For agencies, freelancers, and dev teams

Grade your client's website.Know what to fix first.

Paste a web address. In under a minute you get an accessibility grade, what to fix first, and a page to show your client. Your first grade is free, with no account.

Pages are checked with axe-core, a widely used open-source accessibility engine that Google Lighthouse also uses, against WCAG 2.2 A and AA, the web accessibility standard that laws and RFPs commonly point to. Automated checks find part of the problems; a person still has to review the rest.

Want to see a finished report first? Read a sample client report. Grading is free. The hosted workspace starts at $39 a month.

Case PA-0426·saucedemo.com

Accessibility evidence · WCAG 2.2 AA

The public page passed. The flow behind it didn't.

Critical4.1.2select-name

The inventory sort control has no accessible name. Behind auth, a crawler without a session never reaches it.

found at /inventory · signed-in state

Critical4.1.2button-name

The error-dismiss control on checkout validation exposes no name, so a screen reader announces only “button.”

found at /checkout · validation error

Real probe of the SauceDemo test store. Not a customer account.

Behind the login

Scan the signed-in states. Fail only on what is new.

A one-URL scan sees one page; your users see the whole flow. The free CLI logs in on your machine, so the password never leaves it, and the CI gate fails only on new defects. On the SauceDemo test store the public login page scanned clean. Three critical defects were waiting in states that only exist after you sign in, add to cart, or get something wrong.

Full-flow crawl map: 6 states captured

Public entry (1 state)Behind login (5 states)Defect state (3 critical)

01LoginPublic · /Clean
02Login errorSession only · /login (error)Critical4.1.2
03InventorySession only · /inventoryCritical4.1.2
04CartSession only · /cartClean
05CheckoutSession only · /checkout-step-oneClean
06Checkout errorSession only · /checkout (error)Critical4.1.2

01Public scan
Login
/
The only page a URL scanner loads.
✓ Clean
02Session only
DEFECT
Login error
/login (error)
Only exists after submitting bad input.
Critical4.1.2
03Session only
DEFECT
Inventory
/inventory
Behind auth. No session, no page.
Critical4.1.2
04Session only
Cart
/cart
Needs an item added first.
✓ Clean
05Session only
Checkout
/checkout-step-one
Three interactions deep.
✓ Clean
06Session only
DEFECT
Checkout error
/checkout (error)
An error state inside a multi-step flow.
Critical4.1.2

Probe ledger

Four public demo apps, scanned both ways. The last row found nothing new, and it stays in the table.

Method and raw results: experiments/net-new-violations

Violations found by a public-page scan versus net-new violations found by a session crawl
Target	Public scan	States	Net new
saucedemo.com	0	7	+3
opensource-demo.orangehrmlive.com	1	5	+35
the-internet.herokuapp.com	44	3	+5
demo.applitools.com	5	1	0

Show the results table

Violations found by a public-page scan versus net-new violations found by a session crawl
Target	Public scan	States	Net new
saucedemo.com	0	7	+3
opensource-demo.orangehrmlive.com	1	5	+35
the-internet.herokuapp.com	44	3	+5
demo.applitools.com	5	1	0

Four steps from login to a gated build.

For developers. Scan signed-in flows with the free CLI; the session never leaves your machine. Open source, MIT licensed, and no overlay script on your site.

01Save a session on your machine
Log in once in a real browser. The session file stays on your laptop, mode 0600. Nothing is uploaded.
personaudit auth https://app.client.com
02Crawl every reachable state
Carts, dashboards, error screens, open menus: states that exist only after you do something.
personaudit scan https://app.client.com --session ./session.json
03Get the axe-core verdict at each one
Deterministic, cited to WCAG, merged so one broken component reads as one defect, not forty.
→ report.md · 3 critical · 2 serious
04Gate CI on new defects only
Baseline today's backlog, then fail the build only when something new ships.
personaudit scan … --baseline base.json --fail-on serious

01Save a session on your machine

personaudit auth https://app.client.com

02Crawl every reachable state

Carts, dashboards, error screens, open menus: states that exist only after you do something.

personaudit scan https://app.client.com --session ./session.json

03Get the axe-core verdict at each one

Deterministic, cited to WCAG, merged so one broken component reads as one defect, not forty.

→ report.md · 3 critical · 2 serious

04Gate CI on new defects only

Baseline today's backlog, then fail the build only when something new ships.

personaudit scan … --baseline base.json --fail-on serious

behind the login, on your machine

npx personaudit scan https://your.app

Full setup, including a ready-to-use GitHub Action: the CI accessibility gate guide.

Built for the handoff, not the screenshot.

A violation list is where the work starts. Each scan becomes something a client can read and a developer can close.

Fix first: The defects to clear before anything else, grouped by the component that owns them.
Status per finding: Open, assigned, fixed, accepted risk, or false positive, with a note for the handoff.
Copy as issue: One click turns a finding into a GitHub, Jira, or Linear issue body.
Retest compare: New, cleared, and still-open findings between two runs: proof of progress.
CSV and print: Export the verdicts, or print the report as a clean paper document.

What each report contains

Fix first: The defects to clear before anything else, grouped by the component that owns them.
Status per finding: Open, assigned, fixed, accepted risk, or false positive, with a note for the handoff.
Copy as issue: One click turns a finding into a GitHub, Jira, or Linear issue body.
Retest compare: New, cleared, and still-open findings between two runs: proof of progress.
CSV and print: Export the verdicts, or print the report as a clean paper document.

Persona layer · Solo and up

The grade says what broke. A persona run says whether the job got done.

A persona task-success run sends an AI agent to try a task on your site, like finding the pricing page, and records whether it got there. Clients don't act on a rule ID. They act on “the agent never found pricing.” You get that sentence, with the run to back it up.

Findings Critical4.1.2: From axe-core. Run it twice, get the same answer. Cited to WCAG. The only thing that goes into the evidence report.
Persona notes Opinion · AI: Labeled as AI opinion, never mixed into the findings. A persona is an AI agent, not a stand-in for a person with a disability. For that, test with real people through Fable.

Persona replay · saucedemo.com

· step 1 of 3

Opinion · AI

State: /login (error)Action: submit credentials

“Bad credentials. Looking for what went wrong.”

Task effort18 / 100 (on track)

No axe-core findings logged at this state.

Illustrative walk from experiments/net-new-violations. The task success opinion is separate from deterministic WCAG findings.

in progress1 / 3 steps

Open the sample replay: saucedemo.com, 3 steps

Persona replay · saucedemo.com

· step 1 of 3

Opinion · AI

State: /login (error)Action: submit credentials

“Bad credentials. Looking for what went wrong.”

Task effort18 / 100 (on track)

No axe-core findings logged at this state.

Illustrative walk from experiments/net-new-violations. The task success opinion is separate from deterministic WCAG findings.

in progress1 / 3 steps

Jun 28, 2025 EU accessibility enforcement began. Apr 26, 2027 the US Title II web rule applies to larger governments. All deadlines and sources. Not legal advice.

Open a case file on your next client.

Grade the public site now. Run the CLI behind the login, locally, tonight. Hand over the report tomorrow. Enterprise platforms sell annual contracts; Solo is $39 a month, and the CLI is free.

Grade a site free Agency plans