Free website compliance scan: what to look for (and what to ignore)

Search for “free website compliance scan” and you will find a hundred tools. Some are useful diagnostic instruments. Many are lead-generation funnels for consulting firms or overlay vendors, designed to produce alarming reports that drive sales calls. This article is the buyer’s guide.

What a useful free scan should do

A scan that earns the user’s trust does five things:

1. Tests against named criteria. WCAG 2.1 AA success criteria, GDPR article references, ePrivacy rules. Not vague labels like “risk score.”
2. Captures network traffic on first load. The single most useful GDPR-cookie test only works if the scanner waits no more than a second before snapshotting cookies and requests.
3. Differentiates severity. A missing form label is a high-severity accessibility issue with legal exposure; a missing alt on a decorative divider is not. Know the limit here: no automated tool can actually tell those two images apart. Every one of them, ours included, tests whether the attribute is present, never whether the image mattered. Tools that lump all findings together produce useless “500 violations” reports; tools that claim to know which images are decorative are guessing.
4. Provides specific remediation. The exact element selector and the code change needed. Not “Improve color contrast.”
5. Says what it can’t check. No automated tool catches all WCAG issues; honest scanners say so. Tools that claim 100% coverage are misleading.

Red flags in free scans

“Your site is X% non-compliant.” A single percentage hides severity differentials. A site with 5 warnings can score lower than one with 1 critical error.

“Your site is at risk of a $75,000 lawsuit.” Threat language designed to drive sales. Real audits cite specific exposure based on jurisdiction-specific fine schedules.

“We can fix all your accessibility issues automatically.” The accessibility-overlay claim. The FTC has fined for this; do not engage.

No mention of WCAG criteria. If the scan does not name 1.4.3 Contrast (Minimum) when it flags a contrast issue, the report cannot be acted on.

No mention of jurisdiction. “You have GDPR violations” is useless if you have no EU visitors and unhelpful if you do not know which articles apply.

How to read the results

Treat any free scan as a triage signal, not a verdict. The questions that matter:

• What are the high-severity issues? Form labels, missing alt attributes, contrast on body text, unnamed links and buttons, pixels firing pre-consent. Fix these first. Keyboard traps and focus visibility belong on the same priority list, but they will not appear in any automated report, because no scanner presses Tab.
• What does my cookie inventory look like? Compare it to your published cookie policy yourself. Mismatches are the fastest way to fail a regulator audit, and no scanner we know of, ours included, runs that comparison for you.
• Are required legal pages present and reachable? Privacy policy, accessibility statement, and, in Germany and Austria, an imprint. Expect presence checks and nothing more: a cookie policy usually gets folded into the privacy check rather than graded on its own, and no scanner reads any of these documents for content.
• Is the issue list specific enough to action? If your developer cannot fix the issue from the report, the scan was a marketing exercise.

What to do with the report

One workflow that consistently produces results for SMBs:

1. Run the scan, export the issue list.
2. Triage: high-severity legal-exposure issues first, then medium, then warnings.
3. File one ticket per issue with the specific selector and the developer fix from the report. Do not file “fix all accessibility issues.” That ticket will sit forever.
4. Re-scan once the batch is deployed, not after each individual fix. The diff confirms the issues are resolved and catches regressions introduced along the way. Check your tier’s limits first: Veracly’s free scan allows one run per email address per rolling seven days, so a fix-by-fix loop will hit the rate limit.
5. Set up a recurring scan cadence. Weekly is the realistic SMB default; daily is valuable for sites with active marketing experimentation.

Veracly’s free scan

Measured against the list above, here is ours. The free scan covers one page, one run per email address per rolling seven days. It tests against WCAG 2.1 AA via axe-core plus five custom DOM rules, records cookies, storage writes and third-party requests on first load before any banner interaction, matches those requests against a hand-curated registry of 69 tracker vendors, and checks that a privacy policy, an accessibility statement and, in Germany and Austria, an imprint exist on your own domain. Every finding cites the specific WCAG criterion or regulation article.

Which rule packs you are graded against depends on where your visitors are, not on what you paid. A free scan takes the single market you declare on the form and returns the framework that matches it: EAA and GDPR for an EU site, UK Equality Act and UK GDPR for a British one. Multi-country scope, and with it ADA or AODA alongside the European packs, comes from configuring visitor countries on a paid plan. The analyzers, the rule packs and the score formula are identical either way. What the free tier leaves out is AI explanation on every finding rather than only its top three, plus the evidence screenshots and the copy-paste remediation, which are generated on paid scans only.

And since we made it a criterion, here is what the scan cannot detect. No key is ever pressed, so keyboard traps, focus order and focus visibility go untested. PDFs are not scanned at all. Third-party video embeds get no caption check. Anything axe returns as “needs review” is discarded rather than reported, which quietly drops contrast findings on text over images and gradients. There is one viewport, 1280×800, so reflow and mobile-only defects are never exercised. Twenty-eight WCAG criteria are marked manual and score-neutral. And we never click your cookie banner, because clicking would itself be a consent gesture and would pollute the pre-consent reading, so we can tell you whether a reject-all control is present and equally weighted, but not whether pressing it actually stops the tags. Run a scan.

See also: What is a website compliance audit? · WCAG 2.1 AA accessibility audit explained