Accessibility
What our accessibility controls do, and what they don't.
The footer's "Accessibility" panel offers three independent controls. They are often lumped together as "theme" settings, but each targets a different WCAG 2.2 success criterion and none of them depend on each other.
The three controls
- Colour theme (Obsidian, Editorial, Tactical, or System) changes background, text, and accent colours. Every pairing in every theme is checked against the real WCAG relative-luminance formula, not eyeballed, and clears 7:1 (Level AAA, SC 1.4.6) for body text and 3:1 (Level AA, SC 1.4.11) for borders and focus outlines. "System" removes the choice entirely and follows your browser's own light/dark setting instead.
- Text size (Normal, Large, Accessible XL) scales the page's root font size (112.5% / 125%). This exists as a narrow, site-controlled top-up for fixed-size UI chrome - it is not a replacement for your browser's own zoom, which already satisfies SC 1.4.4 (Resize Text, Level AA) up to 200% and which this control does not attempt to duplicate.
- Touch target size (AA or AAA) changes the minimum clickable size of every button and link on the site: 24×24 CSS pixels by default (SC 2.5.8, Level AA - the widely accepted baseline), or 44×44 pixels if you opt up to AAA (SC 2.5.5, Level AAA). This is the only thing the AAA setting changes. It does not affect colour contrast or text size - those are the two controls above it.
AA vs AAA - what the labels actually mean here
WCAG defines three conformance levels: A, AA, and AAA, each stricter than the last. This site targets Level AA as its baseline for every visitor, with several individual controls letting you opt up to the stricter AAA bar where that is genuinely achievable. "AAA (44px)" in the touch-target control is one specific, narrow example of that opt-up - it is not a single switch that makes the whole site AAA-conformant. No such switch exists, because (see below) some AAA criteria conflict directly with this site's security requirements.
Combinations
The three controls are fully independent, so any colour theme can be paired with any text size and either touch-target setting - 18 combinations in total. If you want the most rigorous combination this site currently offers, Tactical (pure black/white/yellow) with Accessible XL text and the AAA touch-target size comes closest to a "maximum accessibility" preset, though there is currently no single button that selects all three at once - you would set each individually.
Full WCAG 2.2 AAA assessment
The table below lists every AAA-level success criterion we have deliberately assessed against this site, and states plainly where we meet it, where we don't, and why. This is not a claim of full AAA conformance - it is an honest account, reviewed as part of engineering work on this exact page (see the engineering log).
| Success criterion | Status | Why |
|---|---|---|
| 1.4.6 Contrast (Enhanced) | Met, with one exception | Every named colour theme clears 7:1 for body text, verified against the real relative-luminance formula. The one documented exception is the placeholder text inside native browser-rendered password/email input fields, which this site cannot restyle beyond the browser's own rendering - the same category of named exception already used for logo/brand-name text under SC 1.4.3. |
| 1.4.8 Visual Presentation | Not offered, deliberate | This SC asks for a mechanism letting you pick any foreground/background colour, control line length and line-height, and disable text justification. We offer three curated, contrast-verified themes instead of an open colour picker - a deliberate scope decision, not an oversight, and one we may revisit. |
| 2.2.3 No Timing / 2.2.6 Timeouts | Documented exception | An in-progress sign-in that needs a second factor (an authenticator code or emailed one-time code) expires 3 minutes after it starts, with no way to extend it and no advance warning before it does. This is a deliberate anti-fraud control - a long-lived, unfinished sign-in attempt widens the window an attacker who has obtained a stolen password could exploit. If your code expires, you are told to sign in again; nothing you typed is silently lost without that explanation. |
| 2.2.5 Re-authenticating | Documented exception | If your session expires mid-way through a security action, you are asked to re-enter your password or verification code rather than having it preserved. A password or one-time code is never held in memory longer than the security check that needs it - it is discarded, not preserved for you to resume with, so a session that expires mid-way always requires starting that step again. |
| 2.5.5 Target Size (Enhanced) | Met | The touch-target control's AAA setting opts every interactive element up to a 44×44 CSS pixel minimum hit area. |
| 3.3.7 Redundant Entry | Met | Signing up or resetting your password only ever asks for the new password once, not twice. This is a deliberate choice, not an oversight: asking you to retype the same value is exactly the duplicate-entry burden this AA criterion (new in WCAG 2.2) discourages. Every password field instead has a "Show" toggle so you can check what you typed without retyping it. |
| 3.3.8 Accessible Authentication (Minimum) | Met | Signing in never requires you to solve a puzzle or memorise something new. You can paste your password, and every password/one-time-code field supports your browser's or password manager's own autofill. |
| 3.3.9 Accessible Authentication (Enhanced) | Not met, by design | This stricter AAA criterion permits no cognitive test at all - not even one with an alternative available. Because a password is itself a memorised secret, no password-based account can satisfy this criterion. A passwordless method (such as a passkey) is the only way to genuinely meet it, and is not yet offered. |
What we have deliberately not built (yet)
- A free foreground/background colour picker (SC 1.4.8) - deferred in favour of three curated, pre-verified themes.
- Line-length and line-height controls (also part of SC 1.4.8).
- A passwordless sign-in method such as a passkey - the only route to genuinely meeting SC 3.3.9.
- A visible countdown warning before an in-progress sign-in challenge's 3-minute window expires (part of SC 2.2.6) - the timeout itself has a documented security rationale above, but a warning before it fires would be a real, achievable improvement we have not yet made.
This site does not currently use any moving or animated interface elements (only colour/border transitions on hover and focus), so a "reduce motion" preference has nothing to act on today - noted here as a fact, not a gap.