Scanning & Monitoring

Scan any site. Watch it stay accessible.

80+ evaluators across WCAG 2.2 — automated hard-fail detection for all 55 Level A + AA criteria — backed by vision-LLM and real-browser probes that catch what rule-based scanners can’t. Scan pages, opt in to linked PDFs and multi-step flows, run it yourself in CI or paste a URL and let our fleet run it for you — then keep it monitored with scheduled scans and regression alerts.

Request access See what we detect

Private beta Hosted (zero-touch) scanning is rolling out to invited orgs. Request access →

Two ways to run a scan

You run it

Drop the GitHub Action into your pipeline, or run the CLI locally. Scans on every push or PR, with an optional gate that fails the build when conformance regresses.

- uses: wholisphere/scan-action@v1
  with:
    urls: https://example.com
    fail-on-regression: true

We run it beta

Paste a URL in the dashboard. Our hosted runner fleet claims the job, scans (including SPA and signed-in pages), and reports findings back — your client never touches a terminal.

Queued → Scanning… → Done, live
Baseline scan + recurring schedule in one form
No customer credentials on the runner

The three-tier deep scan

Test the way a real user experiences it.

Most scanners parse the DOM and stop. Our deep scan runs on-demand — minutes and cents per page — to turn "cannot verify" into a measured verdict.

Tier 1

Deterministic interaction probes

Playwright drives the real page — no LLM. Keyboard-trap detection, focus order, focus visibility, pixel-measured contrast, 320px reflow, text spacing, target size, motion. Converts ~15 "cannot verify" criteria into hard verdicts.

Tier 2

The audio judge

Fetches caption tracks and measures cue coverage ("captions cover 42% of the media"), with a Whisper adapter for transcripts. The 1.2.x media criteria become measured, not guessed.

Tier 3

Vision & text judges

Stability-verified vision and text-LLM judges rule on criteria a rule-based scanner can’t see — images-of-text, use-of-color, heading descriptiveness — against the rendered full-page screenshot. Measured, never assumed: no vision key means "unverified," never a false pass.

Coverage figure, stated honestly: every one of the 55 WCAG 2.2 Level A + AA criteria has automated hard-fail detection — 37 from static markup analysis, and the rest from deterministic browser probes or stability-verified vision and text judges. All 86 criteria (AAA included) are evaluated with evidence; the 16 criteria that still need human judgment are all Level AAA and arrive as confidence-scored verdicts routed to a one-click reviewer-attestation step. Everything is pinned by three CI regression suites against a 196-page per-criterion fixture testbed — zero false positives on that verification corpus. We report which method judged which criterion on the VPAT — we don’t round any of it up to "100% automated."

From one-time scan to monitored service

Hosted scans: Paste a URL and our runner fleet does the rest — no CLI, no terminal, nothing for your client to install. Queued → Scanning… → Done, with live status.
Scheduled monitoring: Recurring scans on a real cron schedule (timezone- and DST-correct). Accessibility stops being a one-time audit and becomes a monitored service.
Regression detection: Every scheduled run diffs against the previous one. A regression can email your team the criterion-by-criterion delta — or fail your build.
SPA + auth-walled sites: The browser runner loads dynamic, JS-rendered pages and can sign in with a stored session, so scans see what a logged-in user sees.
GitHub issues, auto-filed: Failing criteria open as issues in your repo, deduped by criterion, auto-closed when a later scan finds them fixed, reopened on regression.
Client status portal: A tokenized, no-login page per product: current conformance score, scan-history trend, and published VPATs. Turn a one-time deliverable into an ongoing relationship.
PDF document scanning: Opt in with --include-pdfs and the PDFs your site links get graded too — structural checks citing W3C PDF techniques (tagging, language, title, figure alt text, headings, tables, form labels, link text, bookmarks) plus opt-in rendered-page analysis: deterministic rendered-text contrast measured from pixels (no model), vision-judged image-of-text detection, and a best-effort reading-order signal. Document findings flow through the same review queue and the same VPAT as page findings. Honest limits: alt-text usefulness is not graded, contrast over photos/gradients is reported indeterminate, and reading order is a signal, not proof.
Multi-step flow checks: Opt in with --flow and the scanner walks a checkout- or signup-style flow with sentinel data to answer what no single page can: does the flow re-ask for information (3.3.7) and is there a review step before commit (3.3.4)? Hard safety contract — same-origin, max 6 steps, and it never activates a place-order or pay control.
Scan only what applies: Deselect criteria your site cannot fail — no video, no media checks — with --criteria, --skip-criteria, and --levels. Deselected criteria switch off the browser captures they need, so a trimmed scan is genuinely faster and cheaper, not just a filtered report.

Point it at a URL.

Free tier includes real scans. Hosted, zero-touch scanning is in private beta — ask us for an invite.

Request access Request hosted access