow it in robots.txt and we will skip it.

If the scan fails

Bot-protection layers, IP-based geoblocking and HTTP authentication walls will stop us. If that happens you get an email saying so rather than an empty report, and we will run it manually at no charge — reply to that email.

Your data

We keep the scan results and your contact details for 180 days for free scans and 3 years for paid reports, then delete them. Full detail is in the privacy notice.