Why is a missing privacy policy high severity here?

Because these sites routinely collect personal data — health details, identity documents, financial information — and a privacy policy is the minimum their visitors are owed. The finding is withdrawn when the document is found anywhere on the site.

Does finding an accessibility statement mean the site is accessible?

No. The rule only checks that a statement page exists. Whether the site conforms to WCAG needs its own testing, most of which cannot be automated.

Why does the audit ask a finance site to name its regulator?

Because visitors are entitled to check who supervises a bank, an insurer or an investment firm. The rule runs when a page title mentions banking, credit, finance or insurance and no page mentions a licence or a regulator.

Site types

Auditing a public-sector or regulated website

Government, education, nonprofit, health, finance and insurance websites share one rule module, because they owe their visitors more formal information than most sites. The audit checks for an accessibility statement, a legal notice, a privacy policy and a contact page, looks for organisation markup and downloadable documents, reports forms that submit over plain HTTP, and asks finance and insurance sites to name their regulator. Health, finance, insurance and education sites are also expected to have a FAQ.

Which sites get the institutional rules

Six detected categories run the same module. The category engine recognises them mostly from schema.org types and vocabulary: `GovernmentOrganization` and wording such as "official website" or "démarches administratives"; `EducationalOrganization`, `School` or `Course` and paths such as `/courses` or `/enroll`; `NGO` and paths such as `/donate` or `/volunteer`; `MedicalOrganization`, `Hospital`, `Physician` or `Dentist` and paths such as `/appointment` or `/patients`; `FinancialService` or `BankOrCreditUnion` and paths such as `/loans` or `/invest`; `InsuranceAgency` and paths such as `/insurance` or `/quote`.

A type adds 30 points, a path 12, a word 8, and a category needs 24 points. The rules are the same for all six: the engine groups them because the obligations they check — being accountable, reachable and careful with data — are common to all of them.

The rules the institutional module adds

No legal notice — `/legal`, `/mentions-legales`, `/impressum` — and no privacy policy — `/privacy`, `/confidentialite`, `/vie-privee` — are each reported at high severity, the highest of the module. The legal-document discovery then checks links, pages and the sitemap: it withdraws the finding when the document exists, and downgrades it when the crawl stopped at its page budget first.

No accessibility statement — a URL containing `/accessibility` or `/accessibilite` — is reported at medium severity. In the European Union, public-sector bodies are required to publish one for their websites.

No contact page is reported at medium severity. No organisation markup — `GovernmentOrganization`, `NGO`, `EducationalOrganization`, `MedicalOrganization`, `FinancialService`, `InsuranceAgency` or `Organization` — is reported at low severity, and no downloadable PDF, Word or spreadsheet document at information level.

Every page with a form whose `action` points to an `http://` address is reported at high severity: citizens, patients and customers type personal data into these forms.

When a page title speaks of a bank, credit, finance or insurance and no page mentions a licence or a regulator — such as "regulated by", "licensed", the FCA, the AMF, the ORIAS or the ACPR — that absence is reported at medium severity.

What else changes, and what does not

`structure.faq` treats a FAQ as relevant for health, finance, insurance and education sites, where the same questions come back every day. Its absence is reported as a low-impact observation, never as a failure.

For finance sites, the monitoring check notes, when no public monitoring tool is visible, that error tracking and real-user monitoring are usually worth having on a transactional platform.

None of the six categories is reweighted in the score. Privacy, security and accessibility checks run and weigh here exactly as they do on any site; the difference is in the rules above, not in the arithmetic.

What an audit cannot certify

Finding an accessibility statement is not finding an accessible site: the statement's content and the site's real conformance need testing, most of it by a person. The accessibility checks of the audit cover a mechanical part of WCAG and say so.

Finding a privacy policy or a regulator's name is not a compliance review. Whether the policy is accurate, whether consent is valid and whether a licence is current are legal questions no crawler answers.

Forms, documents and the rest of the audit

The insecure-form rule runs on every crawled page and reports each page separately, with its URL. It complements the transport checks, which report mixed content and plain-HTTP pages for every site; here the same problem is raised to high severity because of what these forms collect.

The document rule only notes whether any PDF, Word or spreadsheet file is linked. It does not open the files, so their accessibility, their dates and their accuracy are not examined.

Legal notice, privacy policy and contact are also looked for by the separate legal-document discovery, which follows links, pages and the sitemap. When the two disagree, the discovery wins: it is the one that looked everywhere.

Frequently asked questions

Why is a missing privacy policy high severity here?: Because these sites routinely collect personal data — health details, identity documents, financial information — and a privacy policy is the minimum their visitors are owed. The finding is withdrawn when the document is found anywhere on the site.
Does finding an accessibility statement mean the site is accessible?: No. The rule only checks that a statement page exists. Whether the site conforms to WCAG needs its own testing, most of which cannot be automated.
Why does the audit ask a finance site to name its regulator?: Because visitors are entitled to check who supervises a bank, an insurer or an investment firm. The rule runs when a page title mentions banking, credit, finance or insurance and no page mentions a licence or a regulator.

Sources

VeriFixScan crawls a site and applies its checks to every page it reaches, keeping the evidence behind each finding. Scanning one website is free.

Scan a website