August 2026 Newsletter: Free contrast checker, two-factor authentication, league tables, and five new audits
Welcome back to the A11y Pulse newsletter! Most accessibility legislation is about raising the floor, so August brought an unusual one: Missouri’s Act Against Abusive Website Access Litigation (SB 907) took effect on 28 August, and it is aimed squarely at the volume filers rather than at inaccessible websites. A business that receives a demand letter now gets 90 days to fix the issues before a claim can proceed, and a plaintiff who presses on after a genuine cure and loses can be ordered to pay the defendant’s costs, with sanctions of up to three times the fees awarded.
Reasonable people disagree about whether laws like this protect small businesses or blunt the main enforcement mechanism disabled users actually have. What is not in dispute is the practical consequence: the cure period is only useful to you if you can find and fix your issues inside 90 days. That is a lot easier when you already know what they are, which is a decent summary of what we spent August building.
We shipped a free contrast checker anyone can use, two-factor authentication, a rebuilt public scoreboard, and five new audits. Let’s dive in!
A free colour contrast checker
Colour contrast is one of the most common issues we find. It was on 23 of the 26 council sites in July’s benchmark, and it is usually the easiest category of issue to fix, because the fix is a hex code rather than a rewrite of your markup.
So we built a free colour contrast checker. Pick a foreground and a background colour, and you get the ratio along with clear pass or fail results for normal text, large text, and non-text elements at both AA and AAA. There is no sign-up and nothing to install. The maths is the same code that powers the contrast audit in our scanner, so a result you get from the checker is the result you would get from a scan.
If you want the background on why the thresholds are what they are, Andy’s guide to accessibility and colour contrast covers it.
Two-factor authentication
A commonly-requested feature, two-factor authentication is now available for all A11y Pulse accounts. This can be enabled by individual users, and if you are a team admin you can enforce 2FA for everyone on your team.
This was the first item on our security roadmap, and is a big step forward for protecting your account. We are looking forward to adding more security features in the months ahead, including SSO and audit logs.
The scoreboard is now a set of league tables
Our public scoreboard tracks the accessibility of some of the world’s most visited websites, and it has been a flat list since we launched it. This month we rebuilt it as league tables. Just under 100 sites are now split across ten leagues, including News & Media, Retail & E-commerce, Banking & Finance, Government, and Healthcare, and each league is ranked and divided into three bands: Good at 90 and above, Needs improvement at 70 to 89, and Poor below 70.
Positions are recalculated monthly, so every site carries its movement against last month’s table rather than against its last scan. Some of the bands tell a story on their own. No search engine we test currently ranks as Good.
You can browse the leagues at scoreboard.a11ypulse.com.
Five new audits, and the source is already public
In June I wrote that we wanted to extend our focus testing to WCAG 2.2 and release the source, because better accessibility testing should not be locked inside one product. The Focus Appearance audit went open source in July. This month we added five more, and published them at the same time.
The new audits cover:
- 2.4.11 Focus Not Obscured - where a focused element ends up hidden behind a sticky header or a cookie banner.
- 3.2.1 On Focus - where focusing a control triggers an unexpected change of context.
- 1.4.10 Reflow - which checks for two-dimensional scrolling at a 320px width.
- 1.4.12 Text Spacing - which looks for clipped or overlapping text once spacing overrides are applied.
- 2.4.1 Bypass Blocks - which verifies that a skip link actually moves keyboard focus.
All five are available now in the A11y-Pulse/audits GitHub repository and on npm, source-available under the PolyForm Shield License. These audits are still classified as “experimental” within A11y Pulse while we tune them against real sites. They will roll out to all scans in the coming months. Our Audits documentation explains which audits we run and, just as importantly, what an automated scan can and cannot tell you.
That’s all for this month. Thanks again for following along with our journey. I’m looking forward to sharing more updates with you next month.
Joseph