Lumadro Accessibility Ledger

Lumadro Accessibility Ledger keeps the record that accessibility work usually leaves scattered
across emails and memory. It finds specific WCAG 2.1 AA failures, helps you fix them
in your actual content, and writes every step into an append-only ledger you
can export: each finding with the success criterion it fails, each change with
its before and after, the date, who approved it, and whether AI drafted it.

The European Accessibility Act has applied since 28 June 2025 to many products
and services sold to consumers in the EU, online shops among them, wherever the
seller is based. Its technical reference is WCAG 2.1 level AA, through EN 301 549.
When someone asks what you have done about accessibility, the answer should be
a document, not a feeling.

It does not make your site legally compliant, and no plugin can. It finds
specific problems, helps you fix them properly, and documents the effort in a
form you can show someone, with the tool’s own limits written into it.

This is not an accessibility overlay. It adds nothing to the front end and
does not change what visitors see at runtime. It changes the underlying content.

The ledger

• Every accepted change is recorded with the date, the text before and after,
  the person who approved it, the AI provider that drafted it (or that a person
  wrote it), and whether the reviewer edited the draft.
• The ledger is append-only. An undo is added as a new entry; nothing is erased.
• When a later scan of the same page no longer finds a problem, the ledger
  records it as “no longer detected” with the date, whether it was fixed here
  or anywhere else. It is never presented as proof of a fix: the content may
  simply have changed.
• A downloadable report lists open findings grouped by success criterion, each
  with its page, and counts confirmed failures apart from items flagged for a
  person to review. It includes the full change log and a section on what the
  checks did not cover.
  It will never say the site is fully conformant, fully accessible or legally
  compliant.

How it finds problems

Site scan. Reads every published post and page and every library image, in
the background, and fetches each published page once to check what the theme
adds. It finds:

• Images with no alt attribute, and alt text that is really a file name
• Links and buttons with no accessible name, including icon-only ones
• Form fields with no label, and frames with no title
• Headings that skip a level, and pages with no h1
• A missing or malformed page language, and missing or placeholder page titles
• Data tables with no header cells, and positive tabindex values

Browser check. Loads your pages in your own browser tab and runs the open
source axe-core engine on them. It sees what visitors see: computed colour
contrast, and forms and content that JavaScript builds after the page loads,
such as a block checkout. It then probes what axe-core cannot: whether the page
scrolls sideways at 320 pixels wide (reflow), whether elements show a visible
change when they take focus, whether clickable elements can be reached from the
keyboard, and whether content that opens on focus closes with Escape. These are
listed for review, never as proven failures. Each run starts with the home page
and shop pages, then pages never checked, then those checked longest ago, so
repeated runs work through the whole site; the browser check screen lists pages
by when they were last checked, and the report says how many never were.
Nothing is sent to any other service.

How it fixes them

AI drafts the part that is slow to write by hand: alt text. It uses your own
provider key through WordPress core’s AI Client, so there are no credits and no
per-fix charges; you pay your provider directly, at cost, for any volume.
Scanning, the browser check and the reports work with no AI configured at all.

Fixes go where the problem is. A library image’s alt text is used wherever it is
placed from then on. An image already placed in a post is fixed in that post,
with a normal post revision, and if the library already describes that image
well, its description is offered without an AI call.

Nothing changes without you

• A draft is only a draft until you accept it, and you can edit it first.
• Text a person wrote is never replaced silently. Replacing it needs a
  deliberate choice on that item: tick “Replace the text a person wrote” and
  accept. In a post, an image someone marked decorative (alt=””) counts as a
  person’s decision too.
• Every change can be undone. If someone has edited the text since, the undo
  refuses rather than discarding their edit.

Lumadro Accessibility Ledger Pro

The free plugin is complete for fixing and recording work one item at a time.
Pro, a separate paid plugin, adds:

• Bulk accept and reject (still never replacing text a person wrote)
• Scheduled weekly or monthly re-scans, with a dated scan history you can add to the downloaded report
• JSON export of the report and CSV export of the change log
• A drafted accessibility statement written from the same evidence
• A network overview of every site’s evidence on multisite
• A portfolio of your separate sites: each exports a summary file, and one
  site shows them all in one table (no site contacts another)

Pro uses the same bring-your-own-key AI, with no credits or per-fix charges.

How much of WCAG this covers

The site scan checks 10 of the 50 WCAG 2.1 level A and AA success criteria. The
browser check adds partial checks of a few more on the pages it loads, and the
report says exactly which and how far. The rest need a person, and the plugin
lists every one of them by name on its “Coverage and limits” screen and inside
every report. Passing the automated checks does not mean your site conforms.

We would rather tell you that than let you believe otherwise.

External services

Your AI provider (optional). Drafting alt text uses the provider you connect
yourself under Settings > Connectors, through WordPress core’s AI Client. Only
when you ask for drafts, the plugin sends the provider the image (the file from
your media library, or its public URL on your own site), the image’s file name,
caption, description and current alt text, and the title, language and nearby text of the published page it
appears on. Nothing from password-protected or private content is sent. No data
is sent to the provider while scanning, running the browser check or building
reports, and nothing is sent at all if no provider is connected. The provider’s
own terms of service and privacy policy apply; see your provider’s website (for
example https://openai.com/policies/, https://www.anthropic.com/legal or
https://policies.google.com/).

When WordPress’s AI Client is missing or has no provider set up, and the
separate AI Services plugin is installed with a provider, drafting uses that
instead. It sends
the same text (the image’s file name, caption, description, current alt text
and the page context above) but not the image itself, only when you ask for
drafts, to the provider configured in AI Services, under that provider’s terms.

No licensing or update service. This plugin contains no licensing code and
contacts no licensing or update service; it updates from WordPress.org like any
other plugin.

The browser check and the site scan contact no outside service: the scan only
fetches your own site’s pages, and axe-core runs in your own browser.

Third-party libraries

• axe-core 4.13.0 by Deque Systems, Mozilla Public License 2.0.
  Source: https://github.com/dequelabs/axe-core
  Bundled unmodified in assets/vendor/axe-core and loaded only into your own
  pages during a browser check started from the admin screen.