WCAG 2.2 · ADA · Section 508 · CCPA · HIPAA · PCI-DSS · SOC 2

One scan. Every compliance standard your site needs.

One scan, every compliance domain. Full WCAG 2.2 accessibility audit plus web-layer checks for HTTP security headers, California privacy, Core Web Vitals, HIPAA, PCI-DSS, FERPA, and a SOC 2 evidence pack — in a single pass, with AI judgment, in one branded PDF report your engineering team can act on and your legal team can defend.

Start a free scanSample report

Free account · 10 pages per scan · No credit card

plumb-report.pdf

Web Compliance Audit ReportTwo-part deliverable

https://example.com

Pages audited

Critical

Serious

Total findings

9 compliance domains covered

AccessibilitySecurity headersCCPA / PrivacyCookiesCore Web VitalsHIPAAPCI-DSSFERPASOC 2

Part 1 — Executive brief

Risk register, scorecard, roadmap. No code.

Part 2 — Technical remediation

Every page, every selector, before/after code.

Everything you need for a defensible audit

Built on axe-core with AI-augmented review on every paid scan.

WCAG 2.2 + axe-core

Tests against all 50 Level A & AA criteria — including the 9 new criteria added in WCAG 2.2 (focus indicators, dragging movements, target size, accessible authentication) — using axe-core from Deque Systems.

AI-augmented review

On paid plans, our AI reviews each page with vision + content analysis — alt-text quality, link descriptiveness, cognitive accessibility, semantic structure. The judgment calls axe-core can’t make.

Branded PDF reports

Clean PDF reports with your logo, an executive summary, severity-ranked findings, and concrete remediation guidance — ready to hand to engineering, design, or legal.

Real-browser testing

Pages render in headless Chromium with full JavaScript execution — not just static HTML. We catch the issues real users actually hit.

Coverage

What Plumb audits against

Every paid scan runs all four categories in one pass. Industry modules (healthcare, commerce, education) only emit findings on pages whose content actually triggers them — your marketing pages won't get HIPAA noise.

What “covers HIPAA / PCI / FERPA / SOC 2” actually means

Plumb is a web-layer scanner. WCAG runs against ~100 axe-core rules — that's a real, deep audit. Core Web Vitals are real measurements against Google's thresholds. The industry modules (HIPAA, PCI-DSS, FERPA, SOC 2) run web-layer hygiene checks scoped to what a public HTTP/HTML scan can see — PHI in URLs, checkout HTTPS, form-method security, header presence, link audits. They are not certifications and do not replace your BAA review, SAQ, records-management audit, or CPA-firm SOC 2 attestation. Use them to catch the obvious web-side failures that would otherwise bite at audit time.

Accessibility & Legal

4 standards

WCAG 2.2

Deep audit

Technical standard

All 50 Level A & AA criteria including the 9 new in 2.2 (focus, dragging, target size, accessible auth). AAA on Pro. The standard ADA Title II / III and Section 508 reference.

ADA Title II

Deep audit

US — public sector

DOJ April 2024 rule requires WCAG 2.1 AA on state & local govt sites — compliance windows in 2026/2027.

ADA Title III

Deep audit

US — businesses

The basis for 3,000–4,500 website-accessibility lawsuits per year. Most settlements reference WCAG 2.1 AA.

Section 508

Deep audit

US — federal

Required for federal agencies and contractors. Revised 508 Standards adopt WCAG 2.0 AA by reference.

Security & Privacy

3 standards

HTTP Security Headers

Web-layer checks

Best practice

CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy — Mozilla Observatory + OWASP baselines. Header presence and basic syntax; not a full security audit.

CCPA / CPRA

Web-layer checks

California, USA

Privacy policy link, "Do Not Sell or Share" link, tracker inventory (GA, Meta, Hotjar, etc.), banner detection, GPC awareness. Link & banner presence — not consent-flow validation.

Core Web Vitals

Measured

Google ranking signal

LCP, CLS, INP, TTFB measured per page against Google's published thresholds. Headless scans rarely capture INP (needs user interaction).

Industry-Specific

3 standards

HIPAA

Web-layer checks

US — healthcare

PHI in URLs, HTTPS / HSTS, form security, autocomplete on sensitive fields. Web-verifiable subset of the Security Rule — does not replace your BAA review, encryption-at-rest, or access-control audit.

PCI-DSS

Web-layer checks

International — commerce

Card number in URLs, checkout HTTPS, form method, CVV autocomplete, iframe-tokenization recommendation. Catches obvious web-side failures — does not replace your SAQ or annual assessment.

FERPA

Web-layer checks

US — education

Student PII in URLs, HTTPS on student-record pages, form method. PowerSchool / Canvas / Banner platform signals. Web-layer only — no records-management or access-control verification.

Audit Evidence

1 standard

SOC 2 evidence pack

Web-layer checks

AICPA Trust Services

Maps findings from other modules to CC6.6 (boundary), CC6.7 (transmission), CC6.8 (malware prevention), CC9.1 (risk mitigation). Hand to your CPA firm. Not a SOC 2 audit and not a substitute for one.

Detailed rule-by-rule findings, severity ratings, and remediation guidance live in the branded PDF report we deliver for every scan. See a sample report ↓

What's under the hood

Built on the same tools the experts use

We don't run our own accessibility ruleset or our own browser engine — we build on the industry standards. The value Plumb adds is the orchestration, AI judgment, and reporting around them.

axe-core

Deque Systems

Playwright

Microsoft

Chromium

Real-browser render

WCAG 2.2

W3C standard

CCPA / CPRA

California AG

SOC 2

AICPA TSC

We'll add customer quotes here as soon as we have ones worth showing. Until then, the sample report and a free scan are the most honest answer to “is this any good?”

On every paid scan

What axe-core can't see, AI can.

Automated rule engines catch ~30–40% of WCAG issues. The rest take judgment — is the alt text actually descriptive? Does the heading structure make logical sense? Is information conveyed only by color?

On Standard and Pro, every page is reviewed by AI with vision + content analysis to surface what programmatic tools miss.

See plans

Sample AI finding

ai-link-text-vague

AI · high confidence

Link text “Read more” appears 7 times on the page without surrounding context. Screen reader users navigating by link list cannot distinguish destinations.

AI reasoning: WCAG 2.4.4 requires link purpose to be determinable from the link text or context. Generic phrases like “read more” fail this criterion when used in lists or repeated.

WCAG: 2.4.4Level: AImpact: serious

From URL to delivered report in 3 steps

Discover your pages

Paste your homepage. We crawl the site so you can see the full page list and pick exactly which pages to audit — no surprise budget burn.

We audit in real Chromium

Each chosen page is rendered, axe-core runs, screenshots are captured, and our AI reviews each page for the issues axe-core can’t see.

Download a branded report

A clean PDF with executive summary, severity-ranked findings, code-fix examples, and screenshots — ready for engineering or legal.

Simple, predictable pricing

Start free. Upgrade when you need clean reports for clients and AI augmentation.

Free

Try Plumb risk-free. Free account, no credit card.

WCAG 2.2 full audit + web-layer compliance checks
Up to 10 pages per scan
Watermarked PDF report
3 scans / day · 20 lifetime cap
🎉 Eligible for monthly Standard giveaway

Start free scan

Standard

$49/month

For consultants and small teams shipping audit-ready compliance.

250 pages of audit per month
Up to 100 pages per scan
AI-augmented multi-compliance report
Choose WCAG level: A, AA, or AAA
Page-by-page findings + screenshots
Pause / resume scans · cancel anytime
Email delivery · scan history

Pro

$199/month

For agencies and compliance teams running full multi-domain audits.

1,000 pages of audit per month
Up to 500 pages per scan (5× Standard)
Priority scan queue
Custom logo + branding on reports
Everything in Standard

Enterprise

Custom

For organizations needing multi-user accounts, groups, and custom page volumes.

Negotiated monthly page allocation
Multi-user accounts with role management
Groups + per-group scan quotas
Account manager for onboarding & renewals
Annual invoice billing
Everything in Pro

Contact sales

🎉 Monthly Standard giveaway

We give away at least 3 free Standard tier months every month

Try Plumb on the free tier. Complete one scan with at least 5 pages and you're automatically entered in that month's drawing — no sign-up, no spam. If your name comes up, you get 30 days of Standard tier (100 pages/scan, AI-augmented report, choose WCAG level) on the house.

Eligibility: free-tier users only, no prior paid subscription, no prior giveaway win. One-shot — past winners aren't re-entered.

Ready to ship something accessible?

Free account, no credit card. Magic-link sign-in takes under a minute.

Start a free scan