What a website accessibility audit actually involves — and why it matters more to RTOs than most people realise
Somewhere on the contact page of a training organisation's website was a field labelled "HP Name". It was a honeypot — a spam trap. Invisible to anyone using a browser normally, it existed to catch automated bots that fill in every field they find.
It was hidden with CSS. Which means it was invisible on screen, but entirely present to screen reading software.
So a person using a screen reader would reach that field, be prompted to complete it, and do so. The form would then treat their enquiry as spam and discard it.
Nobody knew. The organisation didn't know it was losing enquiries. The people making them didn't know their enquiries had gone nowhere. There was no error, no bounce, no record. Just silence on both sides.
Grounding Techniques: Feel your feet on the ground or sit comfortably in your chair. Notice the sensations of contact between your body and the surface beneath you. This can help bring your attention to the present moment.
~ Mindfulness Tip
That is what a website accessibility problem actually looks like. Not a legal abstraction. A prospective student who tried to contact you, and never heard back.
We found it during a WCAG 2.2 audit of an Australian RTO's website. It took fifteen minutes to fix. It had been there for nearly three years.
Why this lands on RTOs specifically
There is no clause in the Standards for RTOs that says "your website must meet WCAG". People sometimes take that to mean accessibility is optional. It isn't — it just arrives from three directions at once.
The Disability Discrimination Act 1992 is where the actual legal exposure sits. An inaccessible website can constitute discrimination in the provision of services and education. The Australian Human Rights Commission has long identified WCAG Level AA as the benchmark for meeting that obligation. It is complaint-driven — nobody audits for it, but one complainant can start it.
The Standards for RTOs 2025 make you responsible for outcomes a poor website undermines. Outcome Standards 1.1 and 1.2 require delivery appropriate to the learner cohort. Standard 1.8 covers facilities, equipment and resources — and a website that is the entry point to enrolment is a resource. The bigger shift in the 2025 Standards is toward self-assurance: demonstrating that your systems actually work, rather than that a policy exists.
Compliance Requirement 7 governs marketing and advertising. Every course code and title on your site must match the National Register. Nothing may imply an outcome outside your control.
That third one produced the most consequential finding of the whole engagement, and it had nothing to do with accessibility. The homepage described the organisation's quality system as "ASQA Approved".
Nobody had questioned it because it sounded reassuring:
Deep Breathing: Take a moment to focus on your breath. Inhale deeply through your nose, hold it for a few seconds, and then exhale slowly through your mouth. Repeat this several times to calm your mind and body.
~ Mindfulness Tips
ASQA registers RTOs. It does not approve, endorse or certify quality management systems. Claiming regulator approval that doesn't exist is precisely what marketing accuracy requirements target — and it had been sitting on the homepage for years, seen by every visitor and presumably copied into printed material.
The first thing that needed auditing was the audit form
The organisation sent through their internal audit tool: 81 WCAG 2.2 checkpoints, formatted as a table.
It had a criteria column. It had a pre-written recommendations column. It had nothing else.
No status field. No space for evidence. No corrective action column. All 81 findings would have had to go into a single comments box at the end. There was literally nothing to tick.
It got worse on inspection. Six criteria carried the wrong name — each copied from the row above. Criterion 1.4.13 was labelled "Text Spacing", which is 1.4.12. Five criteria showed the wrong conformance level.
None of this changed the work. The descriptions beneath each criterion were correct, so nothing was missing. But consider how it reads to an external auditor: a compliance instrument with the wrong labels invites the question of whether anything else in the file was checked carefully.
If your compliance system includes a checklist somebody built once and nobody has revisited, it is worth reading it properly. The instrument is part of the evidence.
Acceptance: Acknowledge any feelings of stress or anxiety that arise. Accept them without judgment and allow yourself to feel them without getting overwhelmed. Remember, it's normal to feel this way in challenging situations.
~ Mindfulness Tip
81 checkpoints, but not 81 problems
The single most useful thing we did was work out what actually applied.
| Checkpoints by Name | Checkpoints Totals |
|---|---|
| Checkpoints in the form | 81 |
| Level AAA — not required by any Australian regulator | −25 |
| Removed from the standard in 2023 | −1 |
| Applicable at Levels A and AA | 55 |
| Not applicable — the site has no video, no student login, no time limits | −16 |
| Actually requiring testing | 39 |
Two things worth taking from that.
Level AAA is not required. The W3C itself does not recommend AAA as a whole-of-site target. A quarter of that form was optional best practice, and treating it as mandatory would have tripled the work for no compliance benefit.
"Not applicable" is a legitimate result — but only if you write down why. "Not applicable — no video content published, confirmed 14 August 2026" is evidence of assessment. A blank cell is evidence of nothing, and it is the first thing an auditor's eye finds.
The 10 out of 10 that doesn't mean compliant
After remediation, the site scored 10 out of 10 on WAVE, WebAIM's accessibility evaluation tool.
It was tempting to call that done.
WebAIM say otherwise, on their own page: a high score does not necessarily indicate that a page is highly accessible or compliant, and manual testing is always necessary to determine compliance.
They are right, and the reason is structural. Automated tools detect somewhere between a third and a half of accessibility issues. They are excellent at what they can measure — colour contrast, missing alt text, heading structure, language attributes. They cannot load a keyboard. They cannot hear a screen reader.
Of the 39 checkpoints that needed testing on this site, automated scanning could settle about three.
The rest required someone to navigate every page template using the keyboard alone, checking that everything is reachable, that focus never gets trapped, that the focus indicator is visible, and that focus doesn't disappear behind the sticky header. Someone to listen to a screen reader read the pages and submit the form incorrectly to hear whether the error was announced. Someone to view the site at 320 pixels wide and with text spacing increased, and check nothing was lost.
That is the gap between a good automated score and a defensible position.
Focus on the Task at Hand: Instead of worrying about the potential outcomes of the assessment, focus on the actions you can take right now. Break down tasks into smaller, manageable steps to prevent feeling overwhelmed.
~ Mindfulness Tip
Why we didn't put a badge on the site
There is a large market in accessibility badges, seals and overlay widgets that promise compliance for a monthly fee.
Two figures are worth knowing. In the first half of 2025, over 22% of digital accessibility lawsuits in the United States involved websites using an overlay or widget — a massive over-representation, since overlays are on a small minority of sites. And in April 2025 the US Federal Trade Commission fined one overlay vendor US$1 million for misrepresenting its product's ability to make sites compliant.
Plaintiff-side firms search for overlay signatures deliberately. A compliance badge signals a site that believes it is finished rather than one that is being maintained.
Instead we published an accessibility statement: what was assessed, how, when, what to do if you hit a barrier, and where to escalate if the response isn't good enough.
That is more informative than a badge, it is verifiable, it carries a date that invites re-assessment — and it cannot be read as a claim somebody else made on your behalf.
Self-Compassion: Be kind to yourself during this process. Treat yourself with the same kindness and understanding that you would offer to a friend in a similar situation.
~ Mindfulness Tip
What actually got fixed
Nothing exotic. That is rather the point.
Colour contrast was the largest group. The brand orange gave 3.62:1 against white — fine for large headings, failing for small text, which needs 4.5:1. Darkening it to a deeper shade brought it to 5.18:1 while remaining recognisably the brand.
Text over photographs was the subtler version. It happened to be readable, because the text sat over a dark part of the image. Change the photo, crop it differently, or view it at a narrower breakpoint and it would land on sky. The fix is a gradient overlay behind the text — which makes the tile compliant by construction, not by luck.
A skip link, so keyboard users can jump past the navigation instead of tabbing through the entire menu on every page.
A page language declaration, so screen reading software uses Australian English pronunciation.
Course links that said where they went. Five tiles all read "Read more". A screen reader user heard "Read more" five times with no way to distinguish them.
And the honeypot.
What "finished" should look like
Not a ticked form. A ticked form proves someone had a pen.
Every applicable checkpoint carries a result and a reason. Compliant with what makes it pass. Not applicable with why it can't arise. Nothing blank.
The method is recorded. Automated scanning, keyboard testing, screen reader testing, responsive testing, content review. When an auditor asks how you reached the result, the answer is on the page.
The date is prominent, and the claim is scoped. "Meets WCAG 2.2 Level AA across the page templates assessed, as at [date]." Accessibility is affected by every content change. A claim without a date is a claim without a shelf life.
Re-assessment is triggered by change, not by calendar. New pages, a new form, a redesign, added video. A dated series of assessments showing the site was re-checked is exactly what self-assurance means — and it is considerably more use than one form completed thoroughly and then forgotten.
Remember, it's okay to feel stressed, but by practicing mindfulness and staying present in the moment, you can navigate this situation with clarity and composure. If "not applicable" is the legitimate result for your assessment, ensure to provide a clear explanation to support your decision. This will demonstrate your awareness and attention to detail, which can be beneficial during audits.
~ Mindfulness Tip
Where to start, and if you run an RTO
If you run an RTO and none of this has been looked at:
Test your own enquiry form with the keyboard alone. No mouse. Tab to every field, fill it in, submit it. If you can't, neither can a proportion of your prospective students.
Read your homepage for claims about regulators. "ASQA Approved", "Government Endorsed", "Certified" — check each one is a thing that actually exists.
Check your course codes against training.gov.au. Titles and codes exactly as they appear on the National Register.
Look at whether your marketing pages are reachable without a mouse, and whether your policy documents are actually linked from anywhere.
None of it requires a specialist to begin. The specialist work is the other two-thirds that automation and self-inspection can't reach — but you will learn a great deal in the first twenty minutes.
This article draws on a WCAG 2.2 Level AA audit and remediation carried out for an Australian registered training organisation in 2026. The organisation is not named. All 55 applicable success criteria were assessed; the site now meets Level AA across all page templates.
SPACELAUNCH NOW!
Get Your Site Up & Running
SpaceLaunch is an ideal choice for those seeking to swiftly establish their own website, it offers a comprehensive and user-friendly solution backed by essential features, FREE domain registration / transfer / renewal, 1h FREE technical support to get you going, and the flexibility to grow and expand as needed (add-ons available).