webscan

Webscan Documentation

Lesson 15 · Recorded audit sessions & the browser extension

Phase 4 · Auditing at scale — Lesson 15 of 21 · All lessons

Objective: understand what a recorded audit session is, install and connect the browser extension, capture a real session, and triage what webscan surfaces from it.

Before you start: a website (Lesson 3) and a Chromium-based or Firefox browser you can add an extension to.

The idea: audit by using the site

Scans, journeys, and exploration all drive an automated browser. But sometimes the best way to find barriers is to use the site yourself — as a real person, following a real task — and have webscan watch.

Recorded audit session — a live session where a browser extension streams your real interactions (clicks, key presses, navigation) to webscan as you use the site; webscan then analyses that trace for accessibility problems and lets you triage them. It captures the actual human experience, including the messy, in-between states a script wouldn't reach.

Key terms:

  • Browser extension — a small add-on you install in your own browser. Here, it's the piece that records your session and sends it to webscan.
  • Session token — a one-off secret the extension presents to stream a session's events to webscan. It's not your login; it just authorises this one recording.
  • Event — a single recorded interaction (a click, a keystroke, a page change).
  • Session finding (behaviour) — a potential problem webscan spotted in your recorded trace, waiting for your judgement.

Step 1 · Start a session and connect the extension

  1. On the website page, open Recorded audit sessions and choose Start a recording (you can give it an optional name).
  2. The session page shows a Session token and a Connect the extension section. Install the webscan extension in your browser, then paste the token to link it to this session.
  3. Once connected, the extension records as you browse.

Step 2 · Do a real task

With recording on, simply use the site the way a user would — complete a sign-up, search for something, work through a form. The extension streams each event to webscan. When you're done, stop the session (from the session page or the extension).

Privacy — redaction happens in your browser. Sensitive input (like what you type into password and similar fields) is redacted in the browser before anything is sent to webscan. The trace records that you interacted, not your secrets. Still, use a test account and test data where you can.

Step 3 · See what you did

The session page replays the trace in two parts:

  • What you did — the ordered list of events, so you can see the exact path you took.
  • Behaviours to judge — the session findings webscan extracted: moments in the trace that look like accessibility problems (for example, a keyboard trap, or focus going somewhere unexpected).

Step 4 · Triage: Problematic or Fine

This is where your expertise comes in. For each behaviour, record a verdict:

  • Problematic — yes, this is a real barrier.
  • Fine — not actually a problem.
  • (New ones start as Not yet judged.)

You're the judge, exactly as with scan-finding verdicts in Lesson 6 — the machine surfaces candidates; you decide.

The AI helpers (optional)

Two AI actions can assist your triage — both are hints, never decisions:

  • AI review (suggest verdicts) — the assistant reads the behaviours webscan already found and suggests Problematic/Fine for each, with a rationale, to speed your triage. You still decide.
  • Find issues (AI) — goes further and looks through the recorded trace for new problems the deterministic checks didn't catch. Anything it surfaces is marked AI-detected so you know its origin, and still needs your verdict.

Step 5 · Turn barriers into issues

Any behaviour you mark Problematic can be promoted into a remediation issue — dropping it straight into the Phase 2 workflow (issue → assistance → fix → retest). So a real, human-experienced barrier ends up tracked and fixed the same way as everything else. Once again, every source of findings converges on one backlog.

Tips & pitfalls

  • Record one task per session. A focused "complete checkout" session is far easier to triage than a sprawling browse.
  • The token authorises one session — treat it as a secret and don't paste it anywhere but the extension.
  • Use AI review to triage faster, not to think less. It's a fast first pass; your verdict is what counts.
  • This complements scans, it doesn't replace them. Recorded sessions catch experiential barriers; keep scanning for the wide, measurable ones.

Recap

  • A recorded audit session streams your real interactions (via a browser extension and a one-off session token) to webscan for analysis.
  • Sensitive input is redacted in the browser before sending.
  • You triage behaviours as Problematic/Fine; AI review suggests verdicts and Find issues (AI) surfaces new AI-detected ones — both just hints.
  • Problematic behaviours become issues, converging with all other findings.

Try it yourself

Start a recording, install and connect the extension with the session token, and complete one short task on your site. Stop the session, review What you did and Behaviours to judge, mark one behaviour, and (if it's a real barrier) turn it into an issue.

Previous: ← Lesson 14 · Manual audits Next: Lesson 16 · Custom rules →