Most accessibility scanners fall into one of two camps: browser extensions that check the page you're looking at, or API services that fetch your HTML and parse it statically. Both approaches miss things. Browser extensions require manual work — someone has to click through every page. Static analyzers miss JavaScript-rendered content, single-page app routing, and anything that requires user interaction to appear.
xsbl takes a different approach. Every scan launches a real headless Chromium browser, navigates to your site, waits for JavaScript to execute and the DOM to settle, then runs axe-core against the fully-rendered page. This is the same engine that powers Puppeteer and Playwright — the tools your own E2E tests use.
Multi-page crawling
When you trigger a scan, xsbl doesn't just check your homepage. It fetches your sitemap (or crawls your internal links), filters out non-scannable URLs like PDFs, XML feeds, and file downloads, then scans each page individually. Free plans scan up to 5 pages, Pro scans 25, and Agency scans 50. Each page gets its own axe-core run, its own score, and its own set of issues.
The final site score is the average across all scanned pages, weighted by issue severity. A single page with 4 critical violations will pull the overall score down more than 10 pages with minor issues. This gives you an honest picture of your site's accessibility posture, not just a cherry-picked best case.
Timeout handling and resilience
Real-world sites are messy. Some pages take 20 seconds to load. Others have infinite scroll or heavy animations. xsbl handles this with a per-page timeout of 35 seconds and a total scan budget of 120 seconds. If a page doesn't settle in time, we move on to the next one and mark it as timed out — you still get results for the pages that worked, rather than the whole scan failing.
We also filter out URLs that would waste your scan budget: sitemaps, RSS feeds, PDF links, and URLs with query parameters that are likely pagination or tracking variants of the same page.
WCAG AA vs AAA
The default scan checks against WCAG 2.2 Level AA — the standard that most laws and policies reference. But Pro and Agency plans also include Level AAA checks, which catch subtler issues like insufficient line spacing, text that can't be resized to 200%, and missing pronunciation hints for screen readers. AAA is aspirational for most sites, but having the data helps you prioritize.
Scan profiles for fine-tuning
Agency users can create custom scan profiles per site. This lets you exclude specific axe-core rules (useful if you've intentionally made a design decision and don't want it flagged every scan), exclude CSS selectors from scanning (like third-party widgets you can't control), and toggle best-practice rules on or off. The profile is saved to the site and applied automatically on every subsequent scan, including scheduled ones.
What happens after the scan
Every issue is stored with the element's HTML, its CSS selector, the page URL, the axe rule ID, WCAG tags, impact level, and a human-readable fix suggestion. This data powers everything downstream: the issue detail view, the AI fix generation, the GitHub PR creation, and the compliance reports. One scan feeds the entire remediation pipeline.