Run a full manual accessibility audit at least once a year, re-test any part of your site you significantly change — a redesign, a new checkout, a theme swap — and run a quick automated check monthly. If your site changes weekly (a store, a publisher, a web app), move the full audit up to every six months. That’s the whole answer for most small businesses.
The more useful question is why a site that passed an audit stops passing. We remediate websites for a living, and the sites that come back to us broken were almost never broken on purpose. Something routine changed, nobody re-tested, and compliance quietly drifted away. Here’s what that looks like — and the cadence that catches it.
Why doesn’t a passing audit stay passed?
Because an audit describes your website on one specific day, and your website doesn’t stay that way. W3C’s own evaluation methodology, WCAG-EM, is explicit about this: evaluations “can quickly become obsolete by implementing even minor changes,” and it describes evaluations being “re-run after a short period… or periodically to monitor progress.” The people who wrote the standard for auditing websites built re-auditing into the standard.
The web-wide data shows the drift, too. In the 2026 WebAIM Million report, 95.9% of the top one million home pages had detectable WCAG 2 failures, averaging 56.1 errors per page — a 10.1% increase in errors over the 2025 analysis. Sites aren’t just failing; sites that were slowly improving got worse as pages grew more complex. Standing still is not a thing websites do.
So treat accessibility like bookkeeping, not like a diploma. You don’t “finish” it once. You keep it current — and there’s no certificate that makes you permanently compliant, whatever a vendor promises.
What silently breaks compliance between audits?
In our remediation work, the same handful of routine events cause most regressions. None of them feel like “changing the website,” which is exactly why nobody re-tests after them:
- Theme and plugin updates. A WordPress or Shopify theme update ships new template files that overwrite fixed ones. We’ve seen a store’s carefully labeled product filters revert to unlabeled controls after a single theme version bump — the fix lived in the old template, and the update replaced it. Shopify apps and themes are a repeat offender here.
- New landing pages cloned from old layouts. A seasonal promo page gets duplicated from a template built before your remediation. The audit fixed twenty pages; page twenty-one launched with the original broken heading structure and low-contrast buttons.
- Editors uploading media. Marketing posts a product video with no captions, or a batch of images with empty alt text. The code is fine; the content now fails. Captions and transcripts are content-level requirements no past audit can cover.
- New third-party embeds. A chat widget, a booking tool, a cookie banner, a reviews carousel — each one drops someone else’s markup into your pages. We’ve audited sites where the only keyboard trap on the entire domain was a chat widget added months after remediation.
- A CSS “refresh.” A designer lightens the brand gray, and text that passed contrast at 4.6:1 now sits at 3.8:1 on every page. Nothing structural changed; the whole site fails WCAG 2.1 AA contrast anyway.
Notice the pattern: not one of these requires touching your site’s accessibility features directly. That’s why W3C’s planning guidance says that “as your website content changes, ensure that regular accessibility reviews are performed” — and recommends building checks into the publishing process itself (W3C WAI, Sustaining Accessibility).
How often should you audit, by site type?
Most published advice converges on “annually at minimum,” and it’s right as a floor — but a floor is all it is. The Bureau of Internet Accessibility recommends basic audits every 4–6 months, with monthly testing for stores and publishers that change constantly. Accessible.org argues the opposite edge: monthly comprehensive audits are counterproductive because a full WCAG 2.1 AA audit takes 10–15 days and teams need time to actually fix things between rounds — they suggest quarterly, semi-annual, or annual full audits depending on the site.
Both are right, because they’re describing different layers. Here’s how we’d set the cadence by site type:
| Site type | How it changes | Full manual audit | Automated check | Targeted re-test |
|---|---|---|---|---|
| Brochure site (5–20 pages) | A few edits a year | Every 12 months | Monthly self-check (below) | After any redesign or theme/plugin update |
| Small business site with a blog | New content weekly or monthly | Every 12 months | Monthly scan of key pages | New templates, forms, or embeds before launch |
| Ecommerce store | Products, banners, apps weekly | Every 6–12 months | Weekly or monthly on core templates | Any checkout, theme, or app change |
| Web app or booking-heavy site | Continuous releases | Every 6 months | Continuous monitoring | Every significant feature release |
Two notes on reading that table honestly. First, the “full manual audit” column is the expensive one, so scale it to risk: your checkout and contact flows matter more than your blog archive. Second, the automated column is a tripwire, not a verdict — automated scanners miss a large share of real barriers, which is why the manual column never disappears.
The 15-minute monthly self-check
Between audits, a non-technical owner can catch most drift with free tools and a quarter of an hour. Do this on the same day every month:
- Run WAVE on your three most important pages (home, top service or product page, contact/checkout). WAVE is WebAIM’s free checker — paste a URL, look at the red error icons, and compare the count to last month. Rising numbers mean something changed. 5 minutes.
- Do a quick keyboard pass on anything new. Tab through any page added or redesigned since last month, using the 10-minute keyboard test shortcut: can you see focus, reach everything, and escape every widget? 4 minutes.
- Spot-check new media. Open the newest blog post or product page. Do images have real alt text? Does any new video have captions? Our alt text checker makes the image half of this a paste-and-go job. 3 minutes.
- Write down what changed. Plugin updates, theme updates, new pages, new embeds — one line each. When something regresses, this log is how your developer finds the cause in minutes instead of hours. 2 minutes.
- Escalate, don’t accumulate. If steps 1–3 surface something you can’t fix, send it to your web person now. A logged issue costs a ticket; an ignored one waits for a demand letter to find it.
This won’t certify anything. It will catch the plugin update that wiped your focus styles eleven months before your next audit would have.
When should you re-audit outside the schedule?
Immediately after any of these, regardless of when your last audit was: a redesign or replatform, a new theme, a new checkout/booking/quote flow, a merger of two sites, or a legal event like a demand letter. And if you’ve just finished remediation, schedule a verification re-test roughly a quarter later — WCAG-EM specifically describes re-running an evaluation “when issues are identified and repaired” to confirm the fixes (W3C WCAG-EM).
A redesign deserves special paranoia. It’s the single event most likely to discard every accessibility fix you’ve paid for, because new templates replace old ones wholesale. Test before launch if at all possible; it is far cheaper than re-remediating in production, as anyone who has read our breakdown of what a full audit includes can price out.
Who should actually do all this?
Split it three ways. The monthly self-check is yours — it needs no technical skill and its job is detection, not repair. Targeted re-tests after changes go to whoever built the change, with a keyboard-and-scanner pass at minimum. The periodic full audit should be done by people who test with real assistive technology, because the highest-risk failures — a screen reader that can’t complete your checkout, a form that never announces its errors — are invisible to every automated tool.
If remembering to do this is the part that will fail (it usually is), that’s the problem ongoing accessibility monitoring exists to solve: automated checks on a schedule, human review of what they find, and an alert when an update quietly breaks something — so drift gets caught in days, not at next year’s audit. And if you’re not sure where your site stands right now, start with the baseline: run a free accessibility scan and see what’s changed since anyone last looked.