Accessibility Audit & Theme Certification

Paid pluginsize Lplanned, not built

Indicative price, not an offer: €19.99/mo for quarterly audits + €9.99-29.99 per certified theme — owns the support commitment and EAA filing obligation

Generated from docs/plan/paid/accessibility-audit-theme-certification/PLAN.md in the AstroBaaS repository. Nothing described below is implemented — it is the written plan for it.

A paid service that runs quarterly WCAG 2.1 AA audits on storefronts, certifies Next.js themes for accessibility compliance, and provides audit evidence for EU Accessibility Act regulators. Merchants get proof of compliance and certified-theme marketplace.

The problem

A Portuguese merchant’s storefront is WCAG AA compliant (she worked with a contractor to fix it 6 months ago), but she has no audit report to show regulators or customers. An audit costs €4k. Her theme has no certification. She’s afraid to make frontend changes because she might break accessibility and not know it.

What it does

• Quarterly automated WCAG 2.1 AA audit (via AXE, Lighthouse, manual spot-checks)
• Detailed audit report: issues found (contrast, keyboard nav, ARIA), severity (blocker/major/minor), remediation steps
• Audit evidence exportable as PDF for regulatory filing (AEPD, etc.)
• Audit history: track compliance over time (did we get better or worse?)
• Certified-theme program: AstroBaaS tests Next.js themes for A11y baseline, awards ‘Certified’ badge
• Certified-theme marketplace: filtered list of themes that pass WCAG AA
• Regression detection: alert merchant if new audit finds issues that were fixed in prior audit
• Support ticket escalation: if audit finds issue, merchant can open ticket with audit engineer
• Integration: audit results dashboard in admin, next audit date countdown

What it deliberately does NOT do

Each boundary carries its reason. A boundary without a reason gets crossed by the next person who reads this.

• Fixing accessibility issues (that’s the merchant or dev’s job)—we only audit
• Hosting or CDN audit (outside scope; theme/storefront only)
• WCAG AAA (highest level)—scope is AA only, hard requirement in EAA
• Auditing merchant’s own custom theme modifications (we only certify base themes)
• Section 508 (US) or AODA (Canada) audits—EU-focused only

Data model

New: A11yAudit(id, shopId, themeId, audit_date, status, findings_json, severity_summary, pdf_url, next_audit_date); ThemeCertification(themeId, certified_at, expires_at, audit_results_id). No migration; stored in plugin/settings infrastructure.

API

• POST /audits/schedule — schedule next quarterly audit
• GET /audits/latest — return most recent audit report
• GET /audits/history — list all audits with dates and severity summary
• POST /audits/:auditId/export-pdf — generate PDF report for regulators
• GET /themes/:themeId/certification — return certification status and valid-until date
• GET /themes/certified — list all certified themes (storefront can use this)

Every route added here must also appear in src/pages/openapi.json.ts — a test fails the build if it does not.

Admin

Compliance dashboard: latest audit results with severity breakdown (blockers/major/minor), PDF export button, next audit date, audit history timeline, certified theme badge if applicable, support ticket button if issues found

The seam — why this is paid

Core owns: audit scheduling, results storage, API. Paid pack owns: running actual audits (AXE + manual review), theme certification program, audit report PDF generation, regulatory filing support.

a paid pack owns the support commitment — we run quarterly WCAG audits, certify next.js themes, and provide audit evidence for regulators.

Dependencies

• accessibility-metadata-validation (core; paid pack builds on top)
• theme system (themeId must exist and link to storefront)
• email layer (for audit alerts)

Acceptance checks

Each of these must be able to fail. Before claiming this is done, break the code deliberately and watch each one go red.

• A quarterly audit is scheduled and runs automatically; report is stored within 24h
• Audit report lists at least 5 types of issues (color contrast, form labels, heading structure, keyboard nav, ARIA attributes)
• Severity summary shows count of blockers/major/minor; blockers (if any) are listed first
• PDF export produces a valid PDF with audit date, storefront URL, issues, remediation steps
• A certified theme shows ‘Certified WCAG AA’ badge in marketplace and admin settings
• If theme is re-audited and issues are found that were resolved in prior audit, merchant receives regression alert
• Audit history shows dates and severity trends over 2+ years (is compliance improving?)
• Certified theme expires after 12 months; cert status shows ‘expires DD/MM/YYYY’

Risks

Audit false positives (e.g., flagging a legitimate ARIA use as wrong)—automated tools have high false-positive rates; needs manual review. If merchant ignores blockers, they remain non-compliant and expose AstroBaaS to liability by association. Theme certification program scope creep: if we certify themes too strictly, no one gets certified; if too loosely, certification is worthless. PDF report outdated within days if storefront changes—must clarify report is snapshot, not live guarantee.

Commercial context

The anchor is what the nearest equivalent charges on Shopify or Magento today. It is context for a pricing decision, not the decision.

---

Generated from the commerce plan. See docs/COMMERCE-PLAN.md for the full catalogue and ../../AI-GUIDE.md for how to work on this repository.