Know what your scan
does and does not tell you.

From loading to finding.

1. 01Loading

   A real browser opens every page, just as a visitor would.

2. 02Checks

   Axe-core tests against WCAG 2.2 level A and AA, on a desktop and a mobile viewport.

3. 03Determine

   The rule engine determines what counts as a finding. Not us, and not the AI.

4. 04Summarising

   With a paid scan, an AI layer writes the summary and the explanation with it, marked in the report as AI-written. With the free scan, AI only writes the example fix in the email, marked as AI-assisted.

5. 05Delivery

   You get the findings back exactly as the rule engine established them.

Who decides what, precisely.

AI text is always marked as AI-written; the finding itself is not, because that comes from the rule engine.

What a scan never fills in.

This remains human work, on top of every scan and on top of every overlay.

• The scan establishes

  Whether there is alt text, and whether it is obviously weak

  A person assesses

  Whether that text conveys the purpose of the image

• The scan establishes

  Whether the headings are technically valid

  A person assesses

  Whether the order reads logically

• The scan establishes

  Vague link text such as "click here" or "read more"

  A person assesses

  Whether a link text is clear in its context

• The scan establishes

  Whether a field technically has a label

  A person assesses

  Whether the label and the error message are understandable

• The scan establishes

  A tab run-through, with clear keyboard traps

  A person assesses

  Whether everything works predictably with the keyboard alone

Every report names these points separately, with what needs doing.

How to allow us in if your site blocks bots.

Recognise us by the User-Agent

We identify ourselves as WexloScanner/1.0 (+https://wexlo.eu/scanner-info). We never pose as an ordinary visitor: no spoofed headers, no imitated mouse behaviour, no proxy to look different. What you see in your logs is what we are.

Allowlist on that name, not on an IP address

We run from the Frankfurt region of Fly.io, and those apps share a pool of outgoing IP addresses rather than one fixed address. So we cannot give a narrow IP range. The User-Agent above does not change even when the IP address does, so that is the durable rule.

At Cloudflare, it's a WAF rule

Create a rule in Cloudflare under Security, WAF, Custom rules:
Expression: http.user_agent contains "WexloScanner"
Action: Skip (or Allow)
Bot Fight Mode and Super Bot Fight Mode are assessed separately, so check those too if a scan still gets challenged.

http.user_agent contains "WexloScanner"

Copy the rule

Another provider or your own firewall

If you do not use Cloudflare but another provider or your own firewall, check that service's documentation for how to let traffic with this User-Agent through. If you get stuck, get in touch with us.

A robots.txt rule is not a firewall rule

robots.txt tells crawlers what you would prefer. It will not get us through a WAF. If there is a block in place, you need the rule above.