If you are selling to a federal agency, Section 508 is not optional and it is not a nice-to-have you handle after launch. It is a condition of award. Agencies ask for a VPAT before they buy, and a weak one stalls a contract.
Most explanations of 508 are written by lawyers for lawyers. Here is what an audit actually looks at.
508 points at WCAG
Section 508 does not contain its own technical rules. The 2017 refresh adopted WCAG 2.0 Level AA by reference, and most agencies now expect WCAG 2.1 AA. So when someone says "we need 508 compliance," the work is WCAG conformance plus the documentation that proves it.
That documentation is a VPAT, filled in as an Accessibility Conformance Report. It states, criterion by criterion, whether your product supports, partially supports or does not support each requirement. A VPAT that claims full support everywhere is a red flag to an experienced evaluator, because almost nothing fully supports every criterion. Honest partial-support entries with an explanation read as credible.
What automated scanning catches
Roughly a third of WCAG failures are machine-detectable, and they are the common ones: images without alternative text, form inputs without labels, insufficient colour contrast, missing page language, duplicate element IDs, empty links and buttons, and heading levels that skip.
These matter and they are worth fixing first because they are cheap. Contrast alone accounts for an enormous share of what gets cited in ADA demand letters against small businesses.
What only a human catches
The remaining two thirds need judgment.
Alt text quality. A scanner confirms alt text exists. It cannot tell you that alt="image123.jpg" is useless, or that a decorative flourish should have empty alt so a screen reader skips it rather than announcing noise.
Focus order. Every interactive element can be reachable by keyboard and the tab order can still be nonsense, jumping from the header to the footer and back into the middle of a form.
Keyboard traps. A modal that opens and cannot be closed without a mouse is a total blocker for a keyboard user, and nothing automated reliably finds it.
Meaningful sequence and context. Whether the reading order matches the visual order. Whether an error message is actually announced. Whether a live region updates at a useful moment or interrupts constantly.
Captions and audio description. A scanner sees a video element. It cannot tell whether captions exist, are accurate, or are auto-generated nonsense.
Anyone selling you a scan as full 508 compliance is selling you a third of the job.
The conflict nobody mentions
Here is the part we built a product around because it kept biting us.
Accessibility remediation and security hardening pull against each other more often than either community admits.
A Content Security Policy tight enough to satisfy a security review can break the inline ARIA live-region updates a screen reader depends on. Session timeouts short enough for a security control can violate the WCAG requirement to give users enough time, because someone using switch access legitimately needs longer to complete a form. CAPTCHA satisfies bot protection and is a well-known accessibility barrier. Disabling paste on a password field defeats password managers, which is both a security regression and an accessibility one.
Fix accessibility without checking the security side and you can fail your next security review. Fix security without checking accessibility and you can fail your 508 review. On a federal delivery, either one stalls the award.
What we would do first
Run an automated scan and fix everything it finds. It is a third of the problem and the cheapest third.
Then do the keyboard pass yourself. Put the mouse down and tab through your most important flow, front to back. You will find more in twenty minutes than most people expect: the focus you cannot see, the modal you cannot escape, the skip link that does not exist.
Then write the VPAT honestly, including partial support where it is partial. Then work the manual criteria in order of how many users each one blocks.
We built MCProof to do the first part free and to draft the artifacts for the rest, including the conflict engine that flags where an accessibility fix would break a security control. But the keyboard pass costs nothing and you can do it this afternoon.
One more thing worth saying plainly: an automated scan of one page is not a legal opinion, and no tool including ours can promise you will not receive a demand letter. What fixing these does is make your site usable by more people, which was the point before it was a compliance requirement.
