WCAG 2.2: The Complete Developer's Guide
WCAG 2.2 introduced nine new success criteria. We break down each one, explain the real-world impact, and show you exactly what to fix in your codebase.
By ShipReady · Updated
WCAG 2.2 became a W3C Recommendation in October 2023, adding nine new success criteria on top of 2.1. Accessibility law in the US, EU and elsewhere increasingly points at WCAG as the standard, so these are not optional niceties — they are the bar you are measured against.
What's new in 2.2
All nine, with their conformance level. Three are AAA, so most teams are measured against the six at A and AA. WCAG 2.2 also removed a criterion — 4.1.1 Parsing is now obsolete, so a duplicate id attribute is no longer a conformance failure by itself.
| Success criterion | Level | What it requires |
|---|---|---|
| 2.4.11 Focus Not Obscured (Minimum) | AA | The focused element must not be entirely hidden by author-created content — a sticky header, a cookie banner, a chat widget. |
| 2.4.12 Focus Not Obscured (Enhanced) | AAA | No part of the focused element may be hidden. |
| 2.4.13 Focus Appearance | AAA | The focus indicator must meet a minimum area and contrast. |
| 2.5.7 Dragging Movements | AA | Anything operated by dragging needs a single-pointer alternative, unless dragging is essential. |
| 2.5.8 Target Size (Minimum) | AA | Pointer targets are at least 24×24 CSS pixels, with exceptions for inline links, spacing, and equivalents elsewhere on the page. |
| 3.2.6 Consistent Help | A | Help mechanisms — contact details, a help link, a chat launcher — appear in the same relative order on every page that has them. |
| 3.3.7 Redundant Entry | A | Do not make someone re-enter information they already gave earlier in the same process. |
| 3.3.8 Accessible Authentication (Minimum) | AA | No cognitive function test — remembering a password, transcribing a code, solving a puzzle — without an alternative or a mechanism to assist. Password managers must not be blocked. |
| 3.3.9 Accessible Authentication (Enhanced) | AAA | As above, with the object-recognition and personal-content exceptions removed. |
The ones most sites fail
Target Size trips up dense mobile UIs with tiny icon buttons. Focus Not Obscured breaks the moment a sticky header covers a focused input. Accessible Authentication catches login flows that require solving a puzzle or copying a code with no easier path such as a password manager or a link.
How to test it
- Do a keyboard-only pass: Tab through every page and confirm focus is always visible, never trapped, and never hidden behind a sticky header. That single pass covers 2.4.11 and much of the rest of Guideline 2.1.
- Run an in-browser checker such as axe DevTools or WAVE. These execute your page, so they can evaluate rendered contrast and computed accessible names.
- Check contrast against 4.5:1 for body text and 3:1 for large text and user-interface components.
- Test one complete flow — sign-up, checkout, whatever pays the bills — with a screen reader. The gap between "passes automated checks" and "actually usable" lives here, and no tool closes it.
Be realistic about what automation covers. The criteria new in 2.2 are largely interaction and flow properties — whether a drag has an alternative, whether a form asks twice for the same thing — and those are precisely the properties a machine is worst at judging. Treat automated results as a floor, never as a conformance claim.
ShipReady checks the structural subset it can verify from the HTML of every page it crawls: images without alternative text, form inputs with no label, a missing `lang` attribute, a viewport that blocks zoom, and skipped heading levels. It does not evaluate colour contrast and does not run your page in a browser, so pair it with an in-browser checker and the keyboard pass above. ARIA labels: when to use them covers the naming half in more depth.
Frequently asked questions
- Is WCAG 2.2 a legal requirement?
- WCAG itself is a W3C technical standard, not a law. Laws and procurement rules in many jurisdictions reference a specific WCAG version and conformance level, and which version applies to you depends on where you operate and who your customers are. Treat the standard as the technical bar and take the legal question to a lawyer.
- Does WCAG 2.2 replace 2.1?
- It extends it. WCAG 2.2 adds nine success criteria and makes 4.1.1 Parsing obsolete; everything else from 2.1 still applies, and 2.1 remains a published Recommendation.
- Can an automated tool prove conformance?
- No. Automated checks find a subset of failures — missing names, missing language, structural problems. Whether a drag has a real alternative, or whether a login flow imposes a cognitive test, needs a person.