From one URL to a sealed pack, every week
Four queues, one browser pool and a diff. Nothing is installed on the site, nothing is rewritten, and the raw scanner output is archived untouched — that archive is what makes the pack worth anything later.
The five stages of a run
CRAWL QUEUE
Only the pages you asked for
The crawler reads robots.txt first and obeys it, even on a customer’s own domain. A sitemap is used when it exists; otherwise a breadth-first crawl runs to depth three inside your include and exclude patterns.
- Two concurrent requests per target host, 250 ms apart
- User agent identifies itself and links to a public bot page
- Include and exclude patterns per site, plus basic-auth support
- Page budget comes from the plan, with a hard cap for runaway sitemaps
64 URLs queued from a 71-URL sitemap; 7 excluded by pattern.
AUDIT QUEUE
One browser, one page, one archive entry
Each page loads in a pooled headless Chromium, settles, then gets the rule set injected. The full-page screenshot and the untouched scanner output are written to EU object storage before anything is summarised.
- Browser pool of three instances with a memory guard
- Full-page capture at 1440 and 320 pixels wide
- Raw output archived per page — never edited, never regenerated
- A page that fails all retries marks the run PARTIAL instead of failing it
Three pages timed out and were requeued; the run stays PARTIAL until they resolve.
RULE CATALOGUE
Clause numbers, not standard text
Ninety-six rules are mapped to clauses and criteria, each with a summary and a repair suggestion we wrote ourselves. Standard text is never reproduced; we reference the clause number and explain it in plain language.
- Every finding carries an EN clause, a WCAG criterion and a rule id
- Repair copy maintained in Dutch, German, French and English
- Twelve criteria are marked manual-only — automation cannot judge them
- Scanner library is used unmodified, behind a wrapper, and attributed
Eight rules still need repair copy in French; they ship with English text meanwhile.
AGGREGATE QUEUE
The number that makes people act
Each finding is fingerprinted from its rule, selector and path, so the diff against the previous run is exact. A finding that was resolved and appears again is labelled a regression rather than counted as new work.
- Score is 100 minus weighted impact per page, clamped to 0–100
- New, closed and returned counts per scan and per page
- Regressions trigger a notification the same minute
- Status set by a human survives the next scan
Two findings returned after a theme update; both were marked resolved in August.
REPORT QUEUE
Dated, hashed, unchangeable
The executive and technical PDFs render from stored findings, the archive is assembled with a sha256 manifest, and the pack is sealed. Re-issuing creates a new pack; the old one stays exactly as it was sent.
- Executive PDF in two pages, technical PDF finding by finding
- Pack contains reports, raw output, screenshots and the signed checklist
- Manifest lists every artefact with its hash
- Everything stored in the EU, retained 24 months after cancellation
Sealed 2 Sep 12:05 · six artefacts · 24.6 MB.
Everything a developer needs, nothing they have to guess
One finding carries its clause mapping, the element, the page, a screenshot, our own repair text and its full history across runs.
Checkout button label falls below 4.5:1
color-contrast · 6 instances · /afrekenen
- EN 301 549 9.1.4.3
- WCAG 1.4.3
- rule: color-contrast
form#checkout .cta--primary > span.cta__label
/* #a99bd6 on #ffffff → 2.61:1 */The same token is reused on five other pages, so a token-level fix closes all six instances at once. Suggestion only — Conforma never modifies your site.
History
- Reappeared in scan #482 after a theme update2 Sep 09:16
- Marked resolved by Jens de Wit19 Aug 14:02
- First seen in scan #43114 Jul 09:08
Two reports, one archive, one statement
The executive PDF goes to the person who signs. The technical PDF goes to whoever fixes it. The pack goes to procurement, and the statement goes on the site.
Executive summary
Two pages: score, what changed, what to do next. Written for the person who signs, not for a developer.
nl de fr en · 2 pages
Technical report
Finding by finding with page, selector, snippet and repair suggestion. This is what a developer works from.
per scan · ~40 pages
Evidence pack
Reports, raw scanner output, screenshots and the signed manual checklist, listed in a sha256 manifest.
sealed · dated
Accessibility statement
Country template with the right authority and complaint route, versioned so an audit reads the version that was live.
4 locales · versioned
Integrity chain
Why the hash matters
A report without a date and a hash is an opinion. Every artefact is hashed on write and listed in a manifest, so a pack you sent in June still proves what the site looked like in June — even after the site changed.
- Scan finished64 pages audited, raw output written to storage unmodified.2 Sep 09:22 · scan #482
- Reports renderedExecutive and technical PDF generated from stored findings, hashed on write.2 Sep 09:33
- Checklist signedTwelve manual criteria recorded with video and screenshot evidence.2 Sep 12:04
- Pack sealedManifest lists every artefact with its hash. Re-issuing creates a new pack.2 Sep 12:05 · v1
See it on a real scan
The demo workspace holds a full portfolio: twelve sites, a scan with regressions, a signed checklist and a sealed pack.