Acceptable Use Policy

You may run AccessWiser scans against a website only if you own it or the owner has authorised you to test it. Scanning someone else's website without permission puts load on their servers, and in many places it is a legal problem for you rather than for us.

That rule is now held up before a scan is sent rather than only recorded afterwards. Every scan runs against a site you have added to your account — the site your plan covers and where your AccessWiser widget is installed — and nothing else. Point a scan at any other address and it is refused with an HTTP 403 before a single request is made to that address, and the refusal is written to your audit log. For a specific page scan, from the dashboard or through the Scan API, adding the site in your dashboard, which is where you get your widget snippet, is the whole check. A journey crawl, a full site scan and scheduled re-checks make many or repeated requests to the same site, so they need one step more: you publish a DNS TXT record, which your dashboard gives you, to show that you control the site's domain, and they run only on a site whose record is verified. We do not fetch the page to confirm the widget is on it.

One rule covers every surface, with no exception for the quick ones. A specific page scan from the dashboard, a scan through the Scan API, a journey crawl, a full site scan that follows links across a whole site in a single run, and scheduled re-checks that return to pages a full site scan or journey crawl has already scanned are all held to the same gate. Adding a site covers its subdomains too, and so does its verified DNS record, because they sit in the same zone of authority.

Scheduled re-checks work like this. When a full site scan finishes — or a journey crawl, on plans that include one — the pages it scanned join your account's re-check list and are re-checked on the schedule your plan sets, up to your plan's page limit. That limit is for your whole account; if you have more than one site on it, the limit is divided between your sites as evenly as whole pages allow. Pages stay on the list, and there is no setting that stops re-checks for a single page. Re-checks for a site stop when you remove the site from your account or when its DNS record is no longer verified, and re-checks for your whole account stop when your plan no longer includes them.

Every scan you start still has to fit your plan: your plan must include scanning, each scan draws on your monthly allowance and then on any credits you have bought, and scans count toward your account's rate limits (see section 4). Scheduled re-checks, which you do not start, draw on neither your allowance nor your credits; they are bounded instead by your plan's page limit and schedule. Our scanner connects only to public addresses, never to private or internal networks. And every scan, whether it was started in the dashboard or through the API, is written to your account's audit log with the account that ran it and the address it was pointed at.

What that gate cannot do is judge authorisation, and that half stays yours. A site sitting on your account shows only that somebody with access to the account added it; it is not proof that you own the site or that its owner has agreed to let you test it. So scanning a site you are not authorised to test is still a breach of this policy even when the scan runs, and an account used that way may be suspended, as section 5 describes. If you manage sites on behalf of clients, hold each client's permission before you add their site, and keep their sites on the account that has that permission.

AccessWiser exists to help site owners find, fix, monitor, and document accessibility issues on their own websites. It is not a prospecting tool for accessibility litigation. You may not use the service, its scan results, its exports, or its reports to:

• assemble, draft, or support an accessibility demand letter or demand package against a website you do not own;
• survey sites in order to identify, rank, or shortlist potential defendants or claim targets;
• solicit claimants, or supply third parties with scan output for either of the above purposes.

Using our own findings on your own site as part of an audit, remediation plan, or your response to a complaint is entirely legitimate and is exactly what the product is for. What is not permitted is pointing it outward at sites that never asked for it.

You may not attempt to detect the AccessWiser scanner, our user agent, or our IP ranges in order to serve it a page that differs from the page your real visitors receive. That practice — commonly called cloaking — is prohibited.

There are two reasons. The first is that it harms disabled visitors: a clean scan of a page nobody actually sees fixes nothing for the person using a screen reader on the real one. The second is that it works against you. Scan history is dated and retained, and a record showing that a site deliberately presented one version to testing tools and another to the public reads, in any dispute, as concealment rather than good faith.

This rule runs in both directions, and our half of it is written into section 2 of our Terms and Conditions, where you can read what we commit to and how it is held in place.

Scans, API calls, and report generation are subject to rate limits and plan quotas. They exist so that one account cannot degrade the service for everyone else, and so that the sites we scan — including yours — are never hit harder than they should be.

Do not attempt to work around them: no rotating or splitting accounts to multiply an allowance, no automating signups, no scripting around the published limits, and no reselling your quota. If your legitimate needs exceed your plan, contact us and we will talk about the right plan rather than leaving you to route around the limit.

Where we reasonably believe this policy is being violated, we may rate-limit, suspend, or terminate the account concerned, and remove the affected domains. Scanning is mostly a matter of records rather than damage now that a scan of an address you have not added is refused before it is sent: both the scans that ran and the attempts that were refused are logged with the account that made them and the address they targeted, so we can trace either back to the account responsible. Serious or repeated cases may be acted on without prior notice. Otherwise, where the circumstances allow it, we will tell you what we saw and give you a chance to put it right first.

If you believe your site has been scanned without your permission, or that someone is using AccessWiser in the ways described above, tell us at contact@accesswiser.com. Include the domain or page address and, if you have them, the dates and times, and we will investigate.

This policy sits alongside our Terms and Conditions; where a use is restricted by either document, the restriction applies.