WCAG 2.2 (published October 2023) introduced 9 new success criteria. Most of them target real-world friction points — touch targets, focus visibility, drag operations — rather than purely conceptual rules. Here's what each one means in practice.
The 9 new criteria
2.4.11 Focus Not Obscured (Minimum) — AA
When an element receives focus, it must not be entirely hidden by sticky headers, banners, or modals. Common offender: a sticky cookie banner that covers the focused link in the menu just below.
Fix: scroll-padding-top equal to the sticky header height, or move focus to a position that accounts for the overlay.
2.4.12 Focus Not Obscured (Enhanced) — AAA
Same as above, but the focused element must be fully visible (no partial occlusion).
2.4.13 Focus Appearance — AAA
The focus indicator must have a minimum area (2 CSS px around the perimeter) and a 3:1 contrast ratio against the unfocused state. Killing the default outline without replacing it fails this.
2.5.7 Dragging Movements — AA
Anything done with a drag must be doable with a single pointer (click/tap). Sliders, kanban boards, signature pads — all need a non-drag fallback.
2.5.8 Target Size (Minimum) — AA
Interactive targets must be at least 24×24 CSS px (with exceptions for inline text and spacing-based equivalents). Tiny social icons in footers are the most common failure.
3.2.6 Consistent Help — A
If a help mechanism is repeated across pages (chat widget, contact link), it must appear in the same relative location. Don't hide the chat on some pages.
3.3.7 Redundant Entry — A
Within the same process, don't ask for information the user has already entered. Pre-fill or offer to reuse.
3.3.8 Accessible Authentication (Minimum) — AA
Cognitive function tests (memorize, transcribe a captcha, identify objects) must have an alternative. Allow paste in password fields. Offer SSO or magic links.
3.3.9 Accessible Authentication (Enhanced) — AAA
No cognitive function test at all, even with alternatives. Object-recognition CAPTCHAs disqualify you.
How AccessProof helps
Of these, the criteria reliably catchable by automated tooling (axe-core 4.9+) are 2.5.8 (target size) and partial coverage of 2.4.11 (focus obscured). The rest require manual review or process audit. AccessProof flags the automatable ones automatically and prompts you for the manual checks at the end of each scan.