Section 508website checklistfor government contractors.

The short version

Build to WCAG 2.1 Level AA. Test every template with an automated checker, a keyboard, and a screen reader. Fix what you find, then write it up honestly in an Accessibility Conformance Report.

That one standard covers federal work under Section 508 and state and local government work under the ADA Title II rule. The rest of this guide is the detail: what each rule says, the checklist itself, how we test, and where sites usually fail.

What Section 508 requires

Section 508 of the Rehabilitation Act requires federal agencies to make the technology they build, buy, maintain or use accessible to people with disabilities. That includes websites, web apps, documents and software, whether the public uses them or only employees do.

Since the standards were refreshed in 2018, the test for web content is WCAG 2.0 Level A and AA. WCAG is the Web Content Accessibility Guidelines, published by the W3C. Level AA is the middle tier, and it's the one every regulation points to.

The law is written for agencies, but it reaches contractors through procurement. Agencies have to buy accessible technology, so expect accessibility language in the statement of work, accessibility as an evaluation factor, and a request for an Accessibility Conformance Report with your proposal or before acceptance.

Why we build to 2.1, not 2.0. WCAG 2.1 includes every 2.0 requirement and adds 12 more at Level A and AA, mostly for mobile, zoom and low vision. It costs very little extra while you build, it's the version the ADA rule requires, and it's what a future Section 508 update is most likely to adopt.

State and local government: the ADA Title II rule

In 2024 the Department of Justice set a hard technical standard for state and local government websites and mobile apps under Title II of the ADA: WCAG 2.1 Level AA. In April 2026 it pushed the deadlines back a year. The dates now are:

• April 26, 2027 for governments serving a population of 50,000 or more.
• April 26, 2028 for smaller governments and special district governments.

That covers cities, counties, states, school districts, transit agencies and public universities, and the contractors who build and run their sites. Content from vendors and plugins on the site counts too. If it's on the government's site, the government is responsible for it. See the rule summary on ADA.gov.

The checklist

This is the list we build against and audit with. It isn't every WCAG success criterion. It's the ones that decide whether a real government site passes, grouped the way you'd check them. The reference on the right is the WCAG criterion or Section 508 provision, so you can look up the exact wording.

Structure and navigation

• Every page has a unique, descriptive title.WCAG 2.4.2
• The page language is set in the code.WCAG 3.1.1
• Headings are real headings, in order, with one H1 per page.WCAG 1.3.1
• A skip link and page landmarks let keyboard and screen reader users jump past the navigation.WCAG 2.4.1
• Link text makes sense on its own. No bare “click here” or “read more”.WCAG 2.4.4
• Navigation is in the same place, in the same order, on every page.WCAG 3.2.3

Images, video and audio

• Every meaningful image has alt text that says what it shows. Decorative images have empty alt text.WCAG 1.1.1
• Prerecorded video has accurate captions, not unedited auto-captions.WCAG 1.2.2
• Video where the visuals carry information has audio description.WCAG 1.2.5
• Audio-only content, like a podcast or recorded meeting, has a transcript.WCAG 1.2.1
• Live video, like a streamed public meeting, has live captions.WCAG 1.2.4

Color, contrast and zoom

• Body text has a contrast ratio of at least 4.5:1. Large text needs 3:1.WCAG 1.4.3
• Buttons, form borders, icons and focus outlines have at least 3:1 contrast.WCAG 1.4.11
• Color is never the only way information is shown (required fields, errors, chart lines).WCAG 1.4.1
• Text can be zoomed to 200% without anything breaking or getting cut off.WCAG 1.4.4
• At a 320px-wide viewport (400% zoom) the page reflows to one column with no sideways scrolling.WCAG 1.4.10
• Users can increase line and letter spacing without text overlapping.WCAG 1.4.12

Keyboard and focus

• Everything works with a keyboard alone: menus, forms, modals, maps, carousels.WCAG 2.1.1
• Focus never gets stuck inside a component.WCAG 2.1.2
• The focused element always has a visible outline.WCAG 2.4.7
• Tab order follows the visual order of the page.WCAG 2.4.3
• Tooltips and menus that open on hover or focus can be dismissed and don’t vanish while you read them.WCAG 1.4.13

Forms and interactive components

• Every field has a visible label tied to it in the code. Placeholder text is not a label.WCAG 3.3.2
• Errors are described in text and point to the field that needs fixing.WCAG 3.3.1
• Where you know the fix, the error message says it (“Enter the date as MM/DD/YYYY”).WCAG 3.3.3
• Name, email, address and phone fields use autocomplete attributes.WCAG 1.3.5
• Status messages (“Saved”, “3 results”) are announced to screen readers without moving focus.WCAG 4.1.3
• Custom controls (dropdowns, toggles, tabs) expose their name, role and state to assistive technology.WCAG 4.1.2

Time limits and motion

• Session timeouts warn the user and let them extend, unless the limit is required by law or security.WCAG 2.2.1
• Anything that moves, scrolls or auto-updates for more than 5 seconds can be paused or stopped.WCAG 2.2.2
• Nothing flashes more than three times a second.WCAG 2.3.1

Documents and data tables

• PDFs posted on the site are tagged, have a reading order, a title and a language, and their images have alt text.508 E205.4
• Word, Excel and PowerPoint files meet the same bar, or there’s an accessible HTML version of the content.508 E205.4
• Data tables have header cells marked as headers. Tables aren’t used for layout.WCAG 1.3.1

How to test it

Automated checkers are the first pass, not the answer. They catch missing alt text, low contrast and empty links quickly, but they can't tell whether alt text is accurate, whether the tab order makes sense, or whether a custom dropdown actually works with a screen reader. That takes a person.

Our pass on every page template, before launch and after any major release:

1. Automated scan of every template and a sample of real content pages.
2. Keyboard only. Unplug the mouse and complete every task: navigate, search, fill in and submit every form, open and close every menu and modal.
3. Screen reader. One on desktop and one on a phone. Listen to headings, links, form labels, errors and status messages.
4. Zoom and reflow. 200% text zoom, then a 320px-wide window. Nothing cut off, no sideways scrolling.
5. Content review. Alt text, link text, captions, and every PDF and Office document linked from the site.

For federal work, the Department of Homeland Security's Trusted Tester process is the recognized manual test method for Section 508, and many agencies ask for testing done that way. Whatever method you use, write it down. The ACR has to say how you tested.

Then keep testing. Most sites that pass at launch fail six months later because of new content: an image uploaded without alt text, a scanned PDF, an embedded form from another vendor. Put the checks in the content editors' workflow and re-scan on a schedule.

The paperwork: VPAT and ACR

Agencies evaluate accessibility through the Accessibility Conformance Report (ACR). You write it using the VPAT, a template from the Information Technology Industry Council. For federal buyers, use the Section 508 edition.

For each requirement you mark one of four levels: Supports, Partially Supports, Does Not Support, or Not Applicable, with a short note explaining it. A few rules keep an ACR credible:

• Base it on testing you actually did, and say which methods and tools you used.
• Don't mark everything “Supports.” Evaluators know no site is perfect. “Partially Supports” with a clear note and a fix date reads as more trustworthy.
• Date it and name the version or release it covers. Update it when the site changes significantly.

Where sites usually fail

WebAIM's yearly scan of the top one million home pages finds the same problems at the top of the list every year: low-contrast text, missing alt text, form fields without labels, empty links, empty buttons, and a missing page language. All six are on the checklist above and are cheap to fix.

On government sites, these come up again and again:

• Scanned PDFs of agendas, minutes and forms. A scan is a picture of text, so a screen reader reads nothing.
• Session timeouts on permit, payment and application portals that log people out with no warning.
• Embedded third-party tools (maps, payment forms, calendars, chat widgets) that fail on their own. They're still part of your site.
• Public meeting video with no captions, or auto-captions nobody corrected.
• Data tables built as images or as layout grids, so the numbers can't be read in order.

Need a hand?

We build and audit government websites to WCAG 2.1 AA, fix what audits find, and help prime contractors with the accessibility part of a bid, including the ACR. We're a SAM.gov registered small business. See government website design or get in touch.