Until now, our axe-core checks only looked at the top-level page, so anything embedded in an iframe went untested. Scans now also check iframes served from the same origin as the page, including iframes nested inside them, up to ten per page. Embedded checkout forms, sign-up widgets and older sections of a site loaded in a frame are now held to the same checks as the page around them.
You may see new issues on pages that haven’t changed. They were there before, we just weren’t reporting them. Issues inside an iframe show the iframe first in their element path, so you can tell which frame they came from. Ignore rules with a CSS selector work inside iframes too: the selector is matched against elements in the iframe’s own document, the same way it is for the top-level page.
Iframes from other origins, such as ads, video players and analytics, are still not tested. We don’t run our code inside other companies’ content, and you usually can’t fix their markup anyway.