Behind the Scenes

Why Our WCAG Scanner Is Free (And What That Costs Us)

May 28, 20267 min read

Run a search for "free WCAG scanner" and the pattern repeats. You land on a page that promises a free audit, then asks for your email, your role, your company size, and sometimes your phone number. Then it shows you violations. We took the other side of that bet. /free-wcag-scan runs a full axe-core pass on any URL — about 120 rules covering WCAG 2.2 A and AA — and returns the report in roughly 90 seconds. No account, no card, no email gate. Here is the math behind that decision and what it actually costs us per scan.

Two scanner business models compared Side-by-side comparison of the gated email-first scanner funnel versus the no-signup full-report model. The gated model collects emails, sends drip, schedules a sales call, and shows partial findings. The open model shows the full report, links to the pillar guide, and lets the merchant self-select into the paid product. TWO FUNNELS Gated (most scanners) 1. Land on page 2. Email + role + company size 3. See top 3 issues only 4. Drip sequence + sales call 5. Maybe see the full report Optimised for lead capture. Open (this scanner) 1. Land on page 2. Paste URL, click Scan 3. See the full violation list 4. Read the pillar guide 5. Self-select into the paid plan Optimised for trust.
The gated funnel sells "the report" as a lead magnet. The open funnel sells the platform — and lets the report itself do the qualifying.

The math behind a single scan

A real WCAG scan is not a clever algorithm. It is a browser. We boot a containerised Chromium, load the URL, wait for paint and idle, inject axe-core (the same engine Lighthouse uses), run the 120-rule pass, capture screenshots of every violation, and emit a structured JSON report. The pipeline runs on a small Fly.io worker, around 1.5 GB of RAM, that idles when nobody is scanning.

The unit economics break down like this:

  • Chromium time — about 8 to 14 seconds of compute per URL, depending on page weight. At Fly.io's shared-cpu-1x:2048MB rate, that works out to roughly $0.0008 to $0.0014 in raw compute.
  • Bandwidth — a typical e-commerce homepage is 2 to 5 MB. Outbound is free on Fly within our allowance; inbound from origin is essentially zero.
  • Storage — screenshots and JSON reports for a free scan are kept 7 days and then purged. Average storage cost per scan: under $0.0001.
  • The fully-loaded number — counting amortised infra (DB, Redis, the worker reservation that keeps cold-start under 2 seconds), we land at roughly $0.03 per free scan. Three cents.

If 1,000 visitors run a scan in a month, that is $30 of marginal compute. Less than a single Google Ads click in our category.

What you actually get

The free scan is not a teaser. It returns:

  • A WCAG 2.2 A + AA compliance score — the same headline number we display inside the paid product.
  • The full list of violations — sorted by severity (Critical, Serious, Moderate, Minor), with the failing selector, the rule ID, the WCAG criterion, and a screenshot of the element.
  • Plain-English explanations — for each rule, what it means and the typical fix. No "consult our enterprise team to learn more."
  • Issue prioritisation — the five issues most likely to appear in a demand letter, called out at the top.

What it does not include — and this is the honest answer:

  • No PDF report. Generating a PDF reliably costs us about ten times the scan, in Chromium time, because we render the report with print layout. PDF is a paid-plan feature.
  • No history. The free scan is one-shot. You get a URL to share for 7 days, then we purge it. Tracked sites with re-scan history are a paid-plan feature.
  • No multi-page crawl. The free scan runs against the URL you paste. The paid plans crawl the sitemap and audit every page.
  • No screen reader narration check. Automated tools, ours included, do not catch what a screen reader user actually hears. About 30% of real accessibility issues need human review — see the pillar guide for the full breakdown.

The bet

Most accessibility SaaS treats the report as a lead magnet. Logical, on paper: the violation list is what the buyer wants, and the email is what the sales team wants. Trade one for the other.

We think that funnel is broken for our product specifically, for three reasons.

One. A merchant who hands over their email under a "free scan" pretext converts on different intent than a merchant who has already read their own violation list. The first wants the scan. The second wants the fix. The economics of a SaaS that sells continuous monitoring favour the second cohort heavily.

Two. Our category is saturated with overlay widgets that promise compliance and deliver a documented liability. Trust is the bottleneck. If we ask for an email before showing a single rule failure, we are using the same playbook as the overlays. We are not the overlays.

Three. The cost of a scan is below the cost of a single ad click. The math only works against us if we measure success by leads captured. Measured by qualified pipeline — merchants who arrive having seen their own report and ready to talk about the fix — it works the other way.

What happens after the scan

Nothing happens automatically. We do not capture an email, so there is no drip sequence. We do not have your phone number, so nobody calls. The shareable URL expires in 7 days. The Chromium worker forgets you existed.

If you want the rest — PDF, history, multi-page crawl, tracked sites — you self-select into the paid plans. Starter at $29/month covers 5 sites with weekly scans. Pro at $99 covers 25 sites daily. The first scan stays free because it was always supposed to be free.

The regulatory backdrop

The European Accessibility Act came into force on 28 June 2025. EU member states are now actively enforcing it for consumer-facing digital services, with the bulk of e-commerce sites in scope. The US side is older — Title III of the ADA has been interpreted to cover websites since at least 2017 — and the cadence of ADA demand letters targeting websites grew roughly 14% year-over-year through 2024 and accelerated again in Q1 2026.

Two regimes, one reality: if your e-commerce isn't audited, you're working on borrowed time. The deadline isn't "later this year." It's whichever comes first — the regulator inspection, the plaintiff firm crawler, or the corporate buyer asking for your VPAT.

A scan that costs us three cents and gives a merchant a baseline they can act on is, in that context, the cheapest pre-emptive action available.

How to use it

  1. Run it on your homepage first. Most demand letters cite the homepage and the checkout flow. The homepage is the easiest to fix and the highest-visibility win.
  2. Run it on a competitor's homepage too. Useful to know whether your category is well-audited or whether you are entering a space where compliance is broadly poor.
  3. Skim the Critical and Serious findings. Those are what plaintiff firms screenshot. If you have fewer than five, you are ahead of the median.
  4. Walk the 7-step manual audit workflow on the items the scan flags. Automated catches the patterns. The 7-step walk catches the rest.
  5. Decide whether you want this continuously. A one-shot scan is a baseline. Conformance is a rhythm. The paid plans exist for the rhythm.

That is the whole pitch. /free-wcag-scan. No email, no card, no overlay. Three cents on our side, a real baseline on yours.

Want this checked on your site automatically?

AccessProof scans your site against WCAG 2.2 every day, scores it, and tells you exactly what to fix. Free plan available.

Start free scanSee sample report