How can we help?

1. Create an account. Sign up with email or continue with Google — no card needed for the Free plan.
2. Add a website. The Free plan covers one site, with unlimited single-page scans of it.
3. Run a scan. ADAGuard loads the page in a real browser, so content rendered by JavaScript is checked too, and runs axe-core plus 22 checkers of its own.
4. Fix and rescan. Each issue comes with its fix, often with code before and after, so you can see the score move once the fix ships.

Yes. The free scanner checks one page with no signup.

One website, with unlimited single-page scans of it. Scanning whole sites, and on a schedule, is what the paid plans add.

1. Start authentication for the site. A real, live browser opens inside the app, pointed at your site.
2. Log in there as you normally would. You type into the real site, not an ADAGuard form, so ADAGuard never sees your password.
3. Click I’m Logged In. ADAGuard keeps the session — every cookie, including httpOnly ones, and localStorage — and closes the browser.
4. The session is encrypted and stored, so later scans of the site use it without you logging in again.

All of them — SSO, two-factor codes, magic links, even CAPTCHA — because you log in yourself.

The login window stays open for 10 minutes, with up to 2 at a time. Logged-in scanning is on Professional and above. If your site refuses to be framed, you can open the login window in a new tab.

A VPAT — also called an ACR, Accessibility Conformance Report — documents how a product conforms to WCAG, Section 508 or the EAA. It is what a buyer’s procurement or legal team usually asks for.

• On Professional and above, generated from your scan results, in WCAG, Section 508, EU (EN 301 549) and INT formats.
• Every criterion a scan can’t test is marked “Not Evaluated”, never a false “Supports” — see which criteria are automated.
• You name a real evaluator: an automated scan is a strong start, not the human review a full VPAT needs.

PDF, HTML, CSV and JSON exports on paid plans.

• Critical — stops someone completing a task (a form field with no label).
• Serious — a major barrier, usually still workable around (low contrast on body text).
• Moderate — a real but narrower usability problem.
• Minor — a small deviation from best practice.

It starts from the share of checks your page passes, then takes off a penalty per severity that grows more slowly the more issues of one kind there are — so fixing your first critical issue moves it more than fixing your tenth.

The WCAG criteria it fails, the affected elements with their selectors, a difficulty rating, and how to fix it — with code where it helps.

Automated checks cover 40 of the 55 WCAG 2.2 A and AA criteria, fully or partly. The other 15 need a person — here is the full list.

The site’s bot or DDoS protection answered with a challenge page instead of the content. That is not an accessibility issue, so the page gets no score rather than a wrong one.

On Cloudflare, pause Bot Fight Mode (Security → Bots), scan, then turn it back on. With another firewall, ask your host to allow automated scanner access for a few minutes — or scan a staging copy without bot protection.

Yes, if it can be reached from the internet. Private and internal addresses are refused. If staging is behind a login, use logged-in scanning.

It depends on how many pages and sites you scan, and whether you need logged-in pages, the API or VPATs — compare the plans.

Yes. Every paid plan can be billed monthly or yearly.

From Settings → Billing in the app, at any time. Email support@adaguard.io if anything gets in the way.