Home / Blog / WCAG Repair Scan: False Positives Explained

Site Audit

WCAG Repair Scan: False Positives Explained

25 October 2026 · By John Carlsson

WCAG Repair's free scan of aiwebpageseo.com named 9 failing security and site health checks. Checked against the live server, 7 were false positives: the site does redirect HTTP to HTTPS with a 301, sends a Strict-Transport-Security header with max-age=31536000, sends all six common security headers, uses Brotli compression, names AI crawlers in robots.txt and has structured data that parses without errors. The same scan scored the security headers at 100% on one tab and 0% on another. DNSSEC being off was correct. Its 205 accessibility issues named no page or element, so they could not be checked.

What happened

On 25 October 2026 we ran the free scan from WCAG Repair on aiwebpageseo.com. It produced three reports from one scan:

Accessibility: Grade D, 205 issues across 10 pages: 1 critical, 35 major and 169 minor.
Security: SSL/TLS 100%, Security Headers 100%, with five failing checks named.
Site Health: 62 out of 100, with SSL/TLS at 70% and Security Headers at 0%, and three failing checks named.

Each report came with a paid guide: $8.99 for accessibility, $14 for security, $39 for site health, or $29 for all three. We did not buy them. We checked every finding the free scan named against the live site, from our own server, and compared the accessibility results with three other tools run on the same page the same day.

The short version

Security and Site Health: 9 checks were named as failing. 7 were false positives. 2 were true, and one of those is a file for a product that no longer exists.
The report contradicts itself. One tab scores our security headers at 100%; another scores them at 0%. One tab scores SSL/TLS at 100%; another at 70%.
Accessibility: none of the 205 issues names a page or an element, so none can be checked. On the one page the report names, our home page, three other tools and our own audit found no violations of the kinds it lists as critical and major.
One fair point: radio buttons on the home page have no group label. WAVE raised the same point the same day.

False positive: "HTTP returned status 200 without HTTPS redirect"

What the report said. On the Site Health tab: "HTTP to HTTPS Redirect: Failed. HTTP returned status 200 without HTTPS redirect."

What the site does. We requested the home page over plain HTTP from our server:

http:// -> 301 https://aiwebpageseo.com/

A 301 permanent redirect to the HTTPS address, exactly what the recommendation asks for. WCAG Repair's own Security tab scores Redirects at 100%, so the same scan passed and failed this check.

False positive: "Strict-Transport-Security header is missing"

What the report said. "HSTS Enabled: Failed. Strict-Transport-Security header is missing. Add Strict-Transport-Security header with max-age=31536000."

What the site sends.

strict-transport-security: max-age=31536000; includeSubDomains; preload

The header is there, with exactly the max-age the report recommends, plus includeSubDomains and preload.

What the rule says. HTTP Strict Transport Security is defined in RFC 6797. A site complies by sending the Strict-Transport-Security header over HTTPS with a max-age, and by redirecting plain HTTP to HTTPS. Our site does both, and the independent graders Mozilla HTTP Observatory and SSL Labs both grade it A+.

Who complies. Our site complies. WCAG Repair's Site Health check reports the opposite of what the server sends.

False positive: "Security Headers 0% (0 of 6 checks passed)"

What the report said. The Site Health tab scored security headers at 0%, with none of six checks passed. The Security tab of the same scan scored them at 100%.

What the site sends.

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src 'none'; script-src 'self' ...
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
referrer-policy: strict-origin-when-cross-origin
permissions-policy: geolocation=(), microphone=(), camera=()

All six of the usual security headers are present. The 100% on the Security tab is right; the 0% on the Site Health tab is wrong. So is the Site Health tab's 70% for SSL/TLS, which the Security tab scores at 100%.

False positive: "Compression"

What the report said. Compression is listed as a failing check under Performance.

What the site sends. When a browser asks for compressed content, our server answers with content-encoding: br, which is Brotli compression, more efficient than the older gzip.

False positive: "Robots.txt AI Crawler Access"

What the report said. AI crawler access in robots.txt is listed as failing, under AI Readiness.

What the site has. Our robots.txt answers 200 and names GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, PerplexityBot, Google-Extended and CCBot individually. AI crawler access is set out bot by bot.

False positive: "Structured Data for AI"

What the report said. Structured data for AI is listed as failing.

What the site has. The home page carries a full JSON-LD graph describing the website, the organisation, the author and the tools. Every JSON-LD block on the page parses without errors, which we checked from our server the same day.

True: DNSSEC, and "AI Plugin Manifest"

DNSSEC. Correct: our domain has no DS record, so DNSSEC is not enabled. It is a fair finding, and our own Security Audit reports it too. It protects against forged DNS answers, and it is set up at the domain registrar and DNS host.

AI Plugin Manifest. Correct that /.well-known/ai-plugin.json does not exist on our site: it returns 404. That file was the manifest for ChatGPT plugins, which OpenAI retired in 2024. No current AI search system needs it, so scoring a site down for not having it is not useful advice.

Accessibility: 205 issues, none located

What the report said. Grade D. 205 issues across 10 pages: 1 critical ("Form elements must have labels", 1 occurrence), and majors for colour contrast (8), touch target size (7), visible text in the accessible name (6) and keyboard access to scrollable regions (4). A further 1,395 contrast items were flagged for manual review across 10 pages.

What it does not say. Which 10 pages, and which elements. The only page the report names is our home page. Every element detail is in the paid guide. Contrast is given as 8 occurrences in one section and 1,395 in another.

What other tools found on the home page the same day.

Our Accessibility Audit: 100/100. All form fields labelled, all 9 images with alt text, 271 text elements measured with none below the AA contrast level, and visible text in every accessible name.
WAVE from WebAIM: 0 errors, 0 contrast errors, 30 form labels, 9 alternative texts.
a11y-check.eu (axe-core): 0 violations.

WCAG Repair also uses axe-core, according to its own footer. If its critical and major issues were on the home page, these tools would have found them. They may be on other pages, but a report that does not say where cannot be checked or acted on, and we have not called them false positives for that reason.

The fair point. Its review list includes "Radio button group has no group label". That is true of the Plain English and Technical switches on our home page, and WAVE raised it too. It is advice, not a WCAG failure, because each button has a clear label.

About the sales pitch

The accessibility report opens with: "Over 4,600 ADA web accessibility lawsuits were filed last year. Plaintiff firms use automated scanners to find these exact issues. A remediation guide costs $8.99 — a demand letter starts at $5,000." It then offers a Grade D badge to embed on the site, a $5.99 a month "AI-Signed" verification, and a link to a translation service. The security guide is described as "AI-generated", and the accessibility guide as "Generated by AI, reviewed for accuracy". On our site, the free scan behind those guides reported a missing redirect and a missing HSTS header that are both present.

Side by side

HTTPS redirect: WCAG Repair, failed. Live site, 301 to HTTPS.
HSTS: WCAG Repair, missing. Live site, max-age=31536000; includeSubDomains; preload.
Security headers: WCAG Repair, 100% on one tab and 0% on another. Live site, all six present.
Compression: WCAG Repair, failed. Live site, Brotli.
DNSSEC: WCAG Repair, not enabled. Live site, not enabled. Correct.
Accessibility on the home page: WCAG Repair, Grade D with no page or element named. Our audit 100/100, WAVE 0 errors, axe-core 0 violations.

How to read any automated website report

Check the claim against the server. A redirect or a header can be checked in seconds with curl or the browser's developer tools.
Look for contradictions. Two scores for the same thing in one report mean at least one of them is wrong.
Ask where. An issue without a page and an element cannot be fixed.
Be wary of fear. A lawsuit figure is not evidence that your site has a problem.

Our Security Audit and Accessibility Audit show the evidence behind every result, and say what they could not check.

The full reports

Every report used in this post is published in full and unedited: WCAG Repair's accessibility, security and site health results, our live server checks, and the WAVE, a11y-check.eu and Accessibility Audit reports for the same page. See the full reports.

Sources

Try it yourself: Security Audit · Accessibility Audit

Frequently asked questions

Is the WCAG Repair scan accurate?

On our site, its security and site health findings were mostly wrong. It said there was no HTTPS redirect and no HSTS header, and scored the security headers at 0%, but our server sends a 301 redirect to HTTPS, a full HSTS header and all six common security headers. The same scan scored those headers at 100% on another tab. Of 9 named failing checks, 7 were false positives. Its accessibility issues named no page or element, so they could not be checked.

How do I check whether my site redirects HTTP to HTTPS?

Request your home page over plain HTTP and look at the status code. On a command line, curl -I http://yourdomain.com shows it: a 301 or 308 with a Location header pointing to the https address means the redirect is in place. A 200 means the page is served without encryption. Browser developer tools show the same thing in the Network tab if you type the http address and look at the first request.

How do I check whether my site sends an HSTS header?

Request your home page over HTTPS and read the response headers. curl -I https://yourdomain.com lists them, and the Network tab in your browser's developer tools shows them for the first request. Look for strict-transport-security with a max-age value. A max-age of 31536000 is one year, and adding includeSubDomains covers every subdomain. Free graders such as Mozilla HTTP Observatory also report it. Browsers ignore the header when it arrives over plain HTTP, so make sure you are reading the HTTPS response.

Do I need an ai-plugin.json file for AI search?

No. The ai-plugin.json file in the .well-known folder was the manifest for ChatGPT plugins, which OpenAI retired in 2024. No current AI search system needs it to find, read or cite your site. What matters is that AI crawlers can fetch your pages, that the content is clear and well structured, and that your structured data accurately describes the page. A scanner that fails a site for not having it is using an outdated check.

Should I pay for an automated remediation guide?

Check the free results first. If a scanner says a header or redirect is missing, confirm it against your own server in a minute with curl or your browser's developer tools before paying for instructions to fix it. If the free results are wrong, a guide built from them will be wrong too. If an accessibility report will not say which page and element each issue is on, ask for that before buying, because an issue you cannot locate cannot be fixed.