An Account and Settings Audit Tests Where Users Live

What We Keep Finding

Audits gravitate to the marketing site, because that is the part a crawler can reach. The industry's best dataset on how broken the web is covers home pages and nothing else, a million of them, which tells you something about where everybody has been looking. Your actual users live logged in, updating a card, changing an email, switching plans, hunting the notification toggle that finally stops the emails. Trust is built or lost on those pages, and the scanner never got past your login.

A settings page is also the clearest case for a Level AA rule nobody names. Deleting an account, changing a plan, removing a payment method, revoking a colleague's access, these all modify or delete data the user controls, and changing a card is a financial transaction. Where that is true, the standard wants one of three things. Reversible, checked with a chance to correct, or a review-and-confirm step before it goes through. That single rule covers most of what a settings audit finds and it is almost never cited.

Two things a report on these pages gets wrong in the expensive direction. A dense grid of notification toggles is not automatically a target-size failure. Small targets pass when a 24-pixel circle around each one does not touch its neighbor's, and that spacing allowance is the most misread part of the rule. And the rule about marking fields so a browser can autofill them applies only to the user's own details. A billing contact who is not the account holder, a teammate's email, an emergency contact's phone number are all outside it. Flagging those is flagging a non-requirement.

WCAG 2.2 also added a rule that bites here specifically. A flow that demands details the account already holds has to fill them in or offer them back, and the browser doing it does not count.