STM Barrierelotse is for shops that sell under the German Accessibility Improvement Act (BFSG / Barrierefreiheitsstärkungsgesetz, Germany’s implementation of the European Accessibility Act). It does three things, and it is honest about the line between them.
1. It checks — the real buying journey, not a list of pages.
- A product goes into the cart, and cart and checkout are then measured WITH content, including the error messages a customer meets when a required field is left empty. A page-list scanner checks an empty checkout, which is a different page. Classic checkout and the checkout block both.
- The pages it visits are drawn from what a shop actually is: the front page, the shop page, the biggest category listings, one product of each kind (simple, variable, on sale), the legal pages, a search with a real product word, the 404 page — and the cookie notice, as a visitor meets it. Before the check starts it says in words what it is about to look at.
- Optionally the four most important pages a second time at the width of a phone.
- Your own cart is put aside before the check and put back afterwards, and no order can be placed while a check runs — the checkout step presses the order button on purpose.
2. It generates — the information § 14 BFSG requires.
- The four mandatory elements of Annex 3, including the responsible market-surveillance authority, as a page of your own or as a block for your terms and conditions.
- Element (c) — how you address the requirements — is filled from real data: the measuring stick, the date and size of the last check, and every guided manual check you assessed as met, by name and date.
- Required fields that are empty stop the generator. This plugin publishes no placeholder prose in your name.
3. It documents — so the work can be shown, not asserted.
- A measures log that writes itself: every check, every fix switched on, every manual verdict, every publication of your information — with date and person.
- A finding can be marked as fixed, handed over or deliberately accepted; the next check holds that claim against what it measures and records the contradiction if there is one.
- Check reports are kept, comparable and printable, with an identity line on paper naming shop, report number, scope and measuring stick.
Where automation ends, it says so. Automated rules reliably reach only part of WCAG 2.1 AA (EN 301 549); roughly two thirds of the criteria need a person. Those are shown as unchecked rather than quietly counted as met, and the ones that matter most on a buying journey come as guided checklists — can an order be reviewed and corrected before it binds, do the error messages help, does the account route work with a keyboard.
It is not an overlay. No toolbar is injected, no widget. The fixes it offers are precise, off by default, and each one names exactly what it changes.
Everything runs locally. No cloud service, no external scan API, no telemetry, no customer data leaving your server.
Auf Deutsch
STM Barrierelotse ist für Shops, die unter das Barrierefreiheitsstärkungsgesetz fallen. Er tut drei Dinge:
- Prüfen: die ECHTE Kaufstrecke — ein Produkt liegt im Warenkorb, Warenkorb und Kasse werden MIT Inhalt gemessen, samt der Fehlermeldungen bei leerem Pflichtfeld. Dazu ein Seitenplan aus dem, was ein Shop wirklich ist, und der Cookie-Hinweis, wie Besucher ihn antreffen. Während einer Prüfung kann keine Bestellung ausgelöst werden.
- Erzeugen: die Informationen nach § 14 BFSG (Anlage 3) samt zuständiger Marktüberwachungsstelle — als Seite oder als AGB-Baustein. Pflichtfelder, die leer sind, halten den Generator an: In Ihrem Namen wird kein Platzhaltertext veröffentlicht.
- Dokumentieren: ein Maßnahmenprotokoll, das sich von selbst schreibt, Befund-Status mit Bestätigung durch die nächste Messung, und aufbewahrte, druckbare Berichte.
Wo die Automatik endet, sagt er es. Etwa zwei Drittel der Kriterien kann nur ein Mensch beurteilen; sie stehen als ungeprüft da, statt stillschweigend als erfüllt zu zählen. Kein Overlay, kein Widget, kein Cloud-Dienst.
Privacy
This plugin stores no personal data of your visitors and sends nothing anywhere.
What it stores in your own database: which pages were checked and when, which rules passed or failed, a short markup excerpt of each element a rule failed on, your verdicts on the guided manual checks, and the measures log. Two of those touch people, and both are handled deliberately:
- Markup excerpts have the values of form fields removed before they are stored: the value attribute, every data- attribute, the content of a textarea and the text of a selected option. The checkout renders the signed-in administrator’s own name and address into the markup, and a report that carried those into a support message would be the one path by which personal data could leave a server this plugin promises never to leave.
- The my-account screens are never checked automatically. The check runs in your own logged-in session, so those pages would render your name, your address and your orders into the stored excerpts. They belong to the guided manual checks, which you carry out signed out in a second browser.
Manual verdicts and log entries record WHICH user account made them (the user id and the display name), because a documented process has to say who did what. That is the same data WordPress already keeps for every post and comment.
Deleting the plugin keeps all of it unless you tick “remove all data on uninstall” beforehand.
Credits
This plugin bundles the axe-core accessibility engine by Deque Systems, Inc., unmodified, under the Mozilla Public License 2.0.
- Version: 4.10.3
- Source: https://github.com/dequelabs/axe-core/releases/tag/v4.10.3
- SHA-256 of the bundled assets/axe/axe.min.js: 880970c081707360e64f34cea25ff91892f5bc95675b0776925b9709dd8a68bb
- Source Code Form of that exact build: https://github.com/dequelabs/axe-core/tree/v4.10.3
As MPL-2.0 § 3.2 requires: the Source Code Form of the bundled file is the one linked above, at no charge.
The build refuses to make a release package when that fingerprint does not match — an engine that changed unnoticed is an engine whose results nobody can trace back to a published version. The license text ships in assets/axe/LICENSE.txt. German rule descriptions come from axe-core’s own locale files. All checking happens locally; the engine is never loaded from a CDN.
Screenshots
The dashboard: one figure for how the shop stands, and beside it what it is made of — findings still open, how many are critical, how many serious, and how much of the human judgement is done. Underneath, the date of the run those numbers come from.
All fifty criteria of WCAG 2.1 AA at a glance, each with its state. Thirty-four of them sit there unchecked because only a person can judge them; not one is quietly counted as met.
A report. Findings are grouped by rule and then by colour pair: the cause in plain words, the darker value to copy, a correction the plugin can apply itself, and every occurrence with the page it sits on and the ratio measured there.
The guided manual checks: the criteria no software can judge, each with the steps to check it, a verdict, and a note that goes into the record.
The measures log. It writes itself — every run, every correction switched on or off, every judgement — with who did it and when, and it downloads as a table.