Login must not depend on a cognitive test without an alternative
Customers with dyslexia, memory or cognitive impairments cannot solve puzzles or retype codes from memory, and blind customers cannot solve an image CAPTCHA. When that is the only way into the account, returning customers cannot log in to reorder or track a parcel.
- Rule id
- vs-accessible-auth
- Source
- Validiscan check
- Impact
- Serious
- Fix tier
- ASSISTED
- on Shopify, Shopware, WooCommerce and Magento
- Status
- runs
What the check does
Detects CAPTCHAs, puzzles and other cognitive function tests on login, registration and password forms without an accessible alternative, and password fields that block pasting or password managers (3.3.8).
The check runs on account and checkout pages that show a visible, enabled password field. It judges each form holding such a field, or the whole page body when there is no form, so a CAPTCHA in a separate form does not count.
A CAPTCHA is recognized by its provider’s frame address, a data-sitekey attribute or “captcha” in an id, class, src or alt; a cognitive test, by an input whose label or nearby text asks for a calculation or for the characters in an image. Either, when visible, is reported unless the text of the form, or of up to two surrounding containers, mentions an audio option, an emailed login link or code, a one-time code or passkeys. An invisible CAPTCHA alone produces no finding. A CAPTCHA frame’s content is not read, so options inside the widget are not seen by the check.
A password field is also reported when it has autocomplete="off", on the field or inherited from its form, or when a script cancels a test paste event.
How to fix it
Replace image and puzzle CAPTCHAs with invisible, risk-based bot protection, allow pasting and password managers (autocomplete="current-password"), and offer an alternative such as a sign-in link by email or passkeys.
WCAG success criteria
EN 301 549 clauses
| WCAG criterion | Version 3.2.1 | Version 4.1.1 |
|---|---|---|
| 3.3.8 | not a clause in this version | 9.3.3.8 |
Start with a free check of your shop.
Send your shop’s address. Validiscan scans it and replies with every failure the scan can prove, with the page and the code.
Request a free checkOr write to info@validiscan.com.
What the free check covers, and what it leaves out- You send
- your shop’s address
- Pages scanned
- up to 15
- You get
- every failure the scan can prove, with the page and the code
- On your shop
- public pages only; no login, nothing bought, no forms sent
- What it is not
- a full audit