A timeout is a time limit the content sets, such as a session that expires, a booking held for ten minutes, or a form that clears itself after a while. The rule that governs it gives you six ways out, and most people only know three. Let the user turn the limit off before they meet it. Let them adjust it before they meet it, over a range of at least ten times the default. Or warn them before it expires and give them at least twenty seconds to extend it with one simple action, at least ten times over. The other three are exceptions, and they are narrow. A real-time event such as an auction where no alternative limit is possible, a limit that is essential because extending it would invalidate the activity, and anything longer than twenty hours, which this rule then leaves alone.
In practice
The timing of the obligation is the part teams miss. Turning the limit off and adjusting it both have to be available before the user meets the limit, so the dialog that says your session is about to expire satisfies neither of those. That dialog is the third route, extending, and it has conditions of its own. At least twenty seconds to respond, a single simple action to do it with, and at least ten extensions, not one.
A time limit is much broader than a session. Anything that happens without the user starting it, after a set time or on a repeat, counts. A page that refreshes itself, content that changes on its own, a window of opportunity to respond to something, and anything advancing faster than a person can read it. A message that pops into the corner and fades after four seconds sits squarely inside that description.
Scope has a real edge to it. The rule attaches to limits set by the content, so one imposed by the browser or the network sits outside it. Where the limit lives is not the test, though. A session length your own server enforces is still a limit your content set, so read the sentence as who chose it rather than where the code runs.
Three more criteria cover time and all three are Level AAA. One is literally called Timeouts and asks you to warn people how long inactivity can run before data is lost, unless the data survives more than twenty hours. One is about resuming an activity after a session ends without losing what was entered. One removes timing from the activity altogether. A timeout that quietly discards a half-filled form is not only their business, though. Where the limit is the content's, it is failing the Level A rule first, and the AAA criteria are what make the warning and the recovery obligations of their own.
Why it matters
The numbers in this rule are not arbitrary, and knowing where they came from is worth more than quoting the rule. Twenty seconds was chosen because twenty seconds to hit any switch is enough for almost everybody, including people with reduced movement. Ten times the default came from the same reasoning. If fifteen seconds is what a person gets, 150 seconds covers almost anyone having trouble. There is also one group on the beneficiary list that surprises people. Somebody who communicates in sign language may be reading printed text in a second language, and where an interpreter is relaying content, that adds time too.
The cheap fix teams skip
A checkbox on the first page of a long form, offering a longer session or no session limit at all, is a documented way to satisfy this rule. It lands before the user meets the limit, which is where the obligation actually sits, and it beats arguing about the default with your security team. Check what the longer option actually does, because an increase that still lands short of what the rule asks has not satisfied anything.
Where this shows up on the site
Related terms
- Cognitive disabilityCognitive disability is a broad group of conditions affecting how people take information in, hold on to it, and act on it.
- Motor disabilityMotor disability covers anything that affects movement, strength, precision or sensation, from tremor and arthritis to multiple sclerosis, repetitive strain, paralysis and missing limbs.
- Switch deviceA switch device is an input for people with severely limited movement, and the picture most people have is a single large button pressed with a hand, head or knee.
- OperableOperable is the second WCAG principle, and its one-line statement is that user interface components and navigation must be operable.
- Error identificationError identification is the Level A rule that when your form rejects something, the page names the field that failed and says in text what went wrong.
Knowing the word is the easy part.
Find out where your own site stands. The free scan checks 10 pages in a real browser against all 90 supported automated rules, separates 27 best-practice checks from its WCAG findings, and names the rule behind every result.