The mechanics

Four phases. No widget. Nothing inserted into your storefront.

We do not modify your site. We do not ship a script tag. We crawl politely, scan with the same engine Microsoft and Google use, translate findings into instructions a non-developer can apply, and generate attestation PDFs your attorney can hand to opposing counsel.

  1. PHASE 01

    Crawl your store, politely.

    We respect robots.txt and rate-limit to 1 request per second per host. Default crawl reads up to 25 pages on the Scanner plan, 50 on Defense, 100 on Agency — from sitemap.xml or following same-origin links. Customer URLs treated as PII — never logged at INFO, never retained beyond 90 days.

    • Playwright Chromium · headless · WCAG 2.2 AA ruleset
    • Same-origin crawl + sitemap.xml / sitemap_index.xml
    • 1 req/sec/host politeness — overridable on Agency plan
  2. PHASE 02

    Run axe-core 4.11 on every page.

    We use the same engine Microsoft, Google, and the U.S. government use for accessibility audits. Findings are de-duplicated, grouped by rule, and ranked by lawsuit-trigger probability based on 2025-2026 case-law citations.

    • axe-core 4.11 · Deque-maintained · open source
    • Per-finding $ or € risk exposure (cited methodology)
    • Diff vs previous scan: fixed · new · unchanged
  3. PHASE 03

    Translate every finding into merchant English.

    Native human-written translations for the top 30 axe rules. We tell you which file to open, which line to look at, which attribute to add. Then we map the violation to the installed Shopify app that introduced it (Klaviyo, Yotpo, Privy, ReConvert, and more).

    • 30 native translations · auditable in our methodology page
    • Shopify-app attribution database · 16 top apps
    • Confidence label on every attribution
  4. PHASE 04

    Generate the legal-defense attestation.

    On the Defense plan, every completed scan triggers the WeasyPrint pipeline. PDF rendered in <6s. 8 mandated sections. Region-aware (US ADA / EU EAA). Hash-verified. Downloadable from your account dashboard at any time while your subscription is active.

    • WeasyPrint · static HTML → PDF · deterministic output
    • SHA-256 integrity hash printed on every page
    • Region-aware: US ADA framing or EU EAA + EN 301 549

Translation, end-to-end

What axe says vs. what ScanAccess says.

A side-by-side of three real findings: the raw axe-core output, the merchant-English translation, the Shopify-app attribution, and the lawsuit-risk exposure.

Raw axe-core output

color-contrast
Element has insufficient color contrast (1.92:1 vs 4.5:1)

ScanAccess translates

Your newsletter button on /pages/about (text #777 on white) is invisible to ~32% of users with low vision. Open Klaviyo → Forms → Newsletter, set button text color to #1F2937 or darker.

Introduced by: Klaviyo Email Marketing

$672 estimated lawsuit exposure

Raw axe-core output

image-alt
Images must have alternative text

ScanAccess translates

9 product images on /collections/all are missing alt text. Open Shopify Admin → Products → click each → set the alt-text field to a 5-10 word product description (e.g. 'Hammered silver hoop earring on white background').

Introduced by: Shopify base theme

$468 estimated lawsuit exposure

Raw axe-core output

button-name
Buttons must have discernible text

ScanAccess translates

Your sticky cart drawer button (selector: .recharge-cart-button) has no accessible name. Open ReCharge → Customizations → Cart drawer → set ARIA label to 'Open cart drawer'.

Introduced by: ReCharge Subscriptions

$312 estimated lawsuit exposure

What's NOT under the hood

No script tag. No DOM injection. No 'AI'-magic.

We do NOT inject scripts into your storefront

Overlays add a runtime widget that modifies what sighted users see. That is the technique courts have rejected. We never touch your live site.

We do NOT 'fix' violations automatically

Automated remediation is what got AccessiBe fined $1M. We give you human-language instructions; you make the change in your theme or app settings.

We do NOT claim 100% coverage

Automated tools detect 25–57% of violations. We say so on every report. The manual-review checklist is in every PDF.

We do NOT log your customer URLs at INFO level

URLs are treated as PII. Scan retention defaults to 90 days. Account deletion erases scan data within 7 days. GDPR Art. 20 export endpoint included.

See it on your own store. Free.

3 free scans per visitor (lifetime). No card. Results render in ~30 seconds.

No signup. No card. 3 free scans per visitor (lifetime).

GitHub Action