Web accessibility got worse in 2026: 95.9% of the top million home pages fail WCAG, up from 94.8%, the first regression in six years. The average page has 56.1 errors, six issues cause 96% of them, and US lawsuits neared 5,000. Here is what every number means for your site.
The FTC click to cancel rule was vacated in July 2025, so many businesses think the pressure is off. It isn't. The rule fell on a technicality, Section 5, ROSCA, and state laws still apply, and Amazon paid $2.5B after it was struck down. Here is what you actually still need to do in 2026.
HTTP security headers kill whole classes of attacks with zero app logic changes, yet under 25% of the web runs a meaningful CSP and 48.8% of those weaken it with unsafe-inline. Here is the complete 2026 checklist: strict nonce CSP, HSTS preload, report-to, and the headers to delete.
A duplicate ID, an unclosed tag, ARIA on the wrong element: small code quality bugs a browser hides and a screen reader exposes. In 2026, pages with ARIA average 59 errors vs 42 without, and WCAG failures hit 95.9%. Here is why markup validity and accessibility are one problem, not two.
Cookie consent in 2026 is not one rule, it is a regional matrix. The EU and UK demand opt-in and an equal Reject button, California and 20+ US states require notice plus a working opt-out and now GPC. Here is what your banner legally needs by region, and why "looks compliant" is not enough.
The DOJ moved the ADA Title II compliance deadline to April 2027 for larger public entities and 2028 for smaller ones. But only the date changed. The WCAG 2.1 AA standard, scope, and obligation all stay in force. Here is what the 2026 rule actually did, and why waiting is a trap.
If you run a website, you have probably seen the pitch. A single line of code, dropped onto your pages, that promises to make your site accessible to people with disabilities and keep you safe from lawsuits.