Webscan Documentation

Webscan User Guide

A practical, task-oriented guide for accessibility auditors and teams using webscan. It follows the order you'd actually work in — from setting up a site to delivering a report — rather than listing features in isolation.

New to webscan? Read Core concepts first, then jump to Your first scan. Everything else is reference for when you need it.

Core concepts

Webscan organises work in a simple hierarchy:

Organization — your team or company. Holds members, billing, and report branding.
Project — a body of work (usually one client or product). Holds websites, issues, and reports.
Website — a single site or app you audit. Everything below hangs off a website: scans, recorded sessions, monitoring, journeys.
Scan — one automated pass over a website's pages, producing findings.
Finding — a single accessibility problem on a page, mapped to WCAG.
Verdict — your judgement on a finding: Confirmed (a real problem) or False positive (not actually a barrier). Verdicts train webscan over time.
Issue — a tracked piece of remediation work, created from a finding or an audit result. Issues carry comments, evidence, AI fix suggestions, and retests.
Report — a client-ready deliverable exported to HTML, PDF, or Word.

Two ideas make webscan more than a checker:

Automated + human + behavioural. Automated scans (axe-core) catch code-level issues; manual audits capture human judgement; the behaviour engine and recorded sessions catch things only a real interaction reveals — focus traps, focus stealing, unannounced status messages.
Evidence that compounds. Your verdicts and retests feed a per-organization model that prioritises future findings, so the tool gets better at surfacing what matters to your work.

Getting set up

Create your account and organization

Register at /register/, or use the Free scan on the home page to try a single scan before signing up.
On first sign-in, the Get started flow (/get-started/) walks you through creating your first organization, project, and website.
Invite teammates from Organization → Members. Roles: - Owner / Admin — full control, billing, settings. - Editor — run scans, set verdicts, manage issues. - Viewer — read-only (cannot run scans or change verdicts).

Add a website

From a project, choose New website and provide:

Base URL — the site to audit.
Environment — development, staging, or production. This controls how cautious webscan is (see Environments and blast radius).
Page limit — how many pages a scan will crawl.

Your first scan

Open the website and choose Run scan.
Webscan crawls up to your page limit, runs axe-core on each page, and (if enabled) records behaviour during the visit.
The scan page live-updates. When it finishes you'll see findings grouped by rule and severity.

Reading findings

Each finding shows:

What and where — the rule, the element (CSS selector), and the page.
WCAG mapping — the success criterion and level (A / AA / AAA).
Severity — how serious the barrier is.
Priority — webscan's ranking of what to fix first (see Prioritisation).

Open any finding for the full detail, remediation guidance, and evidence.

Verdicts: teaching webscan what's real

Automated tools produce false positives. Webscan lets you record a verdict on each finding so noise doesn't waste your time twice.

On a finding, choose Confirmed or False positive.
Verdicts are remembered by a stable fingerprint of the finding, so the same issue on a later scan carries your verdict forward automatically.
AI-suggested verdicts (if AI is enabled): webscan can pre-suggest a verdict with a short rationale, which you accept or override. You are always the final word.

Verdicts do double duty: they clean up your current review and become training data (see Prioritisation).

From finding to fix: issues, assistance, and retests

Create an issue

Turn a finding (or a manual audit result) into a tracked issue. Issues hold:

comments and status,
evidence (screenshots, notes),
source artifacts (the relevant code),
AI remediation drafts,
retest history.

AI remediation assistance

On an issue, choose Generate assistance. Webscan drafts a concrete fix (explanation + code) which you review before using. If AI isn't configured, this option is hidden — everything else still works.

Push a fix to GitHub

Connect a GitHub repository to an issue, import the relevant source, and — from a reviewed assistance draft — open a pull request with the suggested change. The audit trail links the finding → issue → PR.

Retest and auto-verify

When a fix ships, close the loop:

Request retest re-checks whether the finding is still present.
Auto-verify re-renders the page and confirms the specific finding is gone, attaching evidence.
On future scans, resolved issues can auto-verify so you're told immediately if a regression reappears.

Recorded audit sessions (the auditor's workflow)

When you've been engaged to audit a real site, you don't want to script every click — you want to use the site while webscan watches. That's a recorded session, powered by the Webscan Session Recorder browser extension.

On the website, choose Record session → Start. Copy the ingest URL and session token shown.
Install the extension (Chrome/Edge or Firefox — see the extension's README), click its icon, paste the ingest URL + token, and press Start recording. Grant access to the site when prompted (the extension only ever touches the one site you're auditing).
Browse and perform the tasks you want to audit — log in, open menus, complete flows. The extension records interactions (clicks, focus changes, navigation, control keys) and streams them to webscan. - Your typing is never captured. Printable keystrokes are dropped and password/card/SSN-type fields are redacted in the browser before anything is sent.
Press Stop recording, then in webscan press Stop & analyse.
Review the flagged behaviours — focus traps, focus stealing, unannounced status messages — and mark each Problematic or Fine. Turn the problematic ones into issues, which flow into the same report and fix pipeline as everything else.

AI review / detection (if enabled): webscan can pre-triage the flagged behaviours (AI review) and even scan the recorded trace for new behaviours its built-in heuristics didn't name (AI detect). Both are assistive — you judge the results.

Going deeper: exploration, journeys, and authenticated scans

Authenticated scans

Many barriers live behind a login. Create an authentication profile for a website (webscan captures and encrypts the logged-in session state) so scans, exploration, and journeys can reach protected pages.

Agentic exploration

Exploration lets webscan navigate a site on its own to reach and check states a shallow crawl would miss. It runs in tiers:

Read-only — navigates and observes without taking consequential actions.
Gated full-action — can interact more deeply on non-production environments, with an explicit acknowledgement. See Environments and blast radius.

Journeys

A journey is a saved, repeatable path through your site (e.g. "sign up → add to cart → checkout"). Define the steps once, then run the journey to scan those exact states on demand — ideal for regression-checking a critical flow.

Manual audits

Automated tooling can't judge everything (meaningful alt text, logical reading order, sensible focus order). Create a manual audit for a website to work through checkpoints, record results, and complete the audit. Manual results become issues just like automated findings, so a single report can combine both.

Custom rules

Every organisation has patterns its own scanners should catch. Custom rules let you define an organization-specific check by DOM/selector — e.g. "flag every <div> used as a button" or "require a visible label near this component." Add a rule, toggle it on, and it runs alongside axe-core on your scans. Findings from custom rules behave like any other finding (verdicts, issues, reports).

Prioritisation and the model

Not all findings deserve equal attention. Webscan ranks findings by priority so you fix what matters first. Priority combines deterministic signals (severity, WCAG level, how often the pattern recurs) with a per-organization model trained on your own verdicts.

Training the model (admins)

The Verdict model dashboard (per organization) lets an administrator:

see how many labelled verdicts exist and the model's status,
export the verdict dataset for inspection,
train a fresh model (runs in the background).

Model training is a platform-level, superuser-gated action. Once trained, the model feeds live prioritisation automatically. The more you review, the sharper it gets.

Monitoring

Set a monitoring schedule on a website to re-scan it automatically (daily, weekly, etc.). If accessibility regresses, webscan raises a monitoring alert you can acknowledge. This turns a one-off audit into ongoing assurance.

Reports and delivery

When you're ready to deliver:

From a project, choose New report and select what to include.
Review the report, then export to: - HTML — shareable, self-contained. - PDF — for formal delivery. - Word (DOCX) — when the client needs to edit or annotate.
Set report branding at the organization level (logo, colours) so deliverables carry your identity.

Reports pull together automated findings, manual audit results, behaviours from recorded sessions, verdicts, and remediation status — one coherent story of the site's accessibility.

Environments and blast radius

The environment you set on a website governs how boldly webscan acts:

Production — cautious. Consequential actions and full-action exploration are restricted; you get read-only behaviour by default.
Staging / development — webscan can explore and interact more deeply, since mistakes are safe. Full-action exploration requires an explicit acknowledgement.

Setting the environment honestly is what lets you use the powerful features safely.

A typical end-to-end audit

Create the project and website; set the environment.
(If needed) add an authentication profile for logged-in areas.
Run an automated scan; triage findings with verdicts.
Record a real session of the key tasks; judge the behaviours.
Do a manual audit for the judgement-heavy checks.
Convert the real problems to issues; generate fixes and open PRs.
Retest as fixes land; auto-verify resolutions.
Build and export the report; brand it.
Set up monitoring so regressions are caught going forward.

Getting help

Free scan (/free-scan/) — try a single scan with no account.
Privacy / Terms / Cookies — linked in the footer (/privacy/, /terms/, /cookies/). The privacy page also documents exactly what the recorder extension captures and redacts.