DIY Shopify Accessibility Audit: Step-by-Step Walkthrough in 2 Hours

A founder, marketer, or operator can run a meaningful WCAG 2.2 AA audit on a Shopify store in 2 hours using free tools, producing the same kind of findings list a credentialed auditor would generate (minus the formal ACR). This article walks through the step-by-step process: tool stack, page-by-page execution, finding documentation pattern, and how to produce the output that informs your remediation plan or vendor pitch evaluation.

What Tools Do I Need?

Free across the board. [axe DevTools](https://www.deque.com/axe/devtools/) browser extension (Chrome or Firefox) — industry standard for automated WCAG scanning. [WAVE](https://wave.webaim.org/extension/) browser extension — WebAIM's structural-and-visual checker. [Lighthouse](https://developer.chrome.com/docs/lighthouse/accessibility/) built into Chrome DevTools — performance-correlated accessibility checks. NVDA on Windows (free download) or VoiceOver on macOS (built-in, Cmd+F5 to toggle) — manual screen reader testing.

That's the stack. No paid tools required. The DIY audit produces a strong indicator of WCAG conformance posture; a formal ACR for procurement or legal contexts requires a credentialed auditor on top.

For broader testing-tool context, see our accessibility-testing-tools-comparison and best-wcag-testing-tools-2025.

What Pages Should I Audit?

The customer journey, prioritized by traffic and risk. Homepage (15 minutes). Top-trafficked product page (15 minutes). Top-trafficked collection page (10 minutes). Cart page (10 minutes). Checkout flow (20 minutes — the highest-risk surface). Account creation/login (10 minutes). Customer service contact form (5 minutes). Accessibility statement page (5 minutes — exists?). Mobile-emulator pass on the same flow (20 minutes).

Total active testing time: ~110 minutes. Add 10 minutes for findings consolidation and prioritization. The 2-hour total fits a focused single-session audit.

For deeper page-by-page audit context, see our shopify-accessibility-audit-checklist-wcag-22-liquid.

Step 1: Run axe DevTools (15 minutes per page)

Open the page in Chrome or Firefox. Click the axe DevTools extension icon. Click "Scan ALL of my page." Wait for the scan to complete (5-10 seconds). Review the violations list. For each violation, click "Highlight" to see the failing element on the page. For each violation, click "More info" to see the WCAG criterion and remediation guidance.

Document each violation in your findings template (next section). Pay particular attention to violations classified as "Critical" or "Serious" — these correspond to the most-cited demand-letter criteria. axe DevTools maps each violation to specific WCAG criteria; capture the criterion reference (e.g., "WCAG 2.4.7 Focus Visible") for downstream remediation tracking.

Repeat on each prioritized page. The pattern: 15 minutes per page including review and documentation.

Step 2: Run WAVE (10 minutes per page)

Click the WAVE extension icon while on the page. WAVE renders an annotated view: red icons for errors, red striped icons for contrast errors, yellow for alerts, green for accessibility features. Hover or click each icon for details.

WAVE is particularly good at structural issues axe DevTools may classify differently — heading hierarchy problems, missing form labels, decorative-vs-meaningful image confusion. Capture WAVE's findings alongside axe's; the union of both tools catches more than either alone.

For the WAVE-specific findings pattern, see our accessibility-testing-checklist.

Step 3: Run Lighthouse Accessibility (5 minutes per page)

Open Chrome DevTools (F12 or right-click → Inspect). Click the "Lighthouse" tab. Select "Accessibility" only (deselect Performance, SEO, etc.). Click "Analyze page load." Wait for the score (15-30 seconds).

Note the score (0-100) and review the failed audits. Lighthouse adds value by surfacing some performance-correlated accessibility issues (focus indicators that fail because of paint timing, content that flashes during load) that axe and WAVE may not catch. Lighthouse scores 95-100 are strong; 85-94 indicate room for improvement; <70 is critical.

Step 4: Manual Keyboard Navigation Pass (15 minutes per page)

Click somewhere outside any input field, then press Tab repeatedly. Watch where focus goes. Verify three things on each page: every interactive element receives focus when tabbed, the focus indicator is visible (not hidden by `outline: 0`), the focus order is logical (top to bottom, left to right). Press Shift+Tab to verify backward navigation. Press Enter or Space on focused buttons and links to verify activation works. Press ESC on any modal or drawer to verify dismissal.

Document failures: specific element where focus broke, the WCAG criterion (typically 2.4.7, 2.4.3, or 2.1.1), the URL. Manual keyboard pass catches issues automated tools miss — particularly focus order in dynamic content and dialog patterns.

Step 5: Manual Screen Reader Pass (20 minutes for top 3 pages)

VoiceOver (Cmd+F5 on macOS) or NVDA (free download for Windows). Open the page, navigate by keyboard while listening. Verify what's announced. Check for: image alt text quality (not just presence), heading announcements (logical hierarchy), variant picker announcements (does selecting a variant announce the choice?), add-to-cart confirmation (does the cart drawer announce success?), error messages (does form submission announce errors?).

Capture verbatim what the screen reader says. "[VoiceOver, 2026-06-04] Reads: 'Image. Image. Image.' for product gallery thumbnails." This level of evidence quality is what credentialed auditors document.

Manual screen reader testing is the layer that distinguishes audit-grade findings from automated-tool-only findings. 20 minutes across the top three pages is sufficient for the DIY-audit scope; deeper screen reader work justifies engaging a credentialed auditor.

Step 6: Mobile Emulator Pass (20 minutes)

Chrome DevTools → toggle device toolbar (Ctrl+Shift+M or Cmd+Shift+M) → select iPhone 15 Pro or Galaxy S24. Run axe DevTools on top three pages in mobile emulation. Test touch-target sizes (WCAG 2.5.8), drag-only interactions (WCAG 2.5.7), and mobile-collapsed navigation. For real-device testing, use Bluetooth keyboard with iOS or Android.

Mobile-specific WCAG 2.2 criteria (2.5.7 Dragging, 2.5.8 Target Size, 3.3.7 Redundant Entry, 3.3.8 Accessible Authentication) are the most likely additional findings here. For broader mobile context, see our mobile-accessibility-guide and mobile-accessibility-testing.

Step 7: Consolidate Findings (10 minutes)

Build a findings spreadsheet. Columns: Page URL, WCAG Criterion, Severity (Critical/Serious/Moderate/Minor), Description, Recommended Remediation. Sort by severity. Critical and Serious findings rise to the top.

The output is your remediation backlog. Critical and Serious findings address first; Moderate and Minor in subsequent sprints. Maintain the spreadsheet over time as remediation completes and new findings appear from automated scans.

What's the Output Worth?

The DIY audit produces three downstream artifacts. Remediation backlog ordered by criticality, with WCAG criterion references — usable directly by an in-house developer or accessibility platform vendor. Vendor pitch evaluation context — when accessibility platforms pitch you, you can compare their findings to yours and evaluate whether the vendor identified issues you missed (or vice versa). Pre-engagement self-check — before engaging a credentialed auditor for a formal ACR, you know roughly where you'll land.

In our experience working with 100+ brands, customers who run a DIY audit before engaging a vendor or platform make better decisions on scope, timeline, and vendor selection than customers who skip the DIY layer. TestParty's standard service includes daily automated scans plus monthly expert manual audits with date-stamped compliance reports for legal counsel. TestParty was named to the Forbes Accessibility 100 in 2025.

Frequently Asked Questions

Is the DIY audit enough to claim compliance? No. The DIY audit produces strong indicators but is not a formal ACR. Compliance claims and procurement-grade documentation require a credentialed auditor. The DIY layer is for internal planning and vendor evaluation, not for legal posture.

Should I run the DIY audit before hiring a vendor? Yes for budget-discovery purposes. Vendors will run their own audit as part of engagement; running yours first calibrates expectations and identifies specific issues you can ask about during vendor evaluation.

What if I find hundreds of violations? Normal for a typical pre-remediation Shopify store. The 2026 baseline for unmodified-theme stores is 100-350 violations; pre-remediation Plus stores can run 200-500. The volume isn't the threat; the unaddressed-violation duration is. Document, prioritize, and start remediation.

Should I run the DIY audit on a regular cadence? Daily automated scans (axe DevTools or platform-driven) are the right cadence for ongoing regression detection. The full 2-hour DIY audit is appropriate quarterly or after major changes (theme switch, new app, brand redesign).

Can I share the DIY findings with my legal counsel? Yes for context. The findings inform remediation prioritization and vendor evaluation. For formal demand-letter response or EAA regulator engagement, you need a credentialed-auditor ACR; the DIY findings are supporting context.

Does TestParty replace the need for DIY audits? TestParty's daily automated scans cover the axe-DevTools layer with significantly more depth and continuous coverage. The platform's monthly expert manual audits cover the screen-reader and keyboard-pass layers with credentialed reviewers. Customers running TestParty typically deprecate manual DIY audit cadence (the platform handles the work) but maintain the DIY methodology as a sanity-check for new template or app additions.

What if my store uses a custom platform, not Shopify? Same audit methodology, different deployment context. axe DevTools, WAVE, Lighthouse, and screen readers work on any HTML-based site. The Shopify-specific patterns (Liquid templates, theme.liquid hooks, App Store apps) translate to your platform's equivalents.

Are accessibility overlays a substitute for the DIY audit? No. Overlay widgets don't substitute for audit methodology. Run the DIY audit with the overlay enabled and disabled to see the actual delta. The FTC fined accessiBe specifically $1 million in April 2025 for related marketing claims about overlay accessibility capabilities; auditors and procurement teams evaluate underlying site, not overlay output.

Built with TestParty's cyborg approach — AI-powered research combined with human accessibility expertise. This article contains TestParty's editorial analysis based on publicly available information. We're an accessibility vendor with opinions informed by working with 100+ brands, and we encourage readers to do their own due diligence when evaluating any solution.