The short version
A website accessibility audit tests a site against WCAG 2.1 AA, the standard named by Section 508 and the ADA Title II rule, using automated scans and a person working through the site with a keyboard and a screen reader. For a small or mid-sized site it usually costs $1,250 to $5,000 and takes one to three weeks.
The output is a report that lists every issue, where it is, which rule it breaks and how to fix it. If a government buyer or prime contractor asks for an ACR (or VPAT), the audit is what it's built on. Below is what a real audit covers, what it costs, and how to tell a real audit from a scan with a logo on it.
Who needs one
- State and local governments. The ADA Title II rule requires WCAG 2.1 AA by April 26, 2027 for governments serving 50,000 people or more, and April 26, 2028 for smaller governments and special districts. See our Section 508 checklist for the details.
- Federal agencies and their contractors. Section 508 applies to what federal agencies build and buy. Contractors are routinely asked for an ACR in proposals.
- Businesses that serve the public. ADA website lawsuits are common, and an audit with a fix plan is the strongest thing you can show that you're taking it seriously.
- Anyone about to redesign. Auditing the old site first tells the designers exactly what not to repeat, and it's far cheaper to build it right than to fix it after launch.
What an audit should cover
The right column is the WCAG success criterion, or the part of the audit, each item belongs to. If an audit proposal skips a whole group, ask why.
Scope
- A written scope: which pages, templates and user flows get tested, and against which standard.WCAG 2.1 AA
- A sample that covers every template, not just the homepage: a form, a search, a long article, a PDF, a page with video.Sample
- The key tasks tested end to end, like paying a bill, applying for a permit or submitting a contact form.Flows
Testing
- Automated scans of every page in scope, to catch the easy, repeatable errors fast.Automated
- Keyboard only: every menu, form, modal and map used without a mouse, with focus always visible.WCAG 2.1.1
- Screen reader testing with at least one real screen reader on desktop and one on mobile.WCAG 4.1.2
- Zoom to 200% and reflow at 320px wide, with nothing cut off or overlapping.WCAG 1.4.10
- Color contrast on text, buttons, icons and focus outlines, including hover and error states.WCAG 1.4.3
- Forms: labels, instructions, error messages, and what a screen reader announces when something goes wrong.WCAG 3.3.1
- Video and audio: captions, transcripts and audio description where the visuals carry meaning.WCAG 1.2.2
- PDFs and documents linked from the pages in scope, if they're part of the audit.Documents
Automated scans vs. manual testing
Automated checkers are fast and cheap, and every audit should use one. The 2026 WebAIM Million scan found detectable WCAG failures on 95.9% of the top million home pages, an average of 56 errors each. Six problems make up 96% of what tools find: low contrast text, missing alt text, missing form labels, empty links, empty buttons and a missing page language.
But a tool can only check what software can measure. It can tell that an image has alt text, not whether the alt text makes sense. It can't tell whether a form can be completed with a screen reader, or whether keyboard focus gets trapped in a pop-up. Deque's own study of 2,000 audits found its automated tests covered about 57% of issues by volume, and that's a tool maker making the strongest case for tools. The rest needs a person.
A clean scan isn't a passed audit. A site can score 100 on an automated checker and still be impossible to use with a keyboard. If an “audit” is only a scan, it should be priced like one.
What you should get at the end
- An issue list with the page, the element, the WCAG criterion, a severity, and a plain recommended fix for each problem. Screenshots or code snippets help.
- A summary a non-technical reader can follow: how the site does overall and the handful of issues that block people most.
- A prioritized fix plan, so the highest-impact problems on the most-used pages get fixed first.
- A retest after fixes, confirming what's resolved.
- An ACR (VPAT), if you need one for procurement, based on the audit results.
What it costs
We looked at published price lists from accessibility audit firms in October 2026. They fall into rough bands:
- $0 to $500 a month: automated monitoring. Scanning tools that crawl the site and flag the detectable errors. Useful between audits, not a replacement for one.
- $1,250 to $5,000: a manual audit of a small or mid-sized site. Usually priced per page or screen: about $100 to $250 for a full page and $25 to $100 for a light one, on a sample of 10 to 25 pages.
- $5,000 to $25,000 and up: large sites and web apps. More templates, more user flows, logged-in areas and complex components like maps, dashboards and payment steps.
- $350 to $950 on top: the ACR (VPAT). The price depends on the edition: WCAG only, Section 508, the EU's EN 301 549, or the international edition that covers all three.
Testing with disabled users is usually extra, around $450 to $550 a session. Fixing the issues is a separate cost, and on most sites it's bigger than the audit, which is why the fix plan matters as much as the findings.
Questions to ask an auditor
The answers tell you whether you're buying testing or a scan.
- Which standard do you test against, and which version? (WCAG 2.1 AA is what the law currently names.)
- How many pages or screens are in the sample, and how did you choose them?
- How much of the testing is manual, and which screen readers and browsers do you use?
- Can I see a sample report?
- Does each issue come with the exact location, the WCAG criterion and a recommended fix?
- Is a retest included after we fix things? How many rounds?
- Is the ACR (VPAT) included, or priced separately? Which edition?
- Are PDFs and other documents in scope, or extra?
Red flags
- “Compliant in 24 hours.” Real manual testing of even a small site takes days.
- An overlay or widget sold as the fix. Overlays sit on top of the site and leave the code unchanged. In 2025 the FTC ordered one overlay company to pay $1 million over claims that its tool made sites compliant.
- A “100% compliant” certificate. There's no official WCAG certification. An honest report says what was tested, when, and what was found.
- No sample report. Any auditor should be able to show you what you'll get, with client names removed.
- An ACR with no audit behind it. If you're handed a filled-in VPAT without any testing, it won't hold up when a buyer checks.
Want us to audit your site?
We audit against WCAG 2.1 AA with automated and manual testing, give you a prioritized fix list, and can fix the issues ourselves or alongside your team. We work with agencies, prime contractors and businesses. See government digital services or get in touch.
