← Adrian Ene · audits
Audit & remediation Next.js · Cloudflare Workers Published 30 August 2026

startovar.com: found, fixed, and verified before handover.

Seven pages against WCAG 2.2 AA with axe-core — then the fixes, then proof the fixes actually shipped. The two findings that mattered most weren't accessibility defects.

This one is my own property, audited to the same standard I apply to client work. Judge the method, not the relationship.

Result

39 → 9
violation instances, before and after
30 → 0
colour-contrast failures
4 → 3
distinct rules triggered
1
finding measured and withdrawn

For scale: WebAIM's February 2026 study of the top million homepages puts the median at 56 detected errors. Startovar started at four distinct rule violations across seven pages, so it was already in unusually good shape — which is exactly why the valuable findings turned out to be somewhere else.

Method

Seven pages tested with axe-core 4.13 against WCAG 2.0, 2.1 and 2.2 at levels A and AA, plus axe's best-practice rule set, in Chromium at 1280×900 with every stylesheet and image loaded — so contrast was measured from computed styles rather than estimated from a palette. Supplemented by raw-HTML inspection, robots.txt and sitemap parsing, structured-data extraction, response-header checks per crawler user-agent, and a JavaScript-disabled render test.

Both the before and after figures include the best-practice rules. Measuring the "before" with best-practice enabled and the "after" without it would have turned 9 into 1 and made the improvement look far better than it was. Same rule set on both sides, or the comparison is a lie.

What it found

FOUND
The signup and login pages both declared the homepage as their canonical URL — telling Google the conversion page was a duplicate not worth ranking. Root cause was a single alternates.canonical on the Next.js root layout, inherited by every route that did not override it. The login page, being a client component, could not export metadata at all, so it inherited the homepage's title and description too.
FOUND
robots.txt blocked GPTBot, ClaudeBot, CCBot, Google-Extended and four more, while the site's own llms.txt invited them and its robots.ts source said, in a comment, that it wanted them. A managed block at the CDN was prepending itself ahead of the application's own rules — so the code was right and the served file was wrong.
FOUND
All 30 colour-contrast failures traced to one design token at 3.59:1 against a 4.5:1 requirement. One value, thirty failures.
WITHDREW
A finding that looked like invisible text in the login field. Stale dark-theme class names appeared to render typed text unreadable — a dramatic finding, and an easy one to write up. I measured it instead: 11.91:1. Perfectly legible, and deliberate, because the theme redefines the whole colour scale for a light background. It went into the report as explicitly not a defect, with the measurement shown.

That last one is the point of the whole exercise. A report that cries wolf once loses the reader for everything else in it.

What was fixed

FixEffect
Removed the root-layout canonical; gave every route a self-referencing one Signup and product pages became independently indexable
Added a server-component layout for the client-rendered login page Real title and description, plus noindex, follow
Changed one design token from #8a8173 to #767060 3.59:1 → 4.62:1 on the paper background; all 30 failures cleared at once
Removed the CDN-level AI-crawler block and the managed robots.txt override robots.txt reduced to 149 bytes and now matches the application's intent

Verified before handover, not assumed: tsc --noEmit clean, production build exit 0, and the emitted HTML and compiled CSS inspected to confirm the new tags and the new colour actually shipped. Deployed as Cloudflare version db703de2-6700-4178-93ae-72abb94e8b2a.

Verification — re-measured 30 August 2026

Every figure below was measured against the live site on the day this page was published, not carried over from the working notes.

CheckResult
robots.txt149 bytes, no crawler-specific blocks
GPTBot / OAI-SearchBot / ClaudeBot / CCBot / PerplexityBotall HTTP 200
Canonicals on /, /apply, /products, /logineach self-referencing
/login robots metanoindex, follow
axe-core, 7 pages, WCAG A+AA and best-practice9 instances, 3 rulesheading-order, landmark-unique, link-in-text-block
Colour-contrast violationszero
WCAG 2.2 A and AA success criteria alone1 instance across all seven pages

Two numbers on this page could not be re-measured, and I would rather say so than let you assume otherwise: the 39 and the 3.59:1 are pre-fix figures from a build that no longer exists. Everything else above was measured on 30 August 2026.

An error I made, and caught

34 findings that were never real

The first post-deployment re-audit reported 34 new target-size failures — touch targets supposedly too small. That would have been a serious regression, and it would have been easy to publish.

It was my mistake. My mirroring script re-downloaded the stylesheets but reused the HTML files from before the deploy, so post-deploy CSS was being measured against pre-deploy markup. Re-fetching the HTML in the same pass made all 34 vanish.

I am recording it here because a report you cannot audit is worth nothing, and because the script that caused it is now fixed to always fetch markup and assets together. If I catch myself being wrong, you get told.

Still open on this site

Published unresolved, because an audit that only lists what got fixed is marketing:

No <label> elements anywhere; 30 of 40 /stores images carry empty alt text; 82 images ship without width and height attributes; a "See all stores" link on /products sits at 1.31:1 against surrounding text; seven unlabelled <nav> landmarks; a heading-order skip on the homepage; no og:image on four pages; no security headers.

And the largest one, which no code change touches: the site has no brand mentions anywhere on the web. Ahrefs' December 2025 study of 75,000 brands found branded mentions correlate 0.66–0.71 with visibility in AI answers, against 0.218 for backlinks. Fixing crawler access lets the machines in; it does not give them anything to find elsewhere.