Gate non-conforming content by HTTP referer

SVR3 is attached to no success criterion, exactly as SVR2 is, and it does the same job in application code rather than server configuration. The server reads the HTTP referer, and serves the non-conforming page only when the request came from its conforming alternate. Everything else gets the conforming version. W3C's own description hedges the header with the words if any, and never says what to do when it is missing, which is the gap that matters most today. Browsers and privacy settings strip referers routinely, so a gate written to trust the header will fail open on a large share of real traffic. Treat a missing referer as an outside visit and serve the conforming version. That is our rule rather than W3C's, and it is the difference between a gate and a decoration. As with SVR2, the published test accepts either the conforming version or a page that links both.

How we find it in an audit

Reviewers make the request three ways. From the conforming page, from an outside link, and with no referer at all, which is the one that catches the defect. A gate that passes the first two and lets the third through is a gate in name only, and it is the common case rather than an edge case. We script the three requests because there is no reason to do them by hand. What still needs judgment is whether the content behind the gate genuinely cannot be made conforming, since most things that get filed under this arrangement could simply be fixed.

How affected users experience it

The person this arrangement is supposed to protect is somebody who cannot use the original at all. When the gate leaks, they meet the original anyway, usually from a search result, and there is nothing on it telling them a version they could use exists. A leaky gate looks fine from the inside. Everyone testing it arrives from the conforming page and sails through. The only people who see it fail are the people it was built for.

Passes vs. fails

Passes: name, role, and state exposed. Fails: a control with no identity.

Passes

$ref = $_SERVER["HTTP_REFERER"] ?? "";
if (str_starts_with($ref, "https://example.com/accessible/")) {
  serveOriginal();
} else {
  serveConforming();
}

Fails

$ref = $_SERVER["HTTP_REFERER"] ?? "";
if ($ref === "") { serveOriginal(); }
// A stripped referer, which is most of them, walks straight in.

This guide is our interpretation of W3C technique SVR3: Using HTTP referer to ensure that the only way to access non-conforming content is from conforming content. W3C publishes its techniques as guidance rather than as the standard, and says so on every one of them. The success criterion is what conformance is measured against, and a technique is one documented way to meet it.