Accessibility Pre-Check for Your Pages - static HTML, WCAG-referenced (v0.1)

Publisher: Licensed Pipe - contact through the Apify actor page / issues tab.

A quick, load-light pre-check that reads the HTML of your own pages (no browser) and flags common machine-detectable accessibility problems, each tagged with the WCAG 2.x success criterion it relates to:

• missing lang, page title, main landmark; viewport that blocks zoom (user-scalable=no)
• images without alt, image buttons / image-map areas without text alternative
• links, buttons and form fields without an accessible name or label; placeholder-only fields
• invalid ARIA roles, aria-labelledby/describedby/controls pointing to missing ids, aria-hidden on focusable elements, duplicate ids
• heading problems (no h1, skipped levels, empty headings), positive tabindex, iframes without title, tables without header cells
• autoplaying media, videos without a captions track (info)
• inline-style colour contrast (only elements that carry both colours in their style attribute; external CSS is not evaluated)

This is not an accessibility audit or a conformance statement. Automated static checks find only a portion of real barriers; they cannot judge reading order, keyboard operation, focus visibility, colour contrast from CSS files, JavaScript-generated content, screen-reader behaviour or text quality. Passing this check does not mean a page is WCAG-, EN 301 549- or EAA-compliant, and the output is not legal advice. Use it to catch cheap defects early and combine it with manual testing.

Responsible use - your responsibility

• Only audit sites you own or have written permission to audit. By ticking the confirmation box in the input you state that this applies. The actor sends real HTTP requests to the web servers you name; you are responsible for any terms of service, contract or law that applies to that.
• The actor fetches only the start URLs you supply and the same-host pages they link to (up to the page limit). It never follows links to other hosts, never logs in, never submits forms, never uses cookies, proxies or stealth techniques.
• Private, loopback, link-local and cloud-metadata addresses (for example localhost, 10.x, 192.168.x, 169.254.169.254) are refused.

Politeness and hard limits (enforced in code, not configurable above these values)

rule	value
robots.txt	fetched once per host and obeyed (group for this actor's name, else *); Crawl-delay is honoured (delays above 30 s skip the host); robots.txt unreachable (5xx / network) or access denied (401/403) = treated as "disallow all" and reported; URLs disallowed by robots.txt are not requested and are reported as such
request rate	requests run one at a time, >= 1 s between request starts per host (more if robots.txt asks)
size	50 pages by default, hard cap 500 pages per run; 20 start URLs, 3 hosts; response bodies capped at 2 MB (sitemaps 10 MB)
retries	max 3 per URL (network errors, 5xx, 408; 429/503 only after waiting), exponential backoff with jitter
Retry-After	honoured; if a server asks for more than 60 s the run stops instead of waiting
403 / 429	3 consecutive 403/429 responses stop the run; a 403 is never retried
WAF / bot challenge	Cloudflare/Akamai/etc. challenge pages, cf-mitigated: challenge, empty HTTP 202 and CAPTCHA pages stop the run immediately - the actor does not try to get around them
total requests	hard ceiling per run (about 3x the page limit plus 40); max run time 15 min by default (1 h max)
identification	User-Agent contains the actor name, publisher, a contact pointer and the run id: <actor>/0.1 (Apify actor by Licensed Pipe; ...; contact ...; run <id>)
adaptive back-off / stop	after any 429/503 the gap grows (2 s, 4 s ... up to 10 s) for the rest of the run; 6 consecutive 5xx/network failures stop the run
Please do not start many runs against the same site at the same time.

Personal data

• Page bodies are parsed in memory and discarded; no page text, e-mail addresses, phone numbers, names, cookies or form values are stored. mailto: and tel: links are ignored.
• The only free text kept are fields documented below, shortened, with anything that looks like an e-mail address or phone number masked. URLs are stored without their query string (replaced by a salted marker like ?q~1a2b3c4d; the real URL is still requested). Set keepQueryStrings to keep them - only if they contain no personal data.
• If your own pages contain personal data in titles or URLs, the dataset you create contains it too; you are the data controller of that dataset.

Input (see .actor/input_schema.json)

field	meaning
startUrls	your pages (use the exact host)
confirmOwnership	must be ticked
crawlInternalLinks / maxDepth	follow same-host links breadth-first (default on, depth 3)
maxPages	default 50, max 500 (each returned row is billed)
maxRuntimeSeconds	default 900, max 3600

Output

Input option keepQueryStrings (default off) keeps real query strings in output URLs; otherwise they are replaced by a salted marker.

One row per URL: url, finalUrl, status, counts{errors,warnings,checkedElements}, and issues[] where each issue has code, severity, wcag (criterion number, informational), count and up to 5 examples given only as tag#id.class selectors - no element text or HTML snippets are stored. RUN_SUMMARY lists limits, robots.txt status and any early-stop reason.

Legal notes, disclaimers and trademarks

• Ownership is your declaration, not something the actor can check. The actor cannot verify that you own or may audit a site. The confirmation box is your binding statement; you alone are responsible for having the right to send these requests (site terms, contract, applicable law such as the EU/Finnish rules on unauthorised access to information systems) and for complying with the Apify Terms of Service / Acceptable Use Policy. Do not use this actor against sites you do not control and have no permission for. The publisher may block abuse.
• Load protection is built in, but it does not replace permission. Sequential requests, at least 1 s apart (slower after any 429/503), robots.txt and Crawl-delay obeyed (401/403 on robots.txt counts as "disallow"), hard page and request ceilings, run-time limit, retries capped at 3, and the run stops on repeated 403/429, WAF challenges, repeated 5xx/network failures or an excessive Retry-After. Do not start several runs against the same site at the same time.
• Network safety. Only http(s) URLs on the hosts you supplied; private, loopback, link-local, metadata and other reserved addresses are refused at connection time (also against DNS rebinding); redirects leaving your hosts are reported, never followed; no cookies, logins or forms.
• Personal data (GDPR). By default the actor stores no page text. Query strings are replaced by a salted marker in all stored URLs (keepQueryStrings is off by default). E-mail addresses, phone numbers, IBAN-like and Finnish personal-identity-code patterns are masked in any text it keeps. Names cannot be detected automatically, so URL paths may still contain personal data; if they do, you are the controller of the dataset you create and are responsible for its lawful use, retention and deletion. Requests sent to your server appear in its access logs (IP address of the Apify run, the User-Agent below).
• Identification. The User-Agent names the actor, the publisher and the run id, and points to the Apify actor page for contact, so site operators can recognise and report the traffic.
• Not affiliated. This is an independent, unofficial tool. "Google", "WCAG" and "W3C" and other names are trademarks or marks of their respective owners; they are used only to describe what is checked and do not imply endorsement or affiliation. Findings are informational, not legal, compliance or professional advice and no guarantee of search ranking or conformance.

Pricing

Pay per event (proposal, see PRICING.md): one page-audited event per returned row. Runs that stop before returning any row are not charged.