Accessibility statement
Whether the crawled pages link an accessibility statement: how the site was tested, what is not accessible yet, and who to write to about it. The European Accessibility Act has asked consumer services sold into the EU for one since June 2025, and public bodies have owed one for longer. This row appears only where the scan has reason to think the rules reach this site.
An accessibility statement describes how accessible the site is: which standard it aims for (usually WCAG 2.1 AA, the basis of EN 301 549), what is known not to work yet and why, when and how it was assessed, and whom to contact when someone cannot use a part of it. Public bodies in the EU have owed one under the Web Accessibility Directive for years; since 28 June 2025 the European Accessibility Act extends similar duties to consumer services such as online shops, booking and ticketing, banking and e-books. Microenterprises are exempt from the service duties.
When the row appears
SiteScan shows this row only where it has a reason to think the rules apply: the site is addressed to Europe and either looks like a public body (.gov, .gouv, .bund.de, europa.eu and similar), runs a shop platform, describes products, offers or bookings in its structured data, or links to a cart, checkout or booking page. A site that publishes a statement anyway always gets the row.
- Green — a statement is linked from a crawled page.
- Amber — none was found; the report adds a low-severity note.
Publish the statement on its own page and link it from the footer next to the other legal pages. See also accessibility checks.
See this check on your own site
Run a free scan: the report shows this row for your domain along with the other checks of the site audit.
More in “Privacy & consent”
What SiteScan checks
TLS certificate
- TLS certificate expiry
- Outdated TLS versions (TLS 1.0/1.1)
- TLS certificate chain
- TLS certificate issuer
- Certificate signature algorithm
Domain registration
- Domain registration expiry
- Registered domain name
- Domain registrar
- Domain registration date
- Domain last updated date
- Domain status codes (EPP)
- Domain transfer lock
- Registrar abuse contact
- RDAP and WHOIS data source
Indexing
- robots.txt file
- CSS and JS blocked in robots.txt
- XML sitemap
- Sitemap index file
- Off-domain URLs in the sitemap
- Sitemap lastmod dates
- Broken URLs in the sitemap
- RSS and Atom feed
Addresses & redirects
Security headers
- HTTP security headers and grade
- Strict-Transport-Security (HSTS) header
- Content-Security-Policy (CSP) header
- X-Content-Type-Options: nosniff
- X-Frame-Options and clickjacking
- Referrer-Policy header
- Permissions-Policy header
- HSTS preload list
- CORS and cross-origin reads
- HTTP TRACE method
Delivery & reputation
- Cache-Control header for HTML
- ETag and Last-Modified revalidation
- HTTP/3 and QUIC support
- Server version disclosure in headers
- DNS blocklist (DNSBL) check
Internal links
Exposure
- Exposed sensitive files (.env, .git, backups)
- Directory listing enabled
- Public JavaScript source maps
- Exposed WordPress endpoints
Well-known files
- security.txt file
- llms.txt for AI assistants
- llms-full.txt file
- ads.txt authorized sellers file
- humans.txt file
- Well-known change-password URL
DNS & email
- MX records (mail servers)
- SPF record
- DMARC record and policy
- DNSSEC signing
- CAA record
- Nameserver redundancy
- IPv6 support (AAAA record)
- MTA-STS policy
- TLS-RPT reporting record
- BIMI record (brand logo in email)
- Wildcard DNS record
- Dangling CNAME and subdomain takeover
Privacy & consent
- Analytics and tracking scripts
- Cookie consent banner
- Privacy policy link
- Terms of service link
- Imprint (Impressum)
- Accessibility statement
Core Web Vitals
- Lighthouse performance score
- Largest Contentful Paint (LCP)
- Cumulative Layout Shift (CLS)
- Interaction to Next Paint (INP)
- CrUX field data vs lab data