Back to projects & research

Widedoor: Section 508 and WCAG 2.1 AA checker

Built an open source checker that tests websites and PDFs against Section 508 and WCAG 2.1 AA and reports only the conformance it actually tested.

Year

2026

My role

Sole designer and developer.

Tools & technologies

TypeScript · Playwright · axe-core · veraPDF · Docker · GitHub Actions

Outcome

Version 0.1.0 released as source: web and PDF scans, HTML, JSON, and SARIF reports, manual review records, Accessibility Conformance Report exports, report diffs, a local viewer, a GitHub Action, and a Dockerfile. Not yet published to npm.

The problem

Developers and small businesses without an accessibility specialist still need to test websites and PDFs against Section 508 and WCAG 2.1 AA, and to understand what is wrong, who it affects, and how to fix it.

What I built and owned

Never claims what it did not test

Each criterion gets exactly one level. Apart from one documented exception for WCAG 4.1.1, Supports requires every applicable asset to pass through a recorded, current manual result, so an automated pass alone never produces it. Anything untested reads Not Evaluated, and an incomplete scope downgrades results rather than hiding the gap. Every report states that it documents the testing performed and is not a certification of conformance.

What it checks automatically

Web pages run through axe-core 4.14.0 in Chromium with the WCAG 2.0 and 2.1 A and AA rules, at 1280 by 800 and again at 320 pixels wide for reflow, with a screenshot and an escaped snippet of each failing element. PDFs run through veraPDF 1.30.3 with the PDF/UA-1 profile, plus checks for the title bar, document language, pages without a text layer, and bookmarks in long documents.

Manual review is part of the record

Criteria that need a person become a checklist. Reviewers record results in YAML files or in the local viewer, a result expires when the page or file changes, and any automated failure a reviewer overrides is listed with the reviewer, the date, and the reason.

Built for CI and procurement

A GitHub Action uploads SARIF to code scanning, and the exit code fails a build at a chosen severity. Reports export as HTML, JSON, SARIF, and JUnit, and as an Accessibility Conformance Report in OpenACR YAML and the VPAT 2.5 Section 508 layout. In Docker, PDF scans run with no network and read-only inputs.

Explore the work

Widedoor source (opens in a new tab)
Back to profileNext: Microsoft 365 security hardening