Do you need to audit a city website? Most cities discover the size of their accessibility problem the same way: someone runs a scanner, gets back four thousand violations, and has no idea which of them actually stop a resident from paying a water bill. The scan is not the audit. The audit is what you do with it.
This is the process, in the order that produces a defensible remediation plan rather than a spreadsheet nobody acts on.
Know which standard you audit a city website against
The DOJ’s Title II final rule, published April 24, 2024, requires conformance with WCAG 2.1 Level AA. Not 2.0, not 2.2. Compliance dates are April 26, 2027 for jurisdictions of 50,000 or more and April 26, 2028 for smaller jurisdictions and special districts, following the DOJ’s April 2026 one-year extension.
WCAG is structured in three conformance levels: A (minimum), AA (the level the rule requires), and AAA (aspirational, and not achievable for all content types). Audit against 2.1 AA. If your platform or vendor builds to WCAG 2.2 AA, that exceeds the requirement and is reasonable; 2.2 adds criteria around target size, focus appearance, and dragging movements that benefit real users. But conformance is measured against 2.1 AA, and you should be able to state that clearly to your council and your attorney.
Roughly one in four U.S. adults lives with a disability, according to CDC data. That is the population your audit is about, and it is larger than most councils assume when the item comes up for funding.
Step 1: Scope before you scan
Decide what is in scope before running any tool, or you will drown in findings from content the rule excludes. Title II’s exceptions cover archived web content, pre-existing conventional electronic documents not used for current services, third-party content posted outside a contractual arrangement, individualized password-protected documents, and pre-existing social media posts.
Build an inventory that separates:
- Service-critical paths: bill payment, permit applications, service requests, job applications, emergency notification signup. These are where a barrier does actual harm and where litigation risk concentrates.
- High-traffic informational pages: homepage, department directories, council agendas, news.
- Document libraries: usually the largest volume and the most commonly deferred.
- Excepted content: document why you classified it that way. If someone challenges the classification later, the reasoning is the defense.
Step 2: Audit images for meaningful alternative text
Staff photos, event graphics, maps, and infographics are the usual offenders. For each informative image, write alt text that conveys the image’s purpose in context, not a literal description. For purely decorative images, use an empty alt attribute (alt="") so screen readers skip them.
This step resists automation. A scanner tells you an image has no alt attribute. It cannot tell you that alt="image1" is useless, or that a map of polling locations needs a text list of those locations alongside it rather than a description of the map. Budget human time here.
Step 3: Test color contrast and color-only meaning
WCAG 2.1 AA requires a contrast ratio of at least 4.5:1 for normal text and 3:1 for large text and meaningful UI components. City brand palettes fail this constantly: municipal blues and golds were chosen for letterhead, not for screens.
Separately, check anywhere color alone carries meaning. Permit status shown as green and red, a zoning map distinguished only by hue, a required form field marked only by red text. Add a label, icon, or pattern so the meaning survives without color perception.
Step 4: Verify full keyboard operability
Every interactive element must work with Tab, Shift-Tab, Enter, Space, Escape, and arrow keys. Test navigation menus, dropdowns, modals, accordions, date pickers, and embedded maps.
Two things to check specifically: that focus order follows visual order, and that the focus indicator is actually visible against your background. Then look for keyboard traps: a modal that opens but cannot be closed without a mouse, or a widget that swallows focus. A single trap on a payment page is more serious than a hundred contrast warnings in a footer, and your remediation priority should reflect that.
Step 5: Audit forms and documents
Every form field needs a programmatically associated label, via the <label> element or aria-label. Error messages must identify which field failed and how to fix it. Avoid timeouts a user cannot extend, and never auto-submit on change.
Documents are usually the largest body of work. Council agendas, minutes, budgets, and permit forms are typically PDFs, and typically untagged. For each, decide: remediate it, replace it with an accessible HTML page, or classify it as excepted archived content. For high-traffic documents, HTML is often faster and cheaper than PDF remediation, and it works better on phones, which is how most residents will reach it.
Step 6: Caption video and provide transcripts
Pre-recorded video requires synchronized captions under WCAG 2.1 AA. For council meetings, that means the archive, not just the livestream. Audio-only content needs a transcript. Auto-generated captions are a starting point, not a finish line. Review them, particularly for proper nouns, street names, and the names of the people speaking, which automatic speech recognition reliably mangles in exactly the contexts where accuracy matters.
Step 7: Combine automated and manual testing
Automated scanning catches missing alt attributes, contrast failures, duplicate IDs, and missing form labels quickly and across your whole site. It cannot evaluate whether alt text is meaningful, whether a custom widget announces itself sensibly to a screen reader, or whether a multi-step application is actually completable.
Supplement with manual testing: navigate a full service path using only a keyboard, then repeat it with a screen reader such as NVDA or VoiceOver. Where budget allows, test with residents who use assistive technology day to day. Their findings tend to be different in kind from anything a tool or a sighted tester produces.
Turn findings into a remediation plan
An audit that ends in a report has not helped anyone. Convert findings into a plan with:
- Severity ranking by task impact — can a resident complete the task or not? Sort by that, not by violation count.
- An owner per item — content authors, web team, or vendor.
- Dated milestones that work backward from your April 2027 or 2028 deadline.
- A published accessibility statement with a complaint route, so residents can report what you missed.
- A retained record of findings, decisions, and fixes. Documented good-faith effort carries weight both with regulators and in litigation.
Then make it recurring. Accessibility regresses with every new page, plugin update, and third-party embed. Build the check into your publishing workflow rather than scheduling another audit for next year, or you will be re-running this exercise from scratch.
Frequently asked questions
Which WCAG version do I audit a city against?
WCAG 2.1 Level AA. The DOJ incorporated it by reference in the Title II final rule published April 24, 2024, and the April 2026 extension did not change the technical standard. WCAG 2.2 AA exceeds the requirement and is a defensible target, but 2.1 AA is what conformance is measured against.
Can an automated checker alone establish compliance?
No. Automated tools catch technical failures like missing alt attributes and contrast errors, but cannot assess whether alt text is meaningful, whether reading order is logical, or whether a service path is completable with a screen reader. Every credible audit combines automated scanning with manual testing. They are there to simply help you audit a city website with actionable items.
Do we have to remediate every PDF we have ever published?
No. Pre-existing conventional electronic documents that are not currently used to apply for or access a service fall under the rule’s exceptions, as does archived content. Documents actively used to deliver services must conform. Document how you classified each group.
What are the most common failures on municipal websites?
Missing or meaningless alt text, insufficient color contrast, color used as the sole carrier of meaning, uncaptioned video, unlabeled form fields, and interactive elements that require a mouse. Untagged PDF document libraries are usually the single largest body of non-conforming content.
How often should we re-audit?
When you audit a city website, you should at minimum do it annually annually or after any significant redesign or platform change. Continuous checking at publish time is more effective than periodic full audits, because it prevents regressions instead of cataloguing them after the fact. Do not let a backlog of infractions build up. Our agency would suggest once a month or once a quarter.
General information, not legal advice. Confirm your city’s specific obligations with counsel.
