Portfolio demo. Payments run in Stripe test mode: use card 4242 4242 4242 4242, any future date and any CVC. No real charges.

ScanAble Research

Section 508 in 2026: How accessible are America's biggest .gov sites?

Published · Data refreshed

ADA Title II’s deadline for state and local government websites took effect April 24, 2026. Section 508 has required accessibility from federal procurement for over two decades. We picked a curated set of 67 government websites — cabinet departments, regulatory agencies, healthcare portals, citizen-service flagships, large state government homepages, and major city portals — and ran the same automated WCAG 2.0/2.1/2.2 AA audit on each that we sell to private-sector buyers. 55 scanned successfully.

The headline numbers are roughly what you’d guess (mid-tier average score, half the set below 70). The individual results are not. The Supreme Court of the United States ships its homepage at a compliance score of 7 out of 100. weather.gov — one of the most-visited federal sites in existence — scores 8. The FDA, the federal agency in charge of medical-device accessibility regulation, scores 11. Meanwhile va.gov, consumerfinance.gov, epa.gov, cbp.gov, and secretservice.gov all score a perfect 100. This is mostly a story about which agencies have shipped a modern frontend workflow and which haven’t.

Average score

61.1

Median score

61

% scoring below 70

53%

Worse than expected

% with a critical issue

22%

The headline

Across the 55 sites we audited, the average compliance score is 61.1 out of 100, and 22% ship at least one critical accessibility violation. 53% score below 70.

Government websites are arguably the most accessibility- regulated category of public-facing software in existence: Section 508 of the Rehabilitation Act has required it since 1998, ADA Title II now mandates it for state and local governments, and the federal procurement process has required VPATs for years. The automated baseline still isn’t close to clean.

The leaderboard

Best 5
  • epa.gov100
  • consumerfinance.gov100
  • va.gov100
  • cbp.gov100
  • secretservice.gov100
Worst 5
  • supremecourt.gov7
  • weather.gov8
  • usps.com10
  • boston.gov11
  • fda.gov11
Score distribution

Where these 55 sites land

90-100
10 (18%)
70-89
16 (29%)
50-69
8 (15%)
30-49
14 (25%)
0-29
7 (13%)
The repeat offenders

Top 10 violations across the audit set

RuleSeverity% of sites failing
region

Ensure all page content is contained by landmarks

moderate49%
landmark-one-main

Ensure the document has a main landmark

moderate31%
html-has-lang

Ensure every HTML document has a lang attribute

serious24%
landmark-unique

Ensure landmarks are unique

moderate24%
target-size

Ensure touch targets have sufficient size and space

serious15%
page-has-heading-one

Ensure that the page, or at least one of its frames contains a level-one heading

moderate13%
image-alt

Ensure <img> elements have alternative text or a role of none or presentation

critical13%
heading-order

Ensure the order of headings is semantically correct

moderate11%
landmark-no-duplicate-banner

Ensure the document has at most one banner landmark

moderate11%
link-name

Ensure links have discernible text

serious11%

What it means for the public sector

The spread is the story. va.gov, consumerfinance.gov, epa.gov, cbp.gov, secretservice.gov — all 100. supremecourt.gov — 7. weather.gov — 8. The FDA — 11. These agencies operate under the same Section 508 obligations and the same Title II rule. The gap isn’t regulatory; it’s frontend infrastructure.

I’ve worked on biotech and insurance frontends where the difference between “passes” and “fails” was whether the team had a design system. A site built on tokens, with components that ship accessibility properties by default, will mostly pass — even when individual engineers aren’t actively thinking about it — because the system enforces the floor. A site assembled from a 2010-era CMS, where every page renders custom HTML, can’t reach that floor no matter how diligent the team is. The leaderboard maps neatly onto that pattern.

If you’re a procurement officer evaluating a vendor’s VPAT: ask which design system their public site uses. If the answer is “we built our own” or “we don’t have one,” and their automated score is below 70, the VPAT is aspirational. The agencies in our top five didn’t get there by writing better VPATs. They shipped a frontend that defaults to compliance, and the VPATs reflected that.

Methodology

How we generated these numbers

  • Source list: a curated set of 67 federal cabinet departments, major federal agencies, large state government homepages, and major city portals. Curated rather than traffic-ranked because the article angle is Section 508 enforcement, not popularity. Full list lives in scripts/fetch-gov-domains.ts.
  • What we scanned: the homepage of each domain (https://<domain>/), loaded in headless Chrome via Puppeteer, no authentication.
  • Engine: axe-core with WCAG 2.0, 2.1, and 2.2 Level AA tags enabled. Same engine ScanAble uses for every paid audit, same engine the federal accessibility tooling guidance recommends.
  • Score formula: passes / (passes + Σ(violation_nodes × severity_weight)) × 100. Full breakdown at /methodology.
  • Caveat: automated tools (including ours) catch ~30–40% of WCAG issues per Deque’s research. The numbers above are a floor, not a ceiling. A clean automated score does not certify Section 508 conformance.

Find out where your site lands

Same scanner, same engine, same scoring. Vendor selling into government? Put your homepage through it before submitting your VPAT.

Run a free previewSee the global pieceMethodology