惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

H
Help Net Security
T
ThreatConnect
SecWiki News
SecWiki News
F
Future of Privacy Forum
AWS News Blog
AWS News Blog
C
Cisco Blogs
A
Arctic Wolf
Vercel News
Vercel News
The GitHub Blog
The GitHub Blog
Scott Helme
Scott Helme
V
V2EX
博客园 - 叶小钗
阮一峰的网络日志
阮一峰的网络日志
K
Kaspersky official blog
G
Google Developers Blog
freeCodeCamp Programming Tutorials: Python, JavaScript, Git & More
P
Privacy International News Feed
C
Cyber Attacks, Cyber Crime and Cyber Security
N
News | PayPal Newsroom
Schneier on Security
Schneier on Security
NISL@THU
NISL@THU
Microsoft Azure Blog
Microsoft Azure Blog
量子位
The Hacker News
The Hacker News
Stack Overflow Blog
Stack Overflow Blog
Security Latest
Security Latest
M
Microsoft Research Blog - Microsoft Research
Google Online Security Blog
Google Online Security Blog
博客园_首页
C
CXSECURITY Database RSS Feed - CXSecurity.com
I
InfoQ
Google DeepMind News
Google DeepMind News
Y
Y Combinator Blog
The Cloudflare Blog
Microsoft Security Blog
Microsoft Security Blog
Martin Fowler
Martin Fowler
Cisco Talos Blog
Cisco Talos Blog
钛媒体:引领未来商业与生活新知
钛媒体:引领未来商业与生活新知
T
Troy Hunt's Blog
F
Fox-IT International blog
S
Security @ Cisco Blogs
博客园 - 司徒正美
cs.CV updates on arXiv.org
cs.CV updates on arXiv.org
C
Comments on: Blog
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
L
LINUX DO - 最新话题
GbyAI
GbyAI
Project Zero
Project Zero
腾讯CDC
T
Tailwind CSS Blog

DEV Community

A prompt is not a conversation. It's a component contract. Building an Autonomous MCP Lead Generation System with Hermes Agent LangGraph 워크플로우 템플릿 (v40) How I Built 100 Browser-Based Image Tools With No Server (FFmpeg WASM, PDF-lib, AI Background Removal) Nginx CVE-2026-9256, AI Prompt Injection Defenses, and Claude AI Data Leak Demo Scaling RAG for 10M+ Docs, .md Agent Memory, & Claude Code for Motion Graphics Diagram as Code with draw.io DuckDB Delta, PostgreSQL 17 Migration, & SQLite Optimization Deep Dives Windows 11 Microsoft Account Login Recovery During Internet Restrictions The Linux Commands You Forgot Exist (And Why AI Workflows Make Them Relevant Again) Spec-Driven Development Without an IDE: I Generated NestJS, Go, Spring Boot, Laravel, and Rust Apps From a Single PRD File Components are states Edge SEO y Middleware: Cómo Interceptar a Googlebot y LLMs antes de llegar a tu Servidor Context window exceeded at turn 23. Here's how I track token usage without a tokenizer. My Hermes agent spent $3 before I noticed. Now it can't. My Hermes agent's stop condition was a 40-line if/elif chain. I replaced it with 3 lines. My agent kept hitting context limits. This one function fixed it. Create and configure Azure Firewall Your Hermes agent's audit log is leaking customer emails. Here's a 100-line lib that fixes that. My agent kept forgetting what it was doing. A scratchpad fixed it. I replaced 200 lines of ad-hoc state management in my Hermes agent with one object. Per-Key Rate Limiting for Agent Tool Calls: Stop One User From Breaking Everything Composable Output Guardrails: Filter Agent Responses Before They Reach Users Sanitize Your LLM Message Lists Before Every API Call Thread a Run ID Through Every Agent Call So You Can Debug Anything Normalize Provider Error JSON So Your Agent Can Actually Handle Failures Priority Queue for Agent Sub-Tasks: Stop Processing Low-Priority Work First Static Lint Rules for Your LLM Prompts (Before They Hit Production) tool-call-budgets: Stop Runaway Agent Loops Before They Hit Your Invoice Step Through Your Agent's Failures Like a Debugger The Simplest Stop Condition: A Hard Cap on Agent Loop Iterations Score Your Agent's Responses With a 0.0-1.0 Rubric (No LLM Judge Required) Fix Bad Structured Output by Feeding the Error Back to the Model Building an effective Storyblok Tool Plugin with SvelteKit How to Get Your Renault / Dacia Radio Code for Free RAG 시스템 실전 구축 (v39) Retraction — scrml’s Living Compiler I built a fitness app where the AI roasts you for eating pizza (and hypes you when you PR) The Top SaaS Founder Communities on Discord (Beyond the AI Hype) I Built a Production-Grade Async Job Queue from Scratch — Here's Everything That Actually Happened How to watch SMS from multiple Android phones in one iOS app We Didn’t Want Another AI Wrapper — So We Explored a High-Speed Hermes Orchestrator for Engineering Crews Multi-tenant além do TenantId: problemas reais e aprendizados em sistemas .NET After failing 23 times, I am sharing How I Actually Prepare for a Tech Interview Every Single Time Now. I built an app that works like a nutritionist for your brain. Here's what happened in 7 days. GoBadge Dynamic: From Module Stats to Universal Badges LangGraph 워크플로우 템플릿 (v39) The git Commands You Forgot Exist (And Why AI Workflows Make Them Relevant Again) Six Levels of MCP Servers One container to replace Grafana + Loki + Tempo + Prometheus The Request/Response Cycle, HTTP, Auth, JWT, OAuth & Sessions — Explained Properly Python Week 3: We Stopped Repeating Ourselves (Loops!) Creating a Custom Grid Editor tool in Unreal Engine 我做了个付费 Telegram bot。Telegram Stars 实际给开发者多少钱,我算了一笔账。 I Got 96% Recall on LLM Hallucination Detection With No ML Model – Just 50 Lines of Python A practitioner's guide to getting more value out of AI coding: agent quality & token optimization How to Handle Telegram Albums in Telegraf I Built a Multilingual Spam Detection Dataset with 149K+ Messages Across 23 Languages How to Handle Telegram Albums in grammY RAG 시스템 실전 구축 (v38) Beyond Pip Install: Why Your AI Agent Needs a "Hermetic" Life-Support System to Survive Resume Building using HTML & CSS SpecFlow: Multi-Agent SDD in Cursor (4 phases, /approve, single code writer) Running ASR for smart homes in the NPU of Intel processors "Building a CI/CD Pipeline From Scratch: A Practical Guide for Developers (with GitHub Actions)" SpecFlow: SDD multi-agente en Cursor (4 fases, /approve, un solo escritor de código) How to Extract Your Full Team Hierarchy from HubSpot (the API doesn't expose it) Adobe Commerce Cloud now costs $40k/year. We migrated from Adobe Commerce to Magento Open Source — here's the honest breakdown .klickd v4.0.0 — Portable AI memory with constraints, strict schemas, and test vectors We Trust Third Party Code, It’s Time to Trust AI Generated Code LangGraph 워크플로우 템플릿 (v38) Sustainable AI Starts with Efficient AI Find Remove duplicated files in Google Drive How to Detect GPU Waste in a Kubernetes Cluster The Privacy Bug in My First Chrome Extension (And How to Avoid It) Serverless Mental Models: What They Don't Tell You Before You Build Preventing GPT hallucination in automated content pipelines: how I structure Make.com flows with data injection Hmm, where were we? AI Visibility Tools, Math Proofs, and Stripped Guardrails Shape Developer Landscape How AI and Electronics Are Changing Healthcare Devices: The Future of Smart Healthcare Author: Shivam Wakade | Founder, PrivSR Making Claude Sound Like Optimus Prime Understanding Reinforcement Learning with Human Feedback Part 5: Training the Reward Model with Loss Functions Learning Progress Pt.20 How Secure LoRa Communication Devices Work: Building the Future of Private and Long-Range Connectivity Author: Shivam Wakade | Founder, PrivSR How I Rebuilt an RPG Map Editor with Rust, React, and WASM Building a System That Automates YouTube Post-Production Building a 100% Serverless Digital Asset Packager in the Browser Game Recommended AI What is Human-In-The-Loop (HITL)? Deep Dive: React Server Components in TanStack Start Migrating off Google Analytics: Umami vs Plausible vs Fathom Building a Portfolio That Actually Demonstrates Software Engineering Async/Await in JavaScript: From Callbacks to Clean Code (2026) Benchmarking LLM Structured Outputs Angular 21 Multiselect Dropdown: A Migration-Friendly Component with Live Functional Tests ShareBox v5 — GPU transcoding, Netflix-style grid, and why I don't need Plex anymore TOML Schema is live Handling Duplicate Shopify Webhook Events (And Why You Must) Original Kubernetes Dashboard — retired upstream, upgraded to Angular 21. لماذا أسست ترينافو للتجار العرب الذين تتجاهلهم المنصات الغربية
How to Pass the EAA 2025 Accessibility Audit — A Step-by-Step WCAG Checklist
DevToolsmith · 2026-05-26 · via DEV Community

DevToolsmith

The European Accessibility Act (EAA) came into force on 28 June 2025. If your product reaches EU customers — and you ship a website, a SaaS, an e-commerce store, an e-book reader, or really anything users interact with through a screen — the EAA quietly became one of your hard requirements.

It does not matter where your company is incorporated. What matters is whether EU users can buy from or interact with your service. Fines run up to €100,000 in most member states, plus the more painful penalty: forced product withdrawal from EU markets.

This guide is the practical checklist I wish I had when I built FixMyWeb — a free WCAG scanner I now use myself to keep our own pages clean. Run through it once, and you will know exactly which 20% of changes get you to 80% conformance.

Why WCAG 2.1 AA is the practical EAA standard

The EAA directive does not literally name "WCAG 2.1 AA". It refers to EN 301 549 — the European harmonised standard for digital accessibility. EN 301 549 v3.2.1 (the version in force at EAA enforcement) explicitly adopts WCAG 2.1 Level A and AA success criteria for the "Web" chapter.

Translation: if you pass WCAG 2.1 AA on your public-facing pages, you cover ~95% of the EAA web requirements out of the box. WCAG 2.2 (published October 2023) adds 9 more criteria — adopting them now is forward-looking but not strictly required yet.

The 12-point WCAG quick-check

For every page you ship to EU users:

1. Images have meaningful alt text (WCAG 1.1.1)

<!-- Bad: -->
<img src="/hero.jpg">

<!-- Decorative: -->
<img src="/divider.svg" alt="" role="presentation">

<!-- Meaningful: -->
<img src="/dashboard.png" alt="Dashboard showing weekly accessibility score trending from 64 to 89">

Enter fullscreen mode Exit fullscreen mode

alt="" is correct for purely decorative images (combined with role="presentation"). Empty alt is not "I do not care" — it is a deliberate signal to screen readers to skip the image.

2. Color contrast ≥ 4.5:1 for normal text, ≥ 3:1 for large text (WCAG 1.4.3)

Light grey on white (#999 on #fff) is 2.85:1 — fails AA. The most common offender is the "subtle hint" text under inputs and the placeholder text in forms.

Test in 30 seconds: fixmyweb.dev/tools/contrast-checker.

3. Page has a lang attribute on <html> (WCAG 3.1.1)

<html lang="en">

Enter fullscreen mode Exit fullscreen mode

Without this, screen readers default to the user's OS language and mispronounce everything. One attribute, huge UX win.

4. Form inputs have programmatic labels (WCAG 3.3.2)

<!-- Bad: placeholder only -->
<input placeholder="Email">

<!-- Good: -->
<label for="signup-email">Email</label>
<input id="signup-email" type="email" placeholder="you@company.com">

<!-- Or, when visual layout forbids a label: -->
<input type="email" aria-label="Email" placeholder="you@company.com">

Enter fullscreen mode Exit fullscreen mode

Placeholder text disappears the moment the user starts typing and is not announced as a label by VoiceOver / NVDA / JAWS.

5. All interactive elements are reachable by keyboard (WCAG 2.1.1)

Tab through the entire page with no mouse. Every button, link, dropdown, modal, and slider must be reachable and operable. Custom <div onClick> handlers are the #1 violator — switch to <button> or add tabindex="0" + onKeyDown for Enter/Space.

6. Focus is always visible (WCAG 2.4.7)

/* Bad — designer-requested "clean look" */
*:focus { outline: none; }

/* Good — visible focus ring with sufficient contrast */
*:focus-visible {
  outline: 2px solid #4A90D9;
  outline-offset: 2px;
}

Enter fullscreen mode Exit fullscreen mode

:focus-visible is the modern selector — applies the ring only when the user navigated via keyboard, not on a mouse click. Best of both worlds.

7. Heading hierarchy is sequential (WCAG 1.3.1)

<h1><h2><h3>. Do not skip levels (<h1> straight to <h4>). Screen reader users navigate by headings (H key in JAWS/NVDA) — the structure literally is the page outline.

One <h1> per page is best practice, multiple are tolerated but signal layout-driven markup.

8. Skip-to-content link as first focusable element (WCAG 2.4.1)

<a href="#main-content" class="sr-only focus:not-sr-only">
  Skip to main content
</a>
<header>...big navigation...</header>
<main id="main-content">...</main>

Enter fullscreen mode Exit fullscreen mode

Keyboard users should not have to Tab through 40 menu items before reaching the article. The sr-only class hides visually but keeps it in the tab order; focus:not-sr-only reveals it on focus.

9. Buttons and links have accessible names (WCAG 4.1.2 / 2.4.4)

Icon-only buttons are silent killers:

<!-- Bad — screen reader announces "button" with no purpose -->
<button><svg>...</svg></button>

<!-- Good -->
<button aria-label="Close dialog">
  <svg aria-hidden="true">...</svg>
</button>

Enter fullscreen mode Exit fullscreen mode

The aria-hidden on the SVG prevents double-announcement.

10. Tables have headers and captions (WCAG 1.3.1)

<table>
  <caption>Q4 2025 accessibility audit results</caption>
  <thead>
    <tr>
      <th scope="col">Page</th>
      <th scope="col">Score</th>
      <th scope="col">Critical issues</th>
    </tr>
  </thead>
  <tbody>...</tbody>
</table>

Enter fullscreen mode Exit fullscreen mode

scope="col" / scope="row" is what makes header cells navigable in screen reader table mode.

11. Status messages use ARIA live regions (WCAG 4.1.3)

After a form submit, login, or async action — the result message must reach assistive tech:

<div role="status" aria-live="polite">
  Settings saved successfully.
</div>

Enter fullscreen mode Exit fullscreen mode

polite interrupts at the next pause, assertive interrupts immediately (use for errors only).

12. Viewport allows zoom (WCAG 1.4.4)

<!-- Forbidden under WCAG: -->
<meta name="viewport" content="width=device-width, user-scalable=no">

<!-- Required: -->
<meta name="viewport" content="width=device-width, initial-scale=1">

Enter fullscreen mode Exit fullscreen mode

Roughly 1 in 12 men and 1 in 200 women have color vision deficiency, and 8.4% of EU residents have some form of visual impairment (Eurostat 2022). Disabling zoom locks them out of your content.

The 30-second audit

Manual review of all 12 points across a 50-page site takes a serious afternoon. The shortcut I built into FixMyWeb runs 201 automated WCAG 2.1 / 2.2 checks per page in under 60 seconds, returns a 0-100 accessibility score broken down by the four WCAG principles, and gives you copy-paste fix snippets for every issue.

# Or just use the web UI — paste any URL:
curl -X POST https://fixmyweb.dev/api/scan \
  -H "Content-Type: application/json" \
  -d '{"url":"https://your-site.example.com"}'

Enter fullscreen mode Exit fullscreen mode

It is free for up to 3 scans per month (no signup), with paid plans starting at $9/month for higher volume + PDF export + monitoring. Lifetime deal available right now via DealMirror if you prefer a one-time payment.

What FixMyWeb does not do

A few honest disclaimers:

  • Automated checks catch ~30-40% of all WCAG issues. The rest require human review (especially cognitive load, content clarity, screen reader actual user testing). Tools like FixMyWeb cover the surface — they do not replace a user research session with people who use assistive technology daily.
  • Overlays are not a fix. If you have seen accessiBe / UserWay / AudioEye widgets, those overlay JavaScript on the page. They have been sued repeatedly for misleading claims and do not address WCAG conformance at source. FixMyWeb deliberately is an audit, not an overlay — you fix issues in your codebase, not behind a JS shim.

Next steps

  1. Run fixmyweb.dev/scan on your homepage today. Note the score and the top 3 critical issues.
  2. Fix the top 3 critical issues in your codebase this week.
  3. Re-scan. Track the score over time — it is a good leading indicator for legal exposure under EAA.
  4. Once your average page is above 90, generate a VPAT / ACR document for your procurement team.

The EAA deadline already passed. Treat this as the year you stop saying "we will get to accessibility next quarter" and ship the first 3 fixes today.


Disclosure: I am the founder of FixMyWeb. The tool is genuinely free for the first 3 scans/month and I dogfood it on every project I ship — but please file an issue if anything in this checklist is wrong or out of date. I want to keep this honest.