Checks

All checks are rule-based: they do not use AI, and the same page in the same state produces the same result. A rule is identified by check/code, for example overflow/horizontal_overflow. The same identifiers are used by the CLI, webauditlabs Cloud, the REST API and MCP. Use --checks a,b to run a subset.

Check	Codes	Detects
http	http_status, resource_failed, api_failed, console_error, third_party_failed	Pages returning 4xx/5xx, failing resources and API calls, console errors of the site itself; failures of other websites (trackers, widgets) as one informational finding
links	link_dead, link_server_error, link_redirect_loop, link_redirects, anchor_broken, link_empty, link_wrong_locale	Dead links, server errors, redirect loops and chains, broken anchors, empty links, links into another locale
lang	lang_missing, lang_mismatch, translation_missing, hreflang_wrong_locale, hreflang_broken, hreflang_redirect, hreflang_not_reciprocal	Language declaration, missing language versions and hreflang problems
overflow	horizontal_overflow, control_offscreen	Pages wider than the viewport, controls partly off-screen
clipping	text_clipped	Buttons, headings and labels whose text is cut off
media	image_broken, image_not_loaded, image_alt_missing	Broken images, lazy images that never loaded, missing alt text
content	placeholder_text, template_leak, heading_empty, content_empty	Placeholder text (NL/EN/DE), template leftovers, empty headings and pages
forms	field_unlabeled, button_unnamed, link_button_no_href, form_insecure_action, form_offsite_action	Static form diagnostics; nothing is submitted
seo	title_missing, title_too_long, meta_description_missing, canonical_missing, canonical_offsite, canonical_wrong_locale, heading_level_skipped, noindex, canonical_target_broken, canonical_target_redirects, structured_data_invalid, og_image_missing, og_image_broken, robots_missing, robots_blocks_page, robots_no_sitemap, soft_404, favicon_missing, sitemap_url_broken, sitemap_url_redirects, sitemap_url_noindex, sitemap_url_canonical_elsewhere	Titles, descriptions, canonicals and their targets, heading levels, noindex, duplicates across pages, JSON-LD, share images (og:image); per host robots.txt, soft 404 and favicon; with a sitemap, sitemap urls that are broken, redirect, are noindex or canonical elsewhere (up to 500 unscanned sitemap urls are checked with HEAD)
a11y	a11y_<axe rule>	Serious and critical axe-core violations, per rule
consistency	price_mismatch, date_expired, duplicate_text	Prices differing between language versions, past deadlines, duplicate text blocks
privacy	tracker_before_consent, tracker_after_reject, tracker_without_banner, consent_no_reject	Analytics and ad trackers (requests and cookies) that run before the cookie banner is answered, after a reject or without a banner; banners without a reject button. Google Consent Mode pings with storage denied are not counted
security	mixed_content, http_not_redirected, tls_expiring, hsts_missing, security_headers_missing	http files on https pages; once per host: http not redirecting to https, certificates expiring within 21 days, HSTS and basic security headers (skipped for local and private hosts)
keyboard	focus_not_visible, focus_hidden_element, focus_trap, skip_link_missing	Off by default. Presses Tab up to 40 times on the desktop viewport: focus that shows no change, focus on hidden or off-screen elements, focus loops, a missing skip link on pages with long menus. Enable it with --checks or in the scan profile
http	http_status, resource_failed, api_failed, console_error	Pages returning 4xx/5xx, failing resources and API calls, console errors
links	link_dead, link_server_error, link_redirect_loop, link_redirects, anchor_broken, link_empty, link_wrong_locale, contact_link_invalid	Dead links, server errors, redirect loops and chains, broken anchors, empty links, links into another locale, broken or mismatched email and phone links
lang	lang_missing, lang_mismatch, translation_missing, hreflang_wrong_locale, hreflang_broken, hreflang_redirect, hreflang_not_reciprocal, untranslated_ui_text	Language declaration, missing language versions, hreflang problems, buttons and links left in another language (NL/EN/DE)
overflow	horizontal_overflow, control_offscreen, element_overlap, text_too_small	Pages wider than the viewport, controls partly off-screen, overlapping controls and texts, text under 12px on phones
clipping	text_clipped	Buttons, headings and labels whose text is cut off
media	image_broken, image_not_loaded, image_alt_missing	Broken images, lazy images that never loaded, missing alt text
content	placeholder_text, template_leak, heading_empty, content_empty, copyright_outdated	Placeholder text (NL/EN/DE), template leftovers, empty headings and pages, an outdated copyright year
forms	field_unlabeled, button_unnamed, link_button_no_href, form_insecure_action, form_offsite_action, autocomplete_missing, input_type_mismatch	Static form diagnostics, including autocomplete and input types of personal-data fields; nothing is submitted
seo	title_missing, title_too_long, meta_description_missing, canonical_missing, canonical_offsite, canonical_wrong_locale, heading_level_skipped, noindex	Titles, descriptions, canonicals, heading levels, noindex, duplicates across pages
a11y	a11y_<axe rule>	Serious and critical axe-core violations, per rule
consistency	price_mismatch, date_expired, duplicate_text, contact_mismatch	Prices differing between language versions, past deadlines, duplicate text blocks, footer contact details that differ between pages

Pages that cannot be loaded are reported as page errors (navigation_failed, navigation_timeout), not as site findings.

Optional AI step

--ai flags untranslated text and adds plain-language explanations, within a token budget (--ai-max-tokens). It needs OPENROUTER_API_KEY and OPENROUTER_MODEL. AI findings are always marked for review.

Evidence

Each finding lists the elements involved as { tag, selector, rect, html, text } and links to the page screenshot. Pages with findings get an extra *.annotated.png with those elements outlined.