Checks
Every check, explained one page at a time
An audit report is a list of findings, and a finding is only useful if you know what it means and what to do. These pages take the checks the engine runs - 199 of them - one at a time: what the check tests, in the engine's own terms, why a failure matters, how to fix it, and what the fix can break. 193 written so far; the rest are being added, security and accessibility first.
Security
Headers, TLS, cookies, exposure surface
sec.cors.wildcard
CORS wide open: Access-Control-Allow-Origin is a wildcard
Understand Access-Control-Allow-Origin wildcard findings. Fix credentialed CORS, build an origin allowlist, test preflight, and avoid unsafe origin reflection.
Read the explanation →sec.admin-exposure
Admin Login Page Publicly Accessible: Review the Exposure
Review an admin login page linked from public content. Remove unnecessary links, enforce access controls, test public dependencies, and understand scan limits.
Read the explanation →sec.autocomplete-off
Autocomplete Off on a Password Field: Use Helpful Hints
Fix autocomplete off on a password field. Use current-password or new-password, test password managers, and keep deliberate non-login exceptions documented.
Read the explanation →sec.headers.csp
Content-Security-Policy Header Missing: How to Fix It
Fix a missing Content-Security-Policy header with a tested rollout, nonce-based script protection, verification steps, and clear scanner limitations.
Read the explanation →sec.csp.report-only-only
CSP Report-Only Not Enforced: Finish the Policy Rollout
Move CSP from report-only to enforcement safely. Review violations, test critical journeys, configure reporting, and understand what the check verifies.
Read the explanation →sec.cookies.expiry
Cookie Expiration Too Long: Set Purpose-Based Lifetimes
Review cookie expiration that is too long. Set purpose-based Max-Age values, enforce session limits, test renewal, and recognise scanner blind spots.
Read the explanation →sec.cookies.httponly
Cookie Without the HttpOnly Flag: How to Fix It
Fix a missing HttpOnly flag on session cookies without breaking frontend code. See header examples, verification steps, exceptions, and scanner limits.
Read the explanation →sec.cookies.samesite
Cookie Without a SameSite Attribute: How to Fix It
Fix cookies missing SameSite. Compare Lax, Strict, and None, test login and payment callbacks, and understand what the WebAuditOS check actually verifies.
Read the explanation →sec.cookies.secure
Cookie Without the Secure Flag: How to Fix It
Fix a cookie without the Secure flag. See a safe Set-Cookie example, HTTPS and proxy checks, testing steps, and common session-cookie pitfalls.
Read the explanation →sec.headers.coop
Cross-Origin-Opener-Policy Header Missing: Choose COOP
Fix a missing Cross-Origin-Opener-Policy header. Choose COOP for your window relationships, test OAuth and payment popups, and verify actual browser behaviour.
Read the explanation →sec.headers.corp
Cross-Origin-Resource-Policy Header Missing: Set CORP
Review a missing Cross-Origin-Resource-Policy header. Choose CORP values for each resource, preserve public assets, and distinguish it from access control.
Read the explanation →sec.csp.base-uri
CSP Base-URI Missing: Restrict the Document Base URL
Fix CSP base-uri missing. Choose self or none, inspect base elements, preserve required paths, and verify enforcement without relying on default-src.
Read the explanation →sec.csp.default-src
CSP Default-Src Missing: Add a Safe Resource Fallback
Fix a missing CSP default-src directive. Understand fetch fallbacks, choose self or none, test blocked resources, and keep non-inheriting directives explicit.
Read the explanation →sec.csp.object-src
CSP object-src missing: plugin content not blocked
Fix CSP object-src missing with an effective none policy. Check default-src fallback, test embedded PDFs, and verify object and embed restrictions.
Read the explanation →sec.csp.unsafe-eval
CSP Unsafe-Eval: Remove Dynamic Evaluation Safely
Remove unsafe-eval from CSP without breaking production. Find eval dependencies, test a report-only policy, and verify which enforced directive applies.
Read the explanation →sec.directory-listing
Directory Listing Enabled: Disable Public File Indexes
Fix directory listing enabled in nginx, Apache, or IIS. Disable public indexes, remove exposed backups, and verify files are protected at their direct URLs.
Read the explanation →sec.cookies.host-prefix
Session Cookie Without the __Host- Prefix: Review Scope
Use the __Host- cookie prefix for host-bound sessions. Check Secure, Path and Domain rules, plan migration, and preserve intentional cross-subdomain sign-in.
Read the explanation →sec.hsts.preload
HSTS Preload Not Ready: Decide Whether to Preload
Understand HSTS preload readiness. Check base-domain headers, HTTPS across subdomains, submission requirements, and the risks of slow preload removal.
Read the explanation →sec.https.redirect
HTTP Not Redirecting to HTTPS: Configure a Safe Redirect
Fix HTTP not redirecting to HTTPS with a permanent redirect. Preserve paths, test proxy settings and certificate renewal, and avoid unnecessary redirect chains.
Read the explanation →sec.disclosure.generator
Meta Generator Tag Version Disclosure: Remove Extra Detail
Remove unnecessary CMS version disclosure from meta generator tags. Review WordPress and static templates, preserve cache busting, and verify real patch status.
Read the explanation →sec.tls.cert-valid
Missing Intermediate Certificate: Repair the TLS Chain
Fix a missing intermediate certificate by serving the full TLS chain. Check the nginx chain file, validate hostname and trust, and test renewal automation.
Read the explanation →sec.mixed-content
Mixed Content on an HTTPS Page: Find and Fix HTTP Resources
Fix mixed content on an HTTPS page. Find insecure resource URLs, update their source, test browser blocking and upgrades, and verify runtime requests.
Read the explanation →saas.security-page
No Security Page or Trust Center: Publish Useful Evidence
Create a useful security page or trust center. Explain verified practices, link disclosure contacts, avoid unsupported claims, and understand scanner limits.
Read the explanation →sec.forms.password-over-https
Password Field on an HTTP Page: Secure the Full Login Flow
Fix a password field on HTTP or an HTTPS form posting to HTTP. Secure the page and submission, test login flows, and review possible credential exposure.
Read the explanation →sec.headers.permissions-policy
Permissions-Policy Header Missing: Restrict Unused Features
Fix a missing Permissions-Policy header. Disable unused browser features, preserve needed embeds, test supported browsers, and understand presence-only checks.
Read the explanation →sec.headers.referrer-policy
Referrer-Policy Header Missing: Choose and Verify a Policy
Fix a missing Referrer-Policy header. Understand modern browser defaults, choose strict-origin-when-cross-origin or a tighter policy, and verify what is sent.
Read the explanation →sec.security-txt
Security.txt Missing: Publish a Maintained Disclosure Contact
Fix security.txt missing at the well-known path. Add Contact and Expires, serve text over HTTPS, and maintain a monitored vulnerability reporting channel.
Read the explanation →sec.disclosure.server
Server Header Version Disclosure: Hide Unnecessary Numbers
Reduce Server header version disclosure. Configure the serving layer, verify public responses, and understand why hidden versions do not prove security.
Read the explanation →sec.https.enabled
Site Not Served Over HTTPS: Secure Your Website
Fix a site not served over HTTPS. Configure TLS, update links and canonicals, test forms and cookies, and verify the migration without promising ranking gains.
Read the explanation →sec.error-disclosure
Stack Trace Exposed on an Error Page: Stop Debug Disclosure
Fix a stack trace exposed on an error page. Disable public debug output, keep protected logs, preserve error status codes, and test HTML and API responses.
Read the explanation →sec.headers.hsts
Strict-Transport-Security Header Missing: Enable HSTS Safely
Fix a missing Strict-Transport-Security header. Roll out HSTS safely, verify max-age, and understand subdomain coverage, preload, and rollback limitations.
Read the explanation →sec.sri
Subresource Integrity Missing: Pin Trusted Script Files
Fix missing Subresource Integrity on external scripts. Pin exact bytes, configure CORS, test updates, and distinguish browser checks from scanner heuristics.
Read the explanation →sec.form-target-blank
target="_blank" links without rel="noopener"
Review target=_blank links without rel=noopener. Add explicit opener protection, preserve needed referral data, and test legitimate popup communication.
Read the explanation →sec.tls.protocol
Outdated TLS protocol version: 1.0 and 1.1 still enabled
Check whether TLS 1.0 and 1.1 remain enabled. Test each version explicitly, update the real TLS endpoint, and verify legacy clients and scanner limitations.
Read the explanation →sec.tls.cert-expiry
TLS Certificate Expiring Soon: Renew and Verify Deployment
Fix a TLS certificate expiring soon. Check the served certificate, repair renewal and deployment, verify every hostname, and add independent expiry monitoring.
Read the explanation →sec.third-party-scripts
Too Many Third-Party Scripts: Audit and Reduce Exposure
Audit too many third-party scripts. Find runtime vendors, remove unused tags, review ownership and consent, and test security and performance tradeoffs.
Read the explanation →sec.tls.cipher-strength
Weak Cipher Suite Negotiated: Review and Harden TLS
Fix a weak cipher suite finding. Review negotiated and supported suites, prefer modern AEAD configurations, test old clients, and understand scan limits.
Read the explanation →sec.wellknown-change-password
Password change URL missing (/.well-known/change-password)
Add a missing .well-known/change-password URL. Redirect to the real password settings page, preserve login return flow, and test soft-404 and scanner limits.
Read the explanation →sec.headers.nosniff
X-Content-Type-Options Header Missing: Add Nosniff Safely
Fix a missing X-Content-Type-Options header. Add nosniff, correct script and stylesheet MIME types, verify downloads, and test error and asset responses.
Read the explanation →sec.headers.xfo
X-Frame-Options Header Missing: Prevent Unwanted Framing
Fix a missing X-Frame-Options header or configure CSP frame-ancestors. Choose a policy, preserve legitimate embeds, and verify browser enforcement.
Read the explanation →sec.disclosure.powered-by
X-Powered-By Header: Remove Unnecessary Stack Disclosure
Remove the X-Powered-By header in Express, PHP, or your proxy. Check related disclosure headers, verify all response paths, and understand the limited benefit.
Read the explanation →Performance
Core Web Vitals readiness, payload, caching
perf.cache-headers
Cache-Control Header Missing: Declare the Right Policy
Fix a missing Cache-Control header. Choose policies for HTML, versioned assets and private responses, verify revalidation, and avoid unsafe shared caching.
Read the explanation →perf.cwv.cls
Cumulative Layout Shift Too High: Find and Stabilise Movement
Fix high Cumulative Layout Shift. Locate moving elements, reserve image and embed space, tune fonts, and compare the scan with standard CLS and field data.
Read the explanation →perf.cwv.fcp
First Contentful Paint Too Slow: Reduce the Blank Screen
Improve slow First Contentful Paint. Diagnose server delay, blocking CSS, scripts and fonts, test mobile rendering, and compare lab results with field data.
Read the explanation →perf.compression
Gzip compression not enabled on text responses
Fix missing text compression. Enable negotiated gzip or Brotli, inspect Content-Encoding, test HTML and assets, and avoid streaming or double-encoding failures.
Read the explanation →perf.page-weight
HTML Document Size Too Large: Reduce the Initial Payload
Reduce oversized HTML without hiding useful content. Find inline data and repeated markup, distinguish transfer from decoded size, and test content discovery.
Read the explanation →seo.image.filesize-hint
Images Not Served as WebP or AVIF: Verify Actual Formats
Review images not served as WebP or AVIF. Check actual response types, convert suitable assets, use responsive sources, and recognise URL-based scan limits.
Read the explanation →perf.cwv.lcp
Largest Contentful Paint Too Slow: Diagnose the Critical Path
Improve slow Largest Contentful Paint. Identify the LCP element, separate server and image delays, prioritise resources, and compare lab with field data.
Read the explanation →perf.ttfb
Slow Time to First Byte: Separate Network and Server Delay
Improve slow time to first byte. Separate network from server work, profile expensive routes, cache safely, and compare scanner and browser timing.
Read the explanation →perf.requests
Too Many HTTP Requests: Audit the Work Behind the Count
Reduce unnecessary HTTP requests. Audit third-party chains, defer noncritical media, preserve consent and core features, and verify bytes and main-thread work.
Read the explanation →perf.inline-scripts
Too Many Inline Scripts: Separate Code from Data
Review too many inline scripts. Separate executable code from JSON-LD and state, reduce repeated work, preserve load order, and verify actual blocking time.
Read the explanation →perf.stylesheets-count
Too Many Render-Blocking Stylesheets: Reduce Critical CSS Work
Audit too many render-blocking stylesheets. Remove unused CSS, shorten discovery chains, preserve the cascade, and verify real blocking rather than link count.
Read the explanation →perf.cwv.tbt
Total Blocking Time Too High: Reduce Long Main-Thread Tasks
Reduce high Total Blocking Time. Profile long tasks, cut unused JavaScript, split costly work, and distinguish the loading metric from real interaction latency.
Read the explanation →SEO
Indexability, metadata, structure, links
seo.links.broken-internal
Broken Internal Links: Find the Cause and Repair Navigation
Fix broken internal links and stale sitemap targets. Diagnose missing pages and server errors, update source links, and redirect to relevant replacements.
Read the explanation →seo.canonical.same-site
Canonical Pointing to Another Domain: Check the Intended URL
Review a canonical pointing to another domain. Check duplicate-content intent, repair production URL settings, and align links, sitemaps and canonical signals.
Read the explanation →seo.js-rendered-content
Content Only Rendered with JavaScript: Verify Indexable Output
Review JavaScript-rendered content. Compare source and rendered HTML, test crawler access, and use server rendering where it improves reliable delivery.
Read the explanation →seo.title.unique
Duplicate Title Tags: Give Distinct Pages Clear Titles
Fix duplicate title tags with page-specific templates. Review canonical groups, pagination and variants, preserve useful wording, and verify deployed metadata.
Read the explanation →seo.hreflang.valid
Invalid Hreflang Value: Use Supported Language Codes
Fix invalid hreflang values. Use supported language, region and script codes, check reciprocal alternates, and distinguish scanner patterns from Google support.
Read the explanation →seo.jsonld.valid
Invalid JSON-LD Syntax: Repair the Broken Data Block
Fix invalid JSON-LD syntax. Find parse errors, serialize safely, validate structured-data meaning separately, and verify deployed source and rendered output.
Read the explanation →seo.description.length
Meta Description Too Long or Too Short: Write a Useful Summary
Fix a meta description that is too long or too short. Write a useful summary, understand snippet truncation, and distinguish scanner budgets from Google limits.
Read the explanation →seo.canonical.present
Missing Canonical Tag: Declare the Preferred Equivalent URL
Review a missing canonical tag. Declare preferred equivalent URLs, preserve distinct pagination and translations, and align links, sitemaps and redirects.
Read the explanation →seo.h1.present
Missing H1 Tag: Give the Page a Meaningful Main Heading
Fix a missing H1 tag with a meaningful visible page heading. Check markup, image-only headings and rendered content, and preserve accessible document structure.
Read the explanation →seo.description.present
Missing Meta Description: Suggest an Accurate Page Summary
Fix a missing meta description with an accurate page-specific summary. Verify source output and fallbacks, and understand why Google may choose another snippet.
Read the explanation →seo.title.present
Missing Title Tag: Add a Specific Page Title
Fix a missing title tag in the document head. Generate page-specific titles, check server and rendered output, and avoid duplicate fallbacks across routes.
Read the explanation →seo.heading.single-topic
No H2 Subheadings on Page: Organise Substantial Content
Review a page with no H2 subheadings. Organise substantial content semantically, distinguish sections from widgets, and preserve readable responsive styling.
Read the explanation →seo.jsonld.present
No Structured Data Found: Verify Coverage Before Adding Markup
Review missing structured data. Check JSON-LD, microdata and rendered output, choose relevant entities, and validate meaning without promising ranking gains.
Read the explanation →seo.links.descriptive
Non-Descriptive Link Text: Make Destinations Clear
Fix generic link text such as click here and read more. Describe destinations, preserve accessible names, and distinguish scanner matches from WCAG failures.
Read the explanation →seo.og.image-declared
og:image Relative URL: Publish an Absolute Share Image
Fix a relative og:image URL. Generate a full HTTPS image address, verify public retrieval and metadata order, and test platform previews after cache refresh.
Read the explanation →seo.og.url
og:url missing - the page URL is not declared
Fix a missing og:url tag. Generate a clean absolute page identity, keep it consistent with canonical intent, avoid homepage defaults, and test shared previews.
Read the explanation →seo.og.basic
Open Graph Tags Missing: Make Shared Pages Recognisable
Fix missing Open Graph tags. Generate page-specific titles, descriptions and images, add the protocol identity fields, and verify actual platform previews.
Read the explanation →seo.jsonld.organization
Organization Schema Missing: Describe the Real Site Operator
Review missing Organization schema. Check graphs and subtypes, publish verified operator details, and distinguish organization identity from WebSite naming.
Read the explanation →seo.robots.noindex
Page Accidentally Noindexed: Verify Intent and Remove the Block
Fix accidental noindex. Inspect robots metadata and headers, preserve intentional exclusions, allow recrawling, and verify available Search Console evidence.
Read the explanation →seo.redirect.chain
Redirect Chain Too Long: Send Old URLs to the Final Destination
Shorten unnecessary redirect chains. Map old URLs to relevant final destinations, preserve required behaviour, update internal links, and test loops and errors.
Read the explanation →seo.robots-txt.not-blocking-all
Robots.txt Blocking the Entire Site: Check Effective Crawl Rules
Fix unintended robots.txt blocking. Inspect effective Googlebot rules, protect private environments properly, and verify important paths beyond the homepage.
Read the explanation →seo.robots-txt.present
Robots.txt Missing: Publish Deliberate Crawl Instructions
Review a missing robots.txt. Publish deliberate rules and a sitemap location, verify response handling, and distinguish absence from retrieval failures.
Read the explanation →seo.title.length
Title Tag Too Long or Too Short: Preserve the Useful Topic
Improve title tags that are too long or too short. Preserve the distinguishing topic, reduce boilerplate, verify templates, and understand display truncation.
Read the explanation →seo.twitter.card
Twitter Card Tags Missing: Declare and Test X Preview Metadata
Review missing Twitter Card metadata for X. Choose an appropriate card type, check documented Open Graph fallbacks, verify image delivery, and test previews.
Read the explanation →seo.url.structure
Unreadable URLs with Query Parameters: Review Before Migrating
Review complex query URLs. Keep legitimate IDs and pagination, control duplicate variants, and migrate only with relevant redirects and complete testing.
Read the explanation →seo.sitemap.present
XML Sitemap Missing: Publish and Verify a Useful URL List
Fix a missing XML sitemap. Publish preferred URLs, declare its location, verify child files and lastmod, and distinguish scanner limits from Google support.
Read the explanation →Accessibility
WCAG signals, semantics, contrast
a11y.axe.area-alt
Active Area Elements Must Have Alternative Text: Name Each Link
Fix image-map area links missing alternative text. Name each destination, preserve the image context, test coordinate behaviour, and offer usable alternatives.
Read the explanation →a11y.axe.aria-conditional-attr
ARIA Attributes Must Match Role Conditions and Native State
Fix conditionally invalid ARIA attributes. Keep native checkbox state authoritative, review row hierarchy semantics, and verify updates after real interaction.
Read the explanation →a11y.axe.aria-valid-attr
ARIA Attributes Must Conform to Valid Names: Fix the Vocabulary
Fix invalid ARIA attribute names. Correct spelling, separate role and data attributes, verify vocabulary support, and inspect actual accessibility behaviour.
Read the explanation →a11y.axe.aria-valid-attr-value
ARIA Attributes Must Conform to Valid Values: Fix Types and References
Fix invalid ARIA values and references. Use defined tokens and numeric formats, keep IDs current, and verify real state across dynamic component transitions.
Read the explanation →a11y.axe.aria-braille-equivalent
ARIA Braille Attributes Must Have a Non-Braille Equivalent
Review ARIA braille labels and role descriptions. Preserve ordinary names, use specialised variants only when justified, and test speech and braille output.
Read the explanation →a11y.axe.aria-command-name
ARIA Commands Must Have an Accessible Name: Prefer Clear Actions
Name custom ARIA buttons, links and menu items. Prefer native controls, keep visible labels consistent, and test activation, focus and dynamic states.
Read the explanation →a11y.axe.aria-hidden-focus
ARIA-Hidden Elements Must Not Expose Hidden Keyboard Stops
Fix focus inside aria-hidden content. Choose true hiding or inert regions, move focus safely, and restore interactions without relying on tabindex alone.
Read the explanation →a11y.axe.aria-hidden-body
Aria-Hidden True Must Not Be Present on the Document Body
Remove inappropriate aria-hidden from the body. Repair modal boundaries, manage focus and inactive regions, and rescan content omitted from earlier tests.
Read the explanation →a11y.axe.aria-input-field-name
ARIA Input Fields Must Have an Accessible Name: Label the Widget
Name custom ARIA fields with correct label relationships. Prefer native controls, preserve purpose and value semantics, and test full keyboard interaction.
Read the explanation →a11y.axe.aria-meter-name
ARIA Meter Nodes Must Have an Accessible Name: Identify the Measure
Label ARIA meters with the quantity they measure. Keep range and value text accurate, prefer native elements where useful, and distinguish gauges from progress.
Read the explanation →a11y.axe.aria-progressbar-name
ARIA Progressbar Nodes Must Have an Accessible Name: Name the Task
Name ARIA progress bars for their task. Handle known and indeterminate progress correctly, avoid noisy updates, and test completion and failure states.
Read the explanation →a11y.axe.aria-roledescription
Aria-Roledescription Must Be on Elements with a Semantic Role
Review aria-roledescription on meaningful roles. Use custom wording sparingly, preserve familiar interaction semantics, and test speech and braille output.
Read the explanation →a11y.axe.aria-roles
ARIA Roles Used Must Conform to Valid Values: Choose Real Semantics
Fix invalid ARIA role values. Replace invented or abstract roles, understand fallback tokens, prefer native HTML, and verify the complete widget behaviour.
Read the explanation →a11y.axe.aria-tab-name
ARIA Tab Nodes Must Have an Accessible Name: Identify Each Panel
Name ARIA tabs with meaningful labels. Preserve names at narrow widths, connect panels correctly, and test selection and focus beyond the naming rule.
Read the explanation →a11y.axe.aria-toggle-field-name
ARIA Toggle Fields Must Have an Accessible Name: Label the Setting
Name custom switches, checkboxes, radios and options. Keep setting labels stable, expose true state, and test keyboard behaviour and visible label consistency.
Read the explanation →a11y.axe.aria-tooltip-name
ARIA Tooltip Nodes Must Have an Accessible Name: Supply Useful Text
Fix empty ARIA tooltips. Provide useful description text, connect the trigger, support keyboard dismissal, and test dynamic behaviour beyond the initial scan.
Read the explanation →a11y.axe.audio-caption
Audio Elements and Captions Tracks: Provide a Usable Transcript
Make prerecorded audio accessible with an equivalent transcript. Understand audio-caption limits and verify the real alternative, not merely a track element.
Read the explanation →a11y.axe.autocomplete-valid
Autocomplete Attribute Must Be Used Correctly: Fix Field Purpose
Fix invalid autocomplete attributes. Match supported tokens to user information, preserve useful labels, and test autofill without promising full compliance.
Read the explanation →a11y.axe.blink
Blink Elements Are Obsolete: Remove Markup, Review Actual Motion
Remove obsolete blink elements without losing content. Review actual CSS and scripted motion separately, provide necessary controls, and assess flashing risks.
Read the explanation →a11y.axe.button-name
Buttons Must Have Discernible Text: Name the Action
Fix unnamed buttons with useful accessible names. Prefer visible action text, label icons carefully, preserve keyboard behaviour, and verify computed names.
Read the explanation →a11y.axe.aria-required-parent
Certain ARIA Roles Must Be Contained by Particular Parents
Fix ARIA required-parent findings. Check ownership and wrappers, prefer native structures, and implement complete widgets instead of merely adding roles.
Read the explanation →a11y.axe.aria-required-children
Certain ARIA Roles Must Contain Particular Children: Fix Structure
Fix ARIA required-child findings. Check owned roles and wrappers, preserve native semantics, handle loading states, and implement keyboard behaviour separately.
Read the explanation →a11y.axe.css-orientation-lock
CSS Media Queries Must Not Lock Display Orientation
Remove unintended orientation restrictions. Keep tasks usable in portrait and landscape, inspect overlays and scripts, and separate scan coverage from WCAG.
Read the explanation →a11y.axe.table-fake-caption
Data or Header Cells Must Not Be Used as a Data Table Caption
Replace fake table titles with appropriate captions or naming. Preserve spanning headers, verify cell relationships, and account for the disabled scan rule.
Read the explanation →a11y.axe.meta-refresh
Delayed Refresh Under 20 Hours Must Not Be Used: Remove Timing Barriers
Fix delayed meta refresh and redirects. Preserve user control, choose appropriate server redirects, and distinguish scan thresholds from timing requirements.
Read the explanation →a11y.axe.aria-deprecated-role
Deprecated ARIA Roles Must Not Be Used: Migrate Meaningfully
Replace deprecated ARIA roles with appropriate native structures. Review directory and publishing roles, preserve links and grouping, and test real support.
Read the explanation →a11y.axe.definition-list
DL Elements Must Contain Properly Ordered DT and DD Groups
Fix malformed description lists. Preserve valid term-description groups and wrappers, remove stray content, and manually verify ordering beyond the rule.
Read the explanation →a11y.axe.document-title
Documents Must Have a Title Element to Aid in Navigation
Fix an empty rendered document title. Describe each view, compare source and browser output, and test route changes without assuming every title is useful.
Read the explanation →a11y.axe.dlitem
DT and DD Elements Must Be Contained by a DL: Restore Structure
Fix dt and dd outside a description list. Use valid term-description groups, preserve appropriate wrappers, and test semantics as well as responsive styling.
Read the explanation →a11y.axe.label-content-name-mismatch
Visible Text Must Be Part of the Accessible Name: Match Labels
Keep visible control labels in accessible names. Review ARIA overrides, preserve useful context, and test voice interaction beyond the disabled scanner rule.
Read the explanation →a11y.axe.color-contrast
Elements Must Meet Minimum Color Contrast Ratio Thresholds
Fix insufficient text contrast. Apply 4.5:1 and large-text 3:1 thresholds, test themes and states, and manually review uncertain backgrounds and scan results.
Read the explanation →a11y.axe.aria-prohibited-attr
Elements Must Only Use Permitted ARIA Attributes: Fix Prohibited Naming
Fix prohibited ARIA attributes by inspecting the real role. Move names to the right control, preserve useful text, and avoid adding roles merely to pass checks.
Read the explanation →a11y.axe.aria-allowed-attr
Elements Must Only Use Supported ARIA Attributes: Match Role and State
Fix role and ARIA property mismatches. Choose the intended interaction, use supported states, preserve native semantics, and test actual updates after input.
Read the explanation →a11y.axe.label
Form Elements Must Have Labels: Name Fields Persistently
Fix unnamed form fields with associated visible labels. Keep placeholders for hints, check computed names and errors, and test dynamic forms and repeated IDs.
Read the explanation →a11y.axe.form-field-multiple-labels
Form Field Must Not Have Multiple Label Elements: Review the Name
Review multiple labels without assuming invalid HTML. Remove accidental duplicates, preserve deliberate naming, and test visible guidance and computed names.
Read the explanation →a11y.axe.frame-title-unique
Frames Must Have a Unique Title Attribute: Distinguish the Content
Review duplicate frame titles for meaningful distinctions. Name the embedded purpose, preserve valid repetition, and test actual frame navigation.
Read the explanation →a11y.axe.frame-focusable-content
Frames with Focusable Content Must Not Have Tabindex Minus One
Review iframe tabindex=-1 when embedded controls need keyboard access. Test entry, operation and exit, restore active states, and assess framed content.
Read the explanation →a11y.heading-order
Heading Levels Skipped: Repair the Outline Without Styling by Tag
Review skipped heading levels. Match the real content hierarchy, separate semantic levels from visual styles, and verify rendered and source outlines.
Read the explanation →a11y.axe.html-xml-lang-mismatch
HTML Lang and XML:Lang Must Have the Same Base Language
Resolve lang and xml:lang conflicts. Check the served document type, declare the real language, and distinguish full consistency from a base-code pass.
Read the explanation →a11y.html-lang
HTML Lang Attribute Missing: Declare the Actual Page Language
Fix a missing HTML lang attribute. Declare the real language, mark changes, preserve valid BCP 47 tags, and test assistive output without ranking promises.
Read the explanation →a11y.axe.duplicate-id-aria
IDs Used in ARIA and Labels Must Be Unique: Repair References
Repair duplicate IDs used by labels and ARIA. Generate stable instance IDs, update references together, and test actual names beyond omitted review results.
Read the explanation →a11y.iframe-title
Iframes missing a title attribute
Fix iframe titles that are missing or blank. Describe embedded purpose, compare source and rendered naming checks, and test the framed experience separately.
Read the explanation →a11y.axe.input-image-alt
Image Buttons Must Have Alternative Text: Name the Action
Fix image-submit alternatives with useful action text. Preserve submission behaviour, inspect computed names, and do not treat active controls as decoration.
Read the explanation →a11y.img-alt
Images Missing Alt Text: Provide Context-Appropriate Alternatives
Fix images missing alt text. Separate decorative, informative and functional images, preserve link names, and verify meaning beyond the scanner attribute count.
Read the explanation →a11y.axe.avoid-inline-spacing
Inline Text Spacing Must Be Adjustable: Support User Preferences
Support text-spacing changes without lost content. Review restrictive inline styles, test all four WCAG settings, and distinguish CSS cascade origins.
Read the explanation →a11y.axe.input-button-name
Input Buttons Must Have Discernible Text: Identify the Action
Name input button, submit and reset controls. Use clear captions, preserve submitted values, inspect ARIA overrides, and test actions and localisation.
Read the explanation →a11y.axe.nested-interactive
Interactive Controls Must Not Be Nested: Separate Actions
Fix nested interactive controls. Separate navigation and actions, preserve keyboard access and focus, and inspect rendered semantics instead of masking clicks.
Read the explanation →a11y.axe.valid-lang
Lang Attribute Must Have a Valid Value: Identify the Actual Language
Fix language declarations in page content. Use appropriate BCP 47 tags, verify the real language, and distinguish checker vocabulary from full validation.
Read the explanation →a11y.axe.listitem
LI Elements Must Be Contained in a UL or OL: Fix the Parent
Fix orphaned list items with a native list parent. Remove accidental wrappers, preserve valid widget semantics, and test both structure and interaction.
Read the explanation →a11y.axe.link-in-text-block
Links Must Be Distinguishable Without Relying on Color
Make inline links recognisable beyond hue alone. Prefer robust underlines, check text and background contrast separately, and test focus and interaction states.
Read the explanation →a11y.axe.link-name
Links Must Have Discernible Text: Expose a Useful Destination
Fix unnamed links with useful accessible names. Review icon and image links, preserve native navigation, and separate naming from contextual link purpose.
Read the explanation →a11y.axe.marquee
Marquee Elements Are Deprecated: Replace Uncontrolled Scrolling
Replace obsolete marquee elements with readable content. If motion remains, provide usable controls, respect reduced motion, and review actual behaviour.
Read the explanation →a11y.axe.td-has-header
Data Cells in Larger Tables Must Have Associated Headers
Associate data cells with useful headers. Use th, scope or valid explicit references, and review small tables and the disabled rule coverage separately.
Read the explanation →a11y.axe.object-alt
Object Elements Must Have Alternative Text: Name the Embed
Fix unnamed object embeds. Label the resource, keep a usable outside link or equivalent, preserve interaction, and test the embedded document itself.
Read the explanation →a11y.axe.bypass
Page Must Have Means to Bypass Repeated Blocks: Provide a Real Route
Provide a useful way past repeated navigation. Combine skip links, clear structure and tested keyboard behaviour without relying on the omitted bypass rule.
Read the explanation →a11y.axe.aria-required-attr
Required ARIA Attributes Must Be Provided: Expose Real State
Supply required ARIA properties for the actual role. Preserve native states, review defaults and exceptions, and test truthful updates beyond presence.
Read the explanation →a11y.axe.role-img-alt
Role Img Elements Must Have Alternative Text: Name the Graphic
Fix unnamed image-role elements. Describe the graphic through a suitable accessible name, handle decoration separately, and preserve meaningful interaction.
Read the explanation →a11y.axe.scrollable-region-focusable
Scrollable Region Must Have Keyboard Access: Reach the Hidden Content
Make overflow content reachable by keyboard. Review focusable scrollers and descendants, preserve visible focus, and test scrolling and exit.
Read the explanation →a11y.axe.select-name
Select Element Must Have an Accessible Name: Label the Question
Fix an unnamed select with a persistent label. Separate the field name from its selected option, verify naming references, and test keyboard selection.
Read the explanation →a11y.axe.server-side-image-map
Server-Side Image Maps Must Not Be Used: Provide Usable Choices
Replace pointer-dependent ismap navigation with equivalent keyboard choices. Review existing alternatives, label client-side areas, and test every destination.
Read the explanation →a11y.skip-link
Skip to Content Link Missing: Add and Test a Useful Bypass
Add a useful skip-to-content link. Verify its target, focus visibility and keyboard continuation, and understand the source check language and ordering limits.
Read the explanation →a11y.axe.p-as-heading
Styled P Elements Must Not Be Used as Headings: Expose Structure
Review paragraphs styled as headings. Use meaningful heading semantics, preserve visual design, and separate actual emphasis from the disabled heuristic.
Read the explanation →a11y.axe.summary-name
Summary Elements Must Have Discernible Text: Name the Disclosure
Name details-summary disclosures with useful text. Preserve native interaction, align visible and accessible wording, and test open and closed states.
Read the explanation →a11y.axe.svg-img-alt
SVG Elements with an Image Role Must Have Alternative Text
Fix unnamed SVG graphics with image roles. Add a correct title or ARIA name, keep repeated IDs unique, and preserve meaningful control and chart information.
Read the explanation →a11y.axe.td-headers-attr
Table Cell Headers Attributes Must Refer to TH Elements in the Same Table
Repair table headers references. Point to real headers in the same table, keep IDs unique, and preserve correct associations through dynamic updates.
Read the explanation →a11y.axe.th-has-data-cells
Table Headers in a Data Table Must Refer to Data Cells
Review table headers unrelated to data. Preserve meaningful groups, empty states and relationships, and assess review cases omitted by the report.
Read the explanation →a11y.axe.list
UL and OL Must Only Directly Contain Valid List Children
Fix invalid ul and ol children. Keep li items directly inside the list, preserve script and template elements, and verify semantics after layout changes.
Read the explanation →a11y.viewport-zoom
Zoom Disabled by User-Scalable=No: Restore Accessible Resizing
Fix viewport settings that restrict zoom. Remove unnecessary scale caps, test text enlargement and layout, and distinguish the scan from full WCAG compliance.
Read the explanation →a11y.axe.video-caption
Video Elements Must Have Captions: Verify Equivalent Timed Text
Provide accurate timed captions for relevant prerecorded video. Test playback and accessibility, not merely a track tag or an absent review-only finding.
Read the explanation →a11y.axe.no-autoplay-audio
Video or Audio Must Not Play Automatically: Control Sound
Review automatic audio and video playback. Prevent unwanted sound, provide accessible independent controls, and test motion and media alternatives separately.
Read the explanation →UX quality
Clarity, states, navigation, trust
ux.404-helpful
404 Page Without Navigation: Offer Useful Recovery Paths
Improve a 404 page without navigation. Offer useful onward links, preserve the actual error status, and test section-specific pages beyond the link-count rule.
Read the explanation →ux.conversion-path
Broken sign-up or buy link
Repair a broken sign-up or purchase link. Review the recorded status, update its source, test the authorised journey, and recognise external-host scan limits.
Read the explanation →saas.auth-surface
Login or sign-in link missing from the website
Review a missing login-link warning. Make account access discoverable, keep sign-up separate, and test translated or external links the heuristic may miss.
Read the explanation →saas.changelog
No Changelog Page: Make Real Product Changes Discoverable
Review a missing changelog warning. Publish truthful dated updates, link existing release notes, and distinguish a matching link from maintenance evidence.
Read the explanation →saas.docs
No Documentation Link on Website: Make Reliable Help Discoverable
Review missing documentation-link detection. Link useful setup and help resources, preserve proper access restrictions, and verify actual support routes.
Read the explanation →saas.status-page
No Status Page Link: Give Users a Reliable Incident Route
Review missing status-page links. Publish useful incident information, keep the route reachable during failures, and test hosted pages beyond the heuristic.
Read the explanation →ux.trust-signals
No Trust Signals on Website: Publish Truthful Relevant Evidence
Review missing trust-signal detection. Publish real relevant evidence, respect permissions and scope, and separate a matching link from verified credibility.
Read the explanation →ux.navigation-present
Page Without Navigation Links: Provide Meaningful Onward Routes
Review pages with few same-host links. Add useful onward navigation, respect focused flows, and test real menus beyond the link-count heuristic.
Read the explanation →ux.form-labels
Placeholder used instead of a label in forms
Review fields relying on placeholders. Provide persistent questions and accessible names, and distinguish a source heuristic from actual form usability.
Read the explanation →saas.pricing-page
Pricing Page Missing: Explain the Actual Cost Model
Review a missing pricing-page warning. Explain real plans, limits or quote-based costs, and distinguish link wording from clear commercial information.
Read the explanation →tech.custom-404
Soft 404 - missing pages return 200
Fix missing pages that return success. Verify route, status and rendered content, preserve useful recovery, and distinguish the probe from Google soft 404s.
Read the explanation →ux.thin-content
Thin Content Page: Assess Task Completion Before Adding Words
Review low-text pages without padding. Check task value, content delivery and boilerplate, and distinguish the 200-character rule from Google guidance.
Read the explanation →ux.title-h1-align
Title and H1 Do Not Match: Align the Topic, Not Every Word
Review title and H1 alignment without forcing identical text. Keep the topic clear, account for language and synonyms, and recognise the one-word heuristic.
Read the explanation →ux.search-available
Website Search Missing: Review Findability Before Adding a Search Box
Review missing site-search detection. Match search to real content and user needs, label it clearly, and test results beyond the crawl-size heuristic.
Read the explanation →Technical
Status codes, rendering, assets, canonicals
tech.status.ok
Crawled pages returning a 4xx or 5xx status
Review crawled HTTP errors. Separate expected removal from server failure, repair references, investigate excluded responses, and test the exact public route.
Read the explanation →tech.failed-requests
Failed to Load Resource Errors: Separate Network Failures from HTTP Errors
Diagnose resources failing before an HTTP response. Inspect network evidence, preserve security controls, and separate request failures from status errors.
Read the explanation →tech.favicon
Favicon Missing: Declare and Verify a Real Site Icon
Fix a missing favicon declaration. Link a real appropriate icon from the homepage, verify retrieval and supported formats, and understand search-display limits.
Read the explanation →tech.console-errors
JavaScript Errors in Console: Diagnose the Message and Real Impact
Investigate console errors without hiding them. Separate logged messages from uncaught exceptions, inspect network and policy failures, and test actual tasks.
Read the explanation →tech.charset
Meta Charset Missing: Declare the Encoding That Matches the Bytes
Fix missing character-encoding declarations. Match UTF-8 bytes and headers, place metadata early, and verify real decoding rather than a presence-only pass.
Read the explanation →tech.doctype
Missing Doctype HTML: Select No-Quirks Rendering Deliberately
Fix missing HTML doctypes. Use the modern short form, inspect actual rendering mode, and distinguish raw-prefix checks from browser parsing behaviour.
Read the explanation →Compliance
GDPR, policies, consent, transparency
comp.accessibility-statement
Accessibility Statement Missing: Check Scope and Publish Accurate Information
Review missing accessibility information. Identify the applicable regime, publish evidence-based details, and separate link recognition from actual access.
Read the explanation →comp.cookie-consent
Analytics Without Cookie Consent: Verify Actual Behaviour and Legal Scope
Review analytics without detected consent tooling. Inspect storage, requests and choices, distinguish consent modes, and avoid verdicts from tag presence.
Read the explanation →comp.contact-info
Contact Information Missing on Website: Identify the Real Operator
Review operator-contact detection. Publish applicable identity and contact details, keep routes working, and distinguish link matches from complete information.
Read the explanation →comp.consent.banner-present
Cookie Banner Missing: Check Whether Consent and a Usable Choice Are Needed
Review a missing cookie banner with observed tracking. Assess actual consent requirements, fresh-state behaviour, unreadable dialogs and the detection window.
Read the explanation →comp.cookie-policy
Cookie Policy Link Missing: Make the Actual Information Discoverable
Review cookie-policy links. Explain actual technologies, purposes and choices, keep information current, and separate a word match from informed consent.
Read the explanation →comp.consent.pre-consent-cookies
Cookies Set Before Consent: Verify the Observed Identifier and Timing
Review cookies observed before choice. Verify purpose and exemptions, inspect fresh and saved states, and distinguish name-list evidence from a legal verdict.
Read the explanation →comp.dpo-contact
Data Protection Officer Contact Missing: Verify the Responsible Route
Review privacy-contact detection. Separate controller and DPO roles, check appointment duties, and publish a working contact route in the actual notice.
Read the explanation →comp.consent.pre-consent-storage
LocalStorage Tracking Before Consent: Review Device Access Beyond Cookies
Review tracking identifiers in localStorage and sessionStorage before choice. Assess purpose, gate relevant SDKs, and test other storage outside the detector.
Read the explanation →comp.consent.reject-first-layer
No Reject All Button on Cookie Banner: Provide a Genuine Refusal Route
Review acceptance without a direct refusal option. Apply relevant authority guidance, test rejection, and distinguish initial refusal from later withdrawal.
Read the explanation →comp.consent.prechecked-toggle
Pre-Ticked Cookie Consent Boxes: Require an Actual Optional Choice
Remove preselected consent opt-ins. Check actual necessity, saved preferences and hidden panels, then test resulting storage and requests.
Read the explanation →comp.privacy-policy
Privacy Policy Link Missing: Provide Accurate Accessible Information
Make privacy information clear and accurate. Review identity, purposes and rights, provide notices when needed, and separate link detection from compliance.
Read the explanation →comp.consent.reject-parity
Reject button less prominent than Accept: refusal made harder
Review consent-button prominence through measurements and context. Keep refusal usable, and distinguish scanner thresholds from legal standards.
Read the explanation →comp.terms
Terms of Service Link Missing: Make the Applicable Contract Information Available
Review a missing terms link. Assess contract and consumer-information duties, publish relevant terms, and separate link recognition from legal sufficiency.
Read the explanation →comp.consent.pre-consent-requests
Tracking Requests Before Cookie Consent: Inspect the Actual Transmission
Review pre-choice requests to tracking hosts. Inspect the actual operation and consent state, and distinguish container downloads from event processing.
Read the explanation →Mobile readiness
Viewport, tap targets, responsive integrity
mobile.touch-icon
Apple Touch Icon Missing: Declare and Test the Home-Screen Asset
Add an appropriate Apple touch icon, verify the actual image and saved-site result, and recognise where filename and icon-count heuristics misclassify it.
Read the explanation →mobile.responsive-images
Images Without Srcset: Deliver Suitable Responsive Resources
Review images without srcset. Match candidates and sizes to actual layout and density, prioritise useful savings, and test the resources the browser selects.
Read the explanation →perf.mobile.lcp
Slow LCP on Mobile: Diagnose the Measured Critical Path
Improve mobile LCP by finding the candidate and delay. Compare lab and field conditions, prioritise resources, and understand the shared score.
Read the explanation →mobile.tap-targets
Tap Targets Too Small: Measure CSS Size and Applicable Exceptions
Review small tap targets using CSS pixels and WCAG exceptions. Measure active areas, preserve useful spacing, and separate scan severity from conformance.
Read the explanation →mobile.viewport.present
Viewport Meta Tag Missing: Declare the Intended Mobile Layout
Fix a missing or empty viewport declaration. Set a suitable responsive baseline, preserve zoom, and test actual layout rather than presence-only metadata.
Read the explanation →mobile.viewport.config
Viewport Width=Device-Width Missing: Review the Configuration
Review a viewport without explicit width=device-width. Understand fixed-width and scale behaviour, preserve zoom, and verify real breakpoints and layout.
Read the explanation →Browser compat
Engine coverage, fallbacks, legacy risk
tech.deprecated-tags
Deprecated HTML Tags in Use: Replace Legacy Markup Without Losing Meaning
Replace obsolete HTML without losing meaning. Review semantics, CSS and legacy embeds, and separate a short tag list from full compatibility testing.
Read the explanation →compat.viewport-units
IE Conditional Comments in HTML: Review Consumers Before Removing Code
Review conditional comments without deleting useful content. Keep needed email support, distinguish block types, and test actual dependencies.
Read the explanation →compat.lang-region
Inconsistent HTML Lang Across Pages: Check the Language of Each Page
Review language differences across pages. Preserve multilingual content, match declarations to real text, and test source and rendered templates.
Read the explanation →compat.charset-utf8
Page Not Encoded in UTF-8: Align Actual Bytes and Declarations
Review non-UTF-8 declarations. Inspect bytes and headers, test conversion on a backup, and verify storage, forms and integrations before release.
Read the explanation →