How CandidAccess works

1. Add a client and their site

Your agency signs up and invites its team members. Create a client, then add the site address. Your agency confirms it is authorized to monitor that site. TBD: exact wording of the authorization statement

2. Approve the pages to check

CandidAccess reads the site’s homepage and sitemap and suggests pages from the same site. It respects robots.txt, and re-checks it before every scan.

You decide the final list:

• add pages, remove pages or change their order
• pick pages that represent your templates and key journeys
• check only the pages you approve on each site

Only the pages you approve are scanned. Later suggestions are never added on their own.

3. A scan runs every week

Every seven days, CandidAccess runs automated checks with the open-source axe-core engine on each approved page. Each scan runs in an isolated, disposable browser on a separate scanner server with no access to your account data or our database.

Good to know:

• Scans run on a fixed weekly schedule. There is no “scan now” button.
• If a page fails to load, is blocked or times out, we say so. It is never shown as passing.
• Content inside frames from other sites (for example embedded maps or videos) is not analysed, and the page is marked as partial.

4. Triage what changed and what needs review

Your dashboard and findings list show:

• New findings from the latest scan
• Returned findings: issues that came back after a check showed them gone
• Needs manual review: checks the engine could not decide, for a person to look at
• Impact: the engine’s priority level for each finding

Record a triage decision for each finding, so your team knows what is being handled. Filter by site, impact, finding status or triage status.

Planned: a weekly summary email when findings return. TBD: whether alert emails are live at launch

5. Send a branded report

Each scan produces the same report in HTML and PDF, with your agency name, colour, contact line and logo. Very large reports are summarized in the PDF. The report includes:

• the client, site and scan date
• every page that was attempted, with its outcome
• findings grouped by impact, with examples
• What was not tested: failed pages, pages outside the scan, frame and loading gaps
• Needs manual review
• the engine, rule and browser versions used
• a plain statement that automated checks do not establish WCAG or legal compliance

Reports are private files, never publicly linked. They can be seen by members of your organization, plus a small number of CandidAccess operators where needed to run and support the service. Your clients don’t log in; you send them the report. Reports expire on a set schedule. TBD: retention wording

A sample report will be available before launch. TBD: sample report

What CandidAccess does not do

So you can set the right expectations with clients:

• It does not find every barrier. Automated checks catch only some; manual testing with assistive technology is still needed.
• It does not certify, score or badge a site.
• It does not fix code on the site.
• It checks a sample of the pages you choose, not every page.

Request early access or read the frequently asked questions.