WCAG Accessibility Report

This is a custom tool available in addition to the standard Watch My Domains SED interface. To access custom tools, look for the custom tools icon in the main toolbar. These custom tools will be available in versions released after March/April 2026.

The WCAG Accessibility Report lets you check how accessible the websites in your domain portfolio are, see which ones have issues, and drill into the details of what needs fixing.

What Is WCAG?

WCAG stands for the Web Content Accessibility Guidelines, an internationally recognised standard that defines how websites should be built so that people with disabilities can use them. This includes people who use screen readers, keyboard-only navigation, or who have visual, hearing, or cognitive impairments.

WCAG compliance is increasingly a legal requirement in many countries and is considered best practice for any public-facing website. Issues are grouped into three levels of conformance:

Using the Report

The Summary Bar

At the top of the report you will see a row of summary cards showing counts for the current scope:

The Domain Table

Each row in the table represents one domain. The columns show:

Click any column header to sort by that column. Click again to reverse the sort order.

Filtering the Table

Use the toolbar above the table to narrow down what you see:

• Type a domain name in the search box to filter by domain
• Use the Scope dropdown to switch between WCAG Category Only and Show All Domains
• Use the Status dropdown to show only Pass, Fail, Partial, or Error domains
• Use the Level dropdown to show only domains at a specific WCAG level

Viewing Violation Details

Click any row to open a popup showing the full scan results for that domain. The popup shows:

• A summary of the scan result, level, issue counts, pass count, and when the scan was run
• The URL the scanner actually reached, which may differ from the original domain if there was a redirect
• Violations tab - each accessibility issue found, showing its severity, the WCAG criteria it relates to, a description of the problem, and the HTML elements affected
• Incomplete tab - checks the scanner could not fully evaluate automatically and that may need manual review

Press Escape or click outside the popup to close it.

Resetting a Domain for Rescanning

Each row has a reset button (↺) at the right end. Clicking it marks the domain as not yet scanned, so it will be picked up and rescanned automatically on the next scheduled scan run. Use this when a site has been updated and you want fresh results.

Exporting Data

Two export options are available in the toolbar:

• CSV - downloads a spreadsheet with the summary columns for all domains in the current scope. Useful for sharing results or importing into other tools.
• JSON - downloads a complete export including all violation details for every domain in the current scope. Useful for further analysis or integration with other systems.

How Scanning Works

Scans run automatically in the background on a schedule set by your administrator, typically every 30 minutes. By default, automated scanning targets domains assigned to the WCAG Test Domains category in WMD SED. The browser report can also be switched to show all domains in the portfolio for broader review. If a domain does not appear in the category-only view, check that it has been added to the WCAG category.

Each domain is loaded in a headless browser, tested against the configured WCAG standard, and the results are saved. Domains that have been scanned recently are skipped unless reset manually or force-scanned from the CLI.

The scanner tests the homepage of each domain. It tries https:// first and falls back to http:// if the secure version is not available. If the site cannot be reached at all, the domain is marked as Error.

Not all accessibility issues can be detected automatically. The scanner catches a broad range of common violations, but some issues, particularly those involving meaning, context, or user interaction, require manual review. A passing result means no automated violations were found, not that the site is fully accessible.

Administrator and Setup Guide

The sections below cover installation, configuration, and technical reference for administrators setting up or maintaining the WCAG scanning extension.

If you need help preparing the shared Node.js and Puppeteer environment used by WMD SED website tools, see Webshots and Cookie Analysis Setup.

Main Files in the WCAG Tool

• wcag.php - browser-based WCAG report page
• wcag-gather.php - command-line gather script
• axe-scan.js - Node.js and Puppeteer accessibility scanner
• wcag-setup.sh - setup helper script for Linux environments

wcag.php provides the browser report. The gather process uses axe-scan.js, which should be copied into the Node.js working folder used by WMD SED website scanning tools.

Requirements

• WMD SED already installed with shell access
• Node.js available in the environment used by WMD SED
• A Node.js working folder available for WMD SED website scanning tools
• @axe-core/puppeteer installed in that Node.js working folder
• WMD administrator access for the browser report page

Setup

Linux / Debian / Ubuntu

Download wcag-setup.sh from learn.domainpunch.com/static/downloads/wcag-setup.sh and run it as the wmdsed user:

bash wcag-setup.sh

For standard installations, no editing is normally required. For non-standard installations, edit the variables near the top of the script before running it.

To preview the setup without making changes:

bash wcag-setup.sh --dry-run

The script performs pre-flight checks, installs @axe-core/puppeteer if needed, copies axe-scan.js into the Node.js working folder, creates the required WMD SED custom columns, and can optionally add a cron job for automated scanning.

Windows

On Windows there is no setup script. Setup must be completed manually.

WMD SED website scanning tools rely on a dedicated Node.js working folder. This is the folder where the required npm packages are installed and where scanner scripts such as axe-scan.js are placed.

If your installation already uses Node.js and Puppeteer for other WMD SED website tools, use that same working folder for WCAG scanning as well.

Step 1 - Choose the Node.js Working Folder

Identify the Node.js working folder used by WMD SED for website-related scripts. In many installations this is the same folder already used for Puppeteer-based tooling.

Step 2 - Install @axe-core/puppeteer

Open a command prompt in that Node.js working folder and run:

npm install @axe-core/puppeteer --save

Run the command from inside the Node.js working folder so the package is installed in the same environment used by the WCAG scanner.

If that folder is not already being used for other WMD SED website scanning tools, make sure the required Node.js packages for those tools, including Puppeteer, are installed there as well.

Step 3 - Copy axe-scan.js to the Node.js Working Folder

Copy axe-scan.js from the WCAG tool folder into the same Node.js working folder so it can run with the installed npm packages.

All Platforms

The remaining steps are the same on all platforms.

Step 4 - Create custom WMD columns

php wcag-gather.php --setup-columns

This creates four custom columns in WMD SED:

This command is safe to run multiple times because existing columns are skipped.

Step 5 - Create the WCAG category

In WMD SED, create a category named WCAG Test Domains and assign the domains you want to scan to it.

Step 6 - Dry run to verify domain selection

php wcag-gather.php --dry-run

This lists every domain that would be scanned without actually scanning anything.

Step 7 - Run the first scan

php wcag-gather.php
php wcag-gather.php --batch=3

Configuration

The main configuration constants are defined near the top of wcag-gather.php:

WCAG_OUTPUT_FOLDER must match the constant of the same name in wcag.php.

Protocol Resolution

If WCAG_PROTOCOL_COLUMN is set to a custom column name such as site_protocol, the scanner reads the protocol from that column for each domain. If it is left empty, the scanner tries https:// first and falls back to http:// if needed.

CLI Reference - wcag-gather.php

Re-scan Behaviour

Domain Eligibility

A domain is excluded from scanning if all three of the following are true:

• availability = 'available'
• registry_expiry is NULL
• registrar_expiry is NULL

Domains with availability = 'Not Available' or 'possibly available' are still included.

Concurrency Lock

wcag-gather.php uses a lock file named wcag-gather.lock to prevent concurrent runs. If a second instance is started while one is already running, it exits immediately with a warning. Stale locks from crashed processes are detected and removed automatically.

What axe-scan.js Does

axe-scan.js is called once per domain by wcag-gather.php and is executed from the Node.js working folder so it resolves node_modules correctly.

1. Launches headless Chromium via Puppeteer
2. Navigates to the domain URL, trying https:// first and falling back to http:// when needed
3. Runs axe-core at the configured WCAG level
4. Outputs a single JSON object to standard output, including on error

Scan Result Status Values

wcagLevel reflects the highest WCAG level at which the page fully passes. A page with no AA violations but some AAA violations returns AA.

Browser Report - wcag.php

Access this as an authenticated WMD administrator through the Custom Built-in Tools page, or directly at https://yourserver/tools/wcag.php.

Features

• Summary stat cards showing total, scanned, pass, fail, partial, error, and not scanned counts
• Scope selector for category-only or all-domain views
• Filterable table by domain name, status, or WCAG level
• Sortable columns
• Reset button per row to clear wcag_scanned_at so the domain is re-scanned on the next gather run
• Row click opens a popup with the full violation report loaded from disk
  • Violations tab showing axe violations with impact, WCAG tags, description, and affected HTML
  • Incomplete tab showing items axe could not fully evaluate
• Export CSV for summary data
• Export JSON for full data including violation details
• Session expiry handling with a clear prompt to log in again if the WMD session ends

If the WCAG columns have not been created yet, the report page should not be used until setup is completed.

Scheduled Scanning

The lock file prevents re-entry if a previous run is still in progress, so overlapping scheduled runs are not normally a concern regardless of platform.

Linux / Debian / Ubuntu

The wcag-setup.sh script can automatically add a cron job depending on its configuration. A common pattern is to scan every 30 minutes with a batch size of 3.

To add or edit the cron job manually:

crontab -e

Add a line in this form:

*/30 * * * * php /path/to/tools/wcag/wcag-gather.php --batch=3 >> /path/to/wcag-cron.log 2>&1

Windows

On Windows, Task Scheduler is used instead of cron. A batch file can call wcag-gather.php, and a VBScript wrapper can be used to launch that batch file silently if needed.

See learn.domainpunch.com/wmdsed/install/wintask/ for the general Windows scheduled-task pattern used by WMD SED.

Security Notes

• wcag-gather.php is CLI only and exits immediately if accessed through a browser
• wcag.php requires a valid WMD administrator session
• The WCAG output folder is intended to remain outside the public web root
• axe-scan.js runs headless Chromium with --no-sandbox, so ensure the OS user running PHP has appropriate permissions