Methodology
How the Certvo Web Accessibility Report 2026 was built
This page documents every step between the raw scan database and the published figures, so that a reader can judge what the numbers mean and reproduce the aggregation from the open dataset. It is deliberately plain: where a choice could have gone another way, it says so.
1. The scanner
Every website in the sample was tested by Certvo's crawler, which loads each page in a headless Chromium browser, waits for the page to settle, and runs the open-source axe-core rule engine against the rendered DOM. axe-core is the same engine behind Lighthouse's accessibility audit and many commercial tools; its rules are designed to report only failures that can be determined without human judgement, which keeps the false-positive rate low and is why this report speaks about a floor rather than a full picture.
Each scan started at the home page and followed internal links to up to four more pages on the same host, giving a maximum of five pages per site. Pages were tested at a desktop viewport. Every failing element was stored with its axe rule id, impact level (critical, serious, moderate, minor), the WCAG success criteria the rule maps to, and the conformance level of those criteria.
2. Where the sites came from
The database held 2,372 scans at generation time, collected between 2026-03-16 and 2026-09-06. Most originate from Certvo's outreach programme, which scans the public websites of businesses across many industries and countries; the remainder were submitted by visitors to the free public scanner. Sites were not chosen for being good or bad at accessibility.
It is a convenience sample, not a random sample of the web, and it skews toward small and mid-sized commercial sites on .com domains. It is best read as "what a typical business website looks like to an automated audit", which is the question most readers of this report are asking.
3. From scans to one row per website
Raw scans were reduced to one observation per website with the rules below. 808 scans were removed in total, leaving 1,564 websites.
| Excluded | Scans | Reason |
|---|---|---|
| Older scans of the same site | 137 | Only the most recent completed scan per website is kept, so a site that was scanned five times counts once and reflects its latest state. |
| Scans that reached no pages | 247 | The crawler was blocked, timed out or the site was offline. There is nothing to measure. |
| Single-page scans with a perfect 100 and zero issues | 392 | A real page with no detectable issue at all is rare; in practice this pattern means the page served an interstitial, a consent wall or an empty shell to the crawler. Keeping them would inflate pass rates. |
| Scans that never completed | 32 | Failed or still-running scans have partial data. |
The third rule is the judgement call. Dropping suspicious perfect scores lowers the reported pass rate; keeping them would have raised the AA pass rate above 18.8%. We chose the conservative reading because manual inspection of a sample of those scans found consent walls and script-only shells rather than accessible pages. The aggregation code also refuses to produce a dataset from fewer than 500 websites.
4. What each figure means
- Sites affected / % of sites for a rule or criterion: the number and share of websites with at least one detected instance. A site with two hundred contrast failures counts once.
- Average per site: instances divided by affected sites, so it describes how concentrated a problem is on the sites that have it.
- Failing a criterion: any detected issue whose rule maps to that WCAG success criterion. One issue can map to several criteria (an unnamed link fails both 2.4.4 and 4.1.2) and is counted under each.
- Severity share: issues by axe impact level, as a share of all issues, not of sites.
- AA pass rate: the share of websites with zero detected issues mapped to Level A or AA criteria. It is an automated pass, not a conformance claim.
- Accessibility score: Certvo's 0 to 100 score, which weights each issue by severity and normalises for the amount of content scanned. The score explainer gives the formula.
- Domain group: the top-level domain of the site, reduced to .com, .org, .net, EU country-code domains and other. The domain itself is not stored in the dataset.
5. Limitations
- Automated rules cover roughly 30 to 40 percent of WCAG 2.1 success criteria. Nothing here measures whether alt text is accurate, whether focus order is logical, or whether error messages help. Real failure rates are higher than any figure in the report.
- Five pages per site is a sample of the site. Deep checkout, account and form flows, where the most serious barriers usually live, are under-represented.
- The sample over-represents .com and English-language business sites and under-represents public-sector, media and very large sites.
- Scores and pass rates are point-in-time. A site scanned in March may have changed since.
- axe-core versions evolve; rule coverage in this edition reflects the engine version in use during the collection period.
6. Privacy
The published dataset contains aggregate counts and percentages only. No domain, URL, page title, screenshot, user or scan identifier leaves the database. The aggregation script is tested to reject any output containing a URL. Websites that were scanned are not notified, ranked or named, and no per-site figure can be recovered from the published tables.
7. Reproducibility and changelog
The dataset is available as JSON, CSV by criterion and CSV by rule. The JSON includes the exclusion counts above under methodology and a generated_at timestamp; every figure in the report is derived from it and nothing else.
- 2026-09-06 — first edition. 1,564 websites, 4,549 pages, 108,494 issues.
Questions about the method, or requests for an unpublished breakdown, go to support@certvo.com. Back to the report.