WCAG 2.2 in Plain English for a Business Website
WCAG 2.2 is the W3C Recommendation for making web content more accessible. The current page is dated 12 December 2024, and its change log records an original publication on 5 October 2023 [4]. Three Level AA additions are easy to feel on a business site: 2.5.8 Target Size (Minimum), 2.4.11 Focus Not Obscured (Minimum), and 3.3.8 Accessible Authentication (Minimum) [4]. They show up as a button that is hard to tap, a focused link hidden under a banner, and a login that blocks someone who cannot remember a puzzle. The Recommendation also describes three levels, A, AA, and AAA [4]. What follows is those three ideas, why another check follows launch, and why we do not treat a scanner or an overlay as a legal shield.
A button large enough to hit
Success Criterion 2.5.8 covers targets for a mouse, a pen, or a finger [1]. The size is at least 24 by 24 CSS pixels, except in the cases below [1]. A CSS pixel is a layout unit, not a hardware dot on a phone. The size is met when a solid 24 by 24 CSS pixel square, aligned to the page, fits entirely inside the target [1]. A tilted shape can pass if that square still fits, and rounded corners can fail it when the square does not [1].
The page allows a minimum size or, if that size is missed, minimum spacing, so a thumb or a less precise pointer is less likely to hit the neighbor [1]. A very small target can still pass when nothing else is too close, though the page recommends the size itself for important controls [1]. Five exceptions are part of the criterion, and dropping one misstates it [1].
Spacing. A target under 24 by 24 CSS pixels can pass when a circle 24 CSS pixels in diameter, centered on its bounding box, does not intersect another target or the circle of another undersized target [1]. Icons jammed together fail. The same icons, still under 24 by 24 CSS pixels, can pass if each has a clear pocket around it [1].
Equivalent. Another control on the same page does the same job and meets the size rule [1].
Inline. The target sits in a sentence, or the line height of non-target text constrains it, which is the usual case for a link in a paragraph [1]. Text reflows, so those positions are unpredictable, and the page puts a readable line height ahead of forcing every inline link up to the square [1].
User agent control. The browser sets the size and the author does not change it, as with the days in an unmodified date field [1]. Restyle that control, or resize a scrollbar, and the exception ends [1].
Essential. A particular presentation is essential, or is legally required, for the information being conveyed [1]. Map pins are often below 24 CSS pixels apart because each pin has to mark a real place, and the page treats that position as essential, as it does a necessarily dense chart [1]. "Legally required" is the criterion's phrase about that presentation. It is not our account of what any statute asks a business to do.
Zoom does not change CSS pixel size, so it is not a way to meet the rule [1]. While a dropdown, a modal, a cookie banner after load, or an idle survey dialog covers a target, the size check does not apply to that covered target [1]. It does apply to targets in new content that appears on top [1]. The same page names a stricter criterion, 2.5.5 Target Size (Enhanced), for important controls [1]. This article stays with the minimum in 2.5.8, exceptions included [1].
A focused link a banner can cover
Keyboard users, and people using a switch or voice input through the keyboard, need to see the item that has focus. If it is fully covered, the page can feel stuck.
Success Criterion 2.4.11, the Level AA minimum, says that when a component receives keyboard focus, author-created content does not hide it entirely [2]. Part of the component may be covered and the minimum can still be met [2]. None of it covered is the preferred outcome, and that outcome is the separate AAA criterion Focus Not Obscured (Enhanced) [2]. WCAG 2.2 numbers that criterion 2.4.12 [4].
Sticky headers, sticky footers, and non-modal dialogs are the overlaps the page names [2]. A sticky cookie banner fails this criterion when it hides the whole focused component [2]. A modal banner, scroll padding that keeps the banner off other content, or a note that closes when it loses focus are approaches the page describes [2]. If the user can move a panel, only its starting position counts [2]. Content the user opened may cover focus and still pass if the user can reveal the component without advancing focus [2]. The check is the component, not an outline drawn outside it, unless that outline is part of the component [2].
On a Charlotte shop site, a holiday bar stuck to the viewport can bury a call link that was fully visible the week before.
A login that is not only a memory test
Success Criterion 3.3.8, Level AA, aims at logins with less mental effort, without making people solve, recall, or transcribe something to get in [3]. A cognitive function test, such as remembering a password or solving a puzzle, is not required for any authentication step unless that step offers an allowed path [3].
The paths are an alternative method that is not a cognitive function test, a mechanism that helps the person finish the test, object recognition, or identifying non-text content the user provided to the site [3]. Object recognition and personal content may be images, video, or audio [3]. Two mechanisms named in the criterion are password managers, which reduce memory, and copy and paste, which reduces re-typing [3].
A cognitive function test means remembering, manipulating, or transcribing information, including a password or gesture, characters copied by eye, spelling, math, or a puzzle [3]. Name, email, and phone number are not in that group. They are stable personal identifiers [3]. The criterion covers an existing account, not the creation of a username or the start of an account [3]. Every step of a multi-step login needs a passing path, so a password manager on step one does not rescue a puzzle that is the only step two [3].
Blocking a password manager, or blocking paste, fails unless another method is available [3]. Manual transcription of a verification code does not meet the criterion, and paste into the code field has to be possible [3]. One-digit boxes that keep only part of a pasted code, or a request for the first, third, and fifth character, force transcription unless another method exists [3].
Object recognition and picture-based personal content are allowed at this AA level, and the page says they should still be avoided if possible because they leave many people out [3]. They are not exceptions in Success Criterion 3.3.9, the AAA enhanced criterion [3]. Text the user once supplied does not count as personal content, because it asks for recall and transcription [3]. Math problems and visual puzzles, such as rotating an image to match an arrow, are not excepted [3]. Selecting photos of a common object, such as a car, is the kind of recognition that is excepted. Multiplying two counts is not [3]. A hardware key, a confirm-it-is-you prompt, and a fingerprint or face check from the operating system are not cognitive function tests in this account [3]. Someone can still be stuck if the only route is a site-specific puzzle, or a code that has to be retyped when paste would do.
Why another check follows launch
A launch-day review looks at the pages that exist that day. Conformance in WCAG 2.2 is defined only for web pages, and a claim may cover one page, a series of pages, or multiple related pages [4]. A claim is optional. If one is made, it includes a date and a concise description of the pages, such as a list of URIs, including whether subdomains are included [4]. That set, on that date, is what the claim describes.
A blog, comments, or other content added later can use a statement of partial conformance, because the later material is unknown at posting and can affect the rest of the page [4]. Understanding Conformance says to monitor content that can change without the author's approval, since a page which once conformed may suddenly fail to conform [5]. Edits a business makes later can change the result too. A new post can add share icons under 24 by 24 CSS pixels with no pocket of space [1]. A new button can crowd a menu. A banner can cover a focused link that was clear last week.
Our Forged Sites page describes a monthly accessibility scan, plus a human look where a scanner cannot decide, and it states no compliance guarantee and no legal-immunity guarantee. That later look is our practice after launch. It is not a statement that a site is compliant.
What a scanner and an overlay do not settle
W3C's evaluation overview says no tool alone can determine if a site meets accessibility standards, and that knowledgeable human evaluation is required to determine if a site is accessible [6]. Some checks cannot be automated and need a person, and tools can report inaccurate results [7]. The tools page also says not to rely on the tool's report over the experience of people using the site [7]. Understanding Conformance describes the work as automated testing and human evaluation together [5].
Spacing, a banner added next month, and a login that blocks paste are the kinds of checks a width-and-height report does not finish.
A March 18, 2022 ADA.gov page says automated checkers and overlays that identify or fix problems can help, but they need the same care as spelling and grammar checkers [8]. A clean report does not necessarily mean everything is accessible, and a few reported errors do not necessarily mean a barrier [8]. A manual check alongside the automated one gives a better picture [8]. That page does not call an overlay a legal shield.
We do not sell a scanner or an overlay as a legal shield. That is our view. The Forged page says the same kind of limit: no compliance guarantee and no legal-immunity guarantee. Display tweaks laid on a finished page do not enlarge targets, uncover focus, or allow paste. A scan is not a certificate. This article does not state a legal duty, and it does not say a scanned site is a compliant site.
Practical takeaways
- On the home page, the menu, and the contact page, look at each control people tap and ask whether a 24 by 24 CSS pixel square fits inside it [1]. If it does not, see whether spacing, an equivalent control on the same page, inline text, an unmodified browser control, or an essential presentation actually applies [1].
- Tab through the page with any sticky header, footer, or banner visible. Success Criterion 2.4.11 says the focused component is not entirely hidden by author-created content [2]. Partly visible is that minimum, and fully uncovered is the separate enhanced criterion [2].
- Walk every sign-in step. Check that a password manager can fill the fields and that paste works for a password or a code. If the only path is a puzzle, transcription, or math, that is what Success Criterion 3.3.8 is about, unless a path it lists is really there [3].
How we can help
Have more questions or want to get in touch?
Reach Idea Forge Studios on our contact page, by phone at (980) 322-4500, or by email at [email protected].
Citations
- W3C Web Accessibility Initiative, "Understanding Success Criterion 2.5.8: Target Size (Minimum)" (WCAG 2.2 Understanding document)
- W3C Web Accessibility Initiative, "Understanding Success Criterion 2.4.11: Focus Not Obscured (Minimum)" (WCAG 2.2 Understanding document)
- W3C Web Accessibility Initiative, "Understanding Success Criterion 3.3.8: Accessible Authentication (Minimum)" (WCAG 2.2 Understanding document)
- W3C, "Web Content Accessibility Guidelines (WCAG) 2.2" (W3C Recommendation, 12 December 2024; change log notes original publication 5 October 2023)
- W3C Web Accessibility Initiative, "Understanding Conformance" (WCAG 2.2 Understanding document)
- W3C Web Accessibility Initiative, "Evaluating Web Accessibility Overview" (n.d.)
- W3C Web Accessibility Initiative, "Evaluation Tools Overview" (n.d.)
- ADA.gov, U.S. Department of Justice, "Guidance on Web Accessibility and the ADA" (2022-03-18)
