Download the data
The whole result set, including every entity that could not be scanned, as CSV and JSON under CC BY 4.0.
Latest run
- a11yscan-gov-index-2026-08-08.csv — CSV, one row per entity, 300 rows, 107,871 bytes
- a11yscan-gov-index-2026-08-08.json — JSON, full per-rule detail, 300 rows, 525,702 bytes
- latest.csv — CSV, stable URL for the newest run, 300 rows, 107,871 bytes
- latest.json — JSON, stable URL for the newest run, 300 rows, 525,702 bytes
Available runs
| Run | Domain type | Scan dates | Rows | Analyzed |
|---|---|---|---|---|
| 2026-08-state | State or territory | 2026-08-08 to 2026-08-09 | 300 | 155 |
Licensing and attribution
Our measurements are published under CC BY 4.0. Use them for anything, including commercially, with attribution: “a11yscan .gov accessibility index (althor.dev), CC BY 4.0.”
The entity list itself is not ours. It comes from CISA's cisagov/dotgov-data registry, which is CC0 1.0 (public domain). The registry columns we redistribute (domain, domain type, organization, city, state) are public domain; the scan measurements attached to them are ours and are the CC BY 4.0 part.
Fields
| Column | Meaning |
|---|---|
domain | The .gov domain, from the registry. |
domain_type | Registry Domain type: State or territory, County, City, Special district. |
organization | Registry Organization name. |
suborganization | Registry Suborganization name, often empty. |
city | Registry City. |
state | Registry State, a two-letter code. |
run_key | The run this measurement belongs to. |
scanned_at | UTC timestamp of the scan attempt. |
outcome | ok, skipped_robots, dns_failure, connection_failed, http_error, blocked, timeout, or scan_error. Anything other than ok means no measurement was taken. |
contacted | false when the host was not contacted in this run because it had already failed repeatedly; the row then carries the last known failure forward. Never false on an ok row. |
attempts | Attempts made in this run, including the first. 0 when contacted is false. |
detail | Plain-English cause for a non-ok outcome; empty when outcome is ok. |
http_status | HTTP status of the homepage response, empty when no response arrived. |
final_url | The URL actually scanned, after redirects. |
scan_duration_ms | Wall time for the attempt. |
scanner_version / cli_version / axe_core_version | The batch scanner, the a11yscan CLI it shares its engine with, and the axe-core build that produced this row. |
registry_sha256 / registry_fetched | The CISA registry snapshot this entity was drawn from. |
critical_count / serious_count / moderate_count / minor_count | Distinct axe-core rules violated at each impact level. Zero for every non-ok outcome, because no measurement exists for those. |
rule_count | Total distinct rules violated. |
node_count | Total failing elements across all violated rules. |
passes_count / incomplete_count | axe rules that passed, and that need human review. |
violated_rules | Semicolon-separated ruleId:elementCount pairs, e.g. color-contrast:14;link-name:3. Empty when nothing was violated. |
Reading it honestly
The file contains all 300 entities in the cohort, not just the 155 we could analyze. Filter on outcome = 'ok' to get the measured population, and compute the scanned-versus-attempted rate from the same file rather than assuming the rows you see are the rows we tried. Entities that were blocked, timed out, or disallowed us carry zeros in every count column because no measurement exists, not because they were clean, and any rate you compute should exclude them from the denominator.
The cohort is a sample drawn for jurisdictional coverage, described in full on the methodology page along with the seed needed to reproduce it. It is not population-weighted, it is not a census of the registry, and it does not support ranking jurisdictions against each other. The dataset contains automated axe-core observations and nothing else: no assessment of any organization's compliance, exposure, or obligations.
These results come from one automated pass with axe-core. Automated testing detects a subset of WCAG issues; a page with no detected violations has not been shown to conform to WCAG 2.1 Level AA, and a page with detected violations has not been shown to violate any law. This is a dated measurement, not a legal determination and not a certification.