“Accessibility audit” is one of the most overloaded phrases in this industry. One vendor means a 40-page document produced by a person who navigated your checkout with a screen reader. Another means a PDF auto-exported by a scanner in eight seconds. Same word, wildly different value — and if you’re buying, the gap between them is exactly where money gets wasted and lawsuits slip through. This guide breaks down what a real audit contains, what you should receive, and the red flags that tell you a “scan” is actually a sales pitch.
Automated testing: useful, but only the floor
Every credible audit starts with automated scanning, because it’s fast and great at catching high-volume, machine-detectable problems: missing image alt text, low color contrast, empty buttons, and missing form labels. The scale of these issues is real. WebAIM’s 2025 analysis of the top one million home pages found that 94.8% had detectable WCAG failures, with an average of about 51 errors per page (WebAIM Million 2025).
But automation has a ceiling. Deque’s study of over 2,000 audits — covering more than 13,000 pages and nearly 300,000 issues — found that automated tools identify roughly 57% of accessibility issues by volume, higher than the traditional “20–30%” estimate but still far from complete (Deque). A scanner can tell you a link has no text. It cannot tell you whether “click here” makes sense out of context, whether your modal traps keyboard focus, or whether your reading order matches the visual layout. Those require a human.
Manual testing: where the real barriers are found
This is the part overlay vendors and cheap scanners skip, and it’s the part that actually determines whether a disabled person can use your site. A manual auditor works through your key templates by hand and checks the things machines miss:
- Keyboard-only operation — can you reach and use every control with Tab, Enter, Escape, and arrow keys, without getting trapped? See our keyboard navigation guide for what good looks like.
- Logical focus order and visible focus — does the highlight move in a sensible order, and can you always see where you are?
- Meaningful structure — real headings, landmarks, lists, and tables, not divs styled to look like them.
- Content quality — alt text that conveys meaning, descriptive link and button names, and clear error messages on forms.
A good auditor doesn’t test every page — they test every unique template and user flow: homepage, product page, cart, checkout, search, account login, contact form. When you compare quotes, ask exactly how many templates and flows are in scope. That number, more than the page count, tells you how thorough the audit really is.
Assistive-technology testing: using the site the way real users do
The highest-signal step is running your site with the same tools your visitors use. That means screen readers — NVDA and JAWS on Windows, VoiceOver on Mac and iOS — plus voice control and screen magnification. A page can pass an automated scan and still be unusable with a screen reader because the announcements are confusing, the order is wrong, or dynamic updates are silent. AT testing is how you catch that. If a proposal doesn’t mention screen-reader testing by name, it isn’t a complete audit.
The deliverables you should actually receive
A proper audit is judged by what lands in your inbox. Insist on:
- A findings report mapped to WCAG 2.1 AA success criteria — each issue tied to a specific criterion, with the page or component, what’s wrong, and how to reproduce it. WCAG is the standard the U.S. Department of Justice points to as guidance for web accessibility under the ADA (ADA.gov).
- Severity and a prioritized remediation roadmap — blockers first, cosmetic issues later, so your developers know what to fix on Monday.
- A VPAT, if you need one — a Voluntary Product Accessibility Template is a standardized conformance document, useful mainly for selling to government or enterprise buyers. A VPAT is a summary of conformance claims, not a substitute for the detailed findings report. Don’t accept a VPAT alone in place of a real audit.
If the deliverable is a generic checklist with no page-specific findings and no reproduction steps, your team can’t act on it — and you’ve bought a document, not an audit.
Red flags: when a “scan” is really a sales pitch
The biggest trap is the free “scan” offered by accessibility overlay companies. It looks like an audit but functions as lead-gen for a JavaScript widget that promises instant compliance. It doesn’t deliver. Overlays don’t fix the underlying code, and they haven’t reliably kept anyone out of court: more than 5,000 digital accessibility lawsuits were filed in 2025, and hundreds specifically targeted companies that already had a widget installed (UsableNet). In a landmark action, the FTC issued a final order in April 2025 requiring overlay maker accessiBe to pay $1 million for deceptive claims that its automated tool could make any website WCAG-compliant (FTC). We dig into the mechanics in do accessibility overlays work?.
Other warning signs: a price that seems too cheap to involve a human; no mention of keyboard or screen-reader testing; a “100% compliant” guarantee (no honest vendor promises that); and findings with no severity ratings or reproduction steps. A quick scan is a fine starting signal — just don’t mistake it for the finished product.
How this fits together
An audit doesn’t make you compliant; it tells you the truth about where you stand. The value is in what comes next — fixing the real barriers in your HTML, ARIA, and content, then keeping them fixed as the site evolves. That’s the manual, anti-overlay approach Curbcut takes, and it’s why we treat the audit as the first chapter, not the whole book. (For context on budgeting, see what ADA compliance costs; none of this is legal advice — consult an attorney about your specific risk.)
Want a fast first look before commissioning a full audit? Run a free accessibility scan to see roughly where your site stands, then talk to us about a thorough manual audit.