Know what runs on your checkout. And who can't use it.

No. StoreSweep keeps the records Requirements 6.4.3 and 11.6.1 ask for: the script inventory with authorizations, and the dated change-detection trail. Your SAQ is still yours and your processor's, and the other requirements are still your responsibility.

No, and be wary of anyone who says otherwise. Automated testing against WCAG 2.1 AA finds a real portion of accessibility problems, not all of them. What StoreSweep gives you is the machine-checkable part, checked every week, with a dated record of what was found, what got fixed and what you decided to accept and why. An audit by a specialist and testing with real assistive technology are still worth doing. This is what keeps the ground from moving under them.

Form fields with no label, controls with no name a screen reader can announce, images with no alt text, colour contrast below AA, focus order, landmarks, and the other criteria automated tools detect reliably. We run axe-core on all five pages of the purchase path, not just the home page, because the checkout is where a barrier costs you the sale.

Whether alt text is meaningful, or whether a flow makes sense to someone using a screen reader, needs a person. Those are listed separately in your pack as items for manual review, so a consultant knows where to start.

We report what we observe about how card entry is served on your checkout: an iframe from your processor, a redirect, or fields on your own page. The SAQ determination itself is made by you and your acquirer. The evidence pack records the observation so that conversation is shorter.

Because an audit is a photograph and a store is a film. A theme update, a new plugin, a seasonal banner or a checkout change can reintroduce a barrier the week after the report lands, and nobody finds out until a shopper gives up. Monitoring is what turns that audit into something you can still stand behind a year later, with the dates to show it.

Never. The scanner adds one item to the cart with your own add-to-cart control and loads the checkout page. It types nothing into any field and never submits a form. The cart it creates is abandoned like any other.

Then we can't monitor it, and we say so. The scanner identifies itself and never tries to look like a person, so a bot wall or a CAPTCHA on the checkout stops it. Most stores can allow a named User-Agent through their bot protection; we tell you exactly what to allow.

WooCommerce, Shopify and BigCommerce, and most custom carts. If a shopper can reach your checkout by clicking, the scanner can too. The free scan is how we find out for your store.

No. Nothing alerts off one scan. A difference is re-scanned within the hour and reported only if the second scan shows it too. Confirmed changes on the payment page and new critical failures on cart or checkout alert immediately. Everything else waits for the weekly digest.

Yes. Agency tiers cover 25 or 100 sites with a per-site cadence, and the evidence packs are white-labelled with your name and logo. Each client's records stay separate and can be exported to them if they leave you.

Any time. Monitoring stops at the end of the period you paid for. Your records are exported to you, and we keep them available for 90 days after the account closes in case you need a pack.