Skip to content

Nat Tarnoff Posts

A11y 101: 2.1.2 No Keyboard Trap

Admiral Ackbar is letting us know something important. When we navigate by keyboard, we need to make certain of one thing. Make sure that a user doesn’t get trapped with no where to go.

This seems really simple, but it gets complicated quickly. And I know what seems simple to one person is traumatically difficult for another. Let’s talk about what a trap is, some examples, and ways to prevent them.

What is a keyboard trap?

A keyboard trap is any control that receives focus, but does not release it. Usually, the keyboard is trapped from moving in any direction. Sometimes it may be trapped in one direction, generally forward.

I’ve encountered some that prevent moving forward, but allow moving backward. Usually this presents a workaround, but not always. Even if there is a word around, it is still a violation.

Often developers will put a “forward” action on an input when the content meets a certain regex or pattern. This is difficult because the input is saying, “If I have 5 numbers, tab to the next control.” This becomes a keyboard trap as the keyboard only user cannot tab back into the field to correct it.

More common though is a disclosure control that isn’t following the <h3><button>Title</button><h3> pattern. Often the button is somewhere else or outside the heading. When the control is in focus, nothing happens.

How do we test?

If you do not need a screen reader to understand the screen, turn it off. If you require a screen reader, put it in forms mode. Forms mode will only respond to Tabbing and form control with the default keys. We don’t want interference from the AT.

Tab. Again. Shift tab. Keep using tab to navigate through the page, and do it in reverse. If you get stuck, try using the Escape key. Did that get you out? if yes, did it push you backwards or forwards?

If you find you can escape the trap, try repeating the situation in both directions multiple times. If you got out, this belongs in usability advice. If you can’t get out or can’t move in both directions, you have a violation.

What is the cause?

In most cases of keyboard traps, the cause is going to be JavaScript. Typically there is a function tied to the field being focused or activated. This can cause a race condition freezing the browser. More likely, there is function that prevents tabbing out, or the function tied to moving out is not firing.

Take the object where the keyboard trap is happening. Reproduce it locally, then start stripping back all that is tied to it. For example, if you are using custom dropdown, remove all the custom code. Begin with the base HTML <select> and <option> elements.

Is there still a keyboard trap? If you extracted all JS hooks and custom HTML, there should be no trap. Once we establish that the basic HTML works, let’s expose the custom HTML.

Hide any classes tied to JS functions. Remove data attributes. Get the JS out of the way. And try it again. Is it stuck now? Then it is time to examine out HTML again. No, then we slowly start adding in JS one item at a time until we find out trap.

Time to fix it

I cannot really tell you how long to remediate this would be. Everyone’s architecture is different and will cause different problems in different ways. But finding the trap’s location might take a day. Determining the cause could also take time, even for the most skilled developer. I recall early on spending 10 hours searching for an error in my code. It turned out to be the dreaded missing semicolon. It happens to all of us. Its about how do we fix it once we know of it.

Have questions? Come talk to me on LinkedIn or BlueSky!

2 Comments

Liquid Glass: Apple, you know better

Yesterday Apple unveiled their new design system, Liquid Glass. It is replacing the design we currently see in order to provide more design options to your device. The basic concept of liquid glass is that all UI will look like glass. This includes spectral aberrations, highlights, and shadows. All these elements are presented on a transparent background. The default font color looks adapts based on the background. Lighter backgrounds are supposed to show darker fonts, and dark background shows lighter fonts.They didn’t address what happens if the background has both.

Out of the box, this new design style presents accessibility issues. The contrast will rarely be correct for normal vision users to see, much less low vision users. Users can adjust this easily, and I expect Apple to respond with this as their “compliance” answer.

Three screen shots from iOS 26 and the Apple Liquid Glass design system. Screen one shows a lock screen with barely perceivable time. The second screen shows several widget blocks all highly transparent and hard to read text. The third shot is a web page where the text has shifted colors.

I feel this design style is incongruous with Apple’s recent GAAD announcement. And Apple knows this! They have experts on staff that can (and hopefully did) speak out against this.

Hostile much?

Am I being aggressive here? I hope not. I believe it is important to call out Apple on this. Apple is aware that the design styles they create will eventually take over design. It happened with the Mac, the iMac translucent back, and iMac swivel head. It also happened with MacBooks, the iPod, and the iPhone. Skeuomorphism is another example. Must I go on?

Unfortunately, Apple is more than a product company. They’re more than a software company. They’ve become a lifestyle company. They shift thinking. They spawn design thieves who make knock off products.

The federal government is taking actions that appear threatening to disabled people. Over the years, Apple, you have been doing a good job as an accessibility leader. We need you on our side now more than ever. Liquid Glass is not what we need in this moment.

Update 9.26.25

Apple has iOS 26.1 in developer beta and some of the concerns about Liquid Glass are being addressed.

See me on LinkedIn or Bluesky if you want to discuss this.

1 Comment

A11y 101: 1.4.13 Content on Hover or Focus

I’ll be honest, I often question if I’m evaluating this one right. Let’s look at what the text of 1.4.13:

Where receiving and then removing pointer hover or keyboard focus triggers additional content to become visible and then hidden, the following are true:

  • Dismissible: A mechanism is available to dismiss the additional content without moving pointer hover or keyboard focus, unless the additional content communicates an input error or does not obscure or replace other content;
  • Hoverable: If pointer hover can trigger the additional content, then the pointer can be moved over the additional content without the additional content disappearing;
  • Persistent: The additional content remains visible until the hover or focus trigger is removed, the user dismisses it, or its information is no longer valid.

Exception: The visual presentation of the additional content is controlled by the user agent and is not modified by the author.

Breaking this down, what does it mean?

I use my mouse or keyboard to focus on a control. When new content is exposed, I need to follow these rules.

Dismissable

I need to allow the user to dismiss this without moving the mouse or keyboard focus. OK, that is clear, but how do we do it? I can’t move the mouse, and I can’t move keyboard focus, then I need another action I can take. This is why we always implement the Escape key to close these exposed layers.

But here’s the trick…

If you hit ESC while one dialog is open, it will close. If you hit ESC while 2 or three are open, they will all close. For single page applications, or modal “sheets,” if users are several levels deep, they go back to the beginning when they hit ESC. You need to keep control of propagation as well as a track of which dialog opened which. As the user hits ESC, we need to stop propagation after closing the dialog. We also need to return focus to the control that opened it.

Hoverable

If I opened the new content with mouse, I also need to move around inside the new content. This does mean that when we are opening it, we are waiting for an exit event before we close it.

Now, that exit event could be a variety of things. Hitting ESC. Mousing over another control that exposes content. Clicking outside the container. The choices are many, but that it is clear how to do it is crucial.

Persistent

The best practice is to use an event tied to a button. This allows the keyboard user to activate the button to open it and close it. This also benefits users who rely on voice control. The mouse user can also open by clicking, or you can add hover to open the area. But mousing out on it’s own won’t close it. That needs another event that is clear the user is done with this object.

For me this is where I always got confused. What does it mean to be persistent? For how long? What if I click somewhere else on the page? Do I have to close the dialog before moving to some other control?

Persistent means once opened, it stays open until you close it. To close it you can do any of the following:

  • Escape key
  • Close button
  • Hover over another active control that exposes content
  • Click event elsewhere on the page
  • Activating a control inside the exposed content

Best practice: Use at least one in addition to the ESC key.

Have more questions? Want to discuss this? Find me on LinkedIn and BlueSky!

1 Comment

Quick Tip: Context is Key

Testing with Auto Scanning Tools

Many of the auto scanning tools on the market will flag for suspicious text on links and buttons. Sometimes the settings for that tool will flag long alternative text as well. Some look at short lengths. We flag character length because we can’t verify the item makes sense in context. This is something computers cannot do. Even with the best AI out there, computers can’t detect the intention of the control.

Comments closed

A11y 101: 1.4.12 Text Spacing

The internet is made for consuming content in two main ways:

  • Visually – reading articles, posts, and stories; watching video, short and long form, photographs, and animation
  • Audibly – listening to music, speech, screen (via assistive technology)

But the people using the internet don’t all follow the rules and need modifications. One area where we see a lot of modification for customer control is through the text layout. In some cases the issue could be the font, the font weight, or color that makes it difficult to read. Sometimes it’s just the spacing.

1 Comment

A11y 101: How to test manually

Too often, I see companies touting their high accessibility scores. They use tools like aXe Core, Lighthouse, Access Engine, or other free automated tools to derive them. But this only tells a part of the story, and it doesn’t even tell half of it. Let’s explore what is needed, why, and how we go about continuing the testing.

Important Disclosure

I work at Level Access. We have our own toolset that we use internally. While I work there, I try to remain agnostic in talking about tools and techniques.

Tools

Like any project, we need a few tools to help us do the job we’ll need.

  • Computing Device – This can be a Windows, Mac, iPhone, Android device, tablet, or even Linux. We can’t test websites without accessing them.
  • Screen reader – This will be device dependent. The Apple products have VoiceOver. Android has Talkback. For Windows, there is Narrator built in, JAWS, and NVDA. I recommend NVDA as it doesn’t lie and is free open source software. I also caution on relying on Narrator. It’s initial use was just to get someone to the point where they can download a “real” screen reader. Microsoft has continued to update it. It is acting more like a screen reader now. However, there’s still work to be done.
  • Browser – Unless you are working with VoiceOver, the recommended browser to use is Chrome. It has the largest market share and is at the tech edge of production browsers.
  • Spreadsheet – to log findings. Include columns for at least:
    • Finding description
    • Finding recommendation
    • Page found on (URL)
    • Guideline
    • Screenshot (I like to use ScreenCast for storing these images.)
    • Steps to reproduce
  • WCAG’s Quickref for the level I am testing against. I test to 2.2 A and AA as my standard.
  • Mouse
  • Keyboard (Doing a mobile audit? Use a Bluetooth keyboard without the screen reader.)
  • Automated tooling – It does help to run automatics at the beginning of an audit. It will reduce the time you spend documenting issues.
  • Contrast checker
  • Scope document
  • Objective of the audit

Setup

We’ve gathered our tools and we are ready to begin testing…or are we? The last two items I mention in the Tools section are a scope and objective. We need to know the objective of the audit. Is it to update their backlog with any accessibility issues? Is it because they need a VPAT? I ask these questions because it influences how I scope.

Scoping is an art to itself. I’ll give a brief overview here. The first part of scoping is understanding the objective and the primary flows.

Look at each primary flow. Are there shared experiences? Yes, we probably only need to test one. Do they use the same header or footer? That can be one unit to test as it is global. Identify patterns used the site and capture them. If pages use templates, say a product details page, capture one of each to test. A thorough audit will likely involve more than 10 pages or units to test. Most of my clients come in around 15-20.

If there is a need for a VPAT, we will add a few more pages. We want to make sure we capture a sample of everything. In the first audit style we may not look at the About Us, Contact, Terms & Conditions, etc. But with a VPAT to be authored, I would be reviewing these as well.

Setup your spreadsheet. I like to make pivot tables and drop downs for key sections. Like which guideline is involved, what disabilities are affected, anything where you will be repeating things from a limited collection.

Step 1 – Mouse

If your vision requires a screen reader, use it instead of the mouse.

Time to start testing. You have your scope. The key here is getting to know the site layout and functionality. Go through every single page in your scope with the mouse and only the mouse. Figure out what items are active controls and how they respond to the mouse.

Step 2 – Automatics

Now that I have familiarized myself with site, I run my automatic testing tools. Depending on the tool you use and how you have it configured, you’ll have a few ways to do this. Some tools look at one page and report findings back in the Chrome Developer tools. If they allow you to export them to a spreadsheet, collect that. You have one for each page tested to compile later. If it doesn’t export, you will need to manually copy them to your spreadsheet.

You may want to roll your own testing bot that can push content to a database. There are several free and open source tooling that will let you run a headless browser with Node.JS to make calls to pages and return the tested output. I’m now playing around with this for a different project.

Automatic tools at best cover 40% of all WCAG criteria. If a company says their AI enhanced tool does better, you may hit 50% coverage. This is because AI doesn’t understand intent, purpose, or how people think into account.

Review every automatic to make sure there are no false positives. Every company out there is saying they get fewer or no false positives. I have yet to find a tool that can honestly say “zero false positives.”

Step 2 – Keyboard

If your vision requires a screen reader, skip this step.

Keyboard testing is based off our mouse testing. We now want to navigate the site like we did in step one without the use of the mouse. We want to ensure that only active controls receive focus. We also check that controls can be used by the keyboard fully in their design. Log anything that doesn’t work properly with keyboard only. Log anything that gets focus, yet is a static element. Caveat – if the link is an in-page link and the target is static a tabindex of -1 is allowable. Repeat this until the page is completely reviewed.

Now you may want to move onto another screen, and that’s fine. Many folks like to go through a project with one tool, then the next. I test my projects by page or screen. So I go through all the steps on a screen, then mark the screen done. You do this as it best works for you.

Step 3 – Screen reader

Pick your screen reader. Remember, these are often device dependent. Repeat Step 2 with the screen reader on. Now, we are determining if the active controls have proper accessible names. Do the names include the visual text? Will they work with the screen reader?

Advice

Step 4 – Color contrast

Pick your picker! Until you are capable of computing contrast ratios with your own eyes, you will need a color contrast testing tool. There are dozens out there. My favorite is Level Access’s Accessible Color Picker. Before that it was Colour Contrast Analyzer.

Which one matters less than if it is giving you accurate ratios.

Advice

Step 5 – Reading level

You need to know the audience of the site or product you are testing. For instance, the targeted audience of this blog is people interested or involved in accessibility work. I have some basic posts, and some more advanced. My language is always meant to be as simple as possible. However, there are specific things I expect others in the domain to understand. One of these is the term WCAG.

Why do we need to know the audience? Because we need to check if the writing on the site is hitting the right audience.

For instance, providing a legal interpretation of a document. If the audience is other lawyers, you use one style. You include as much jargon and as many shortcuts as possible, because you expect them to know the domain.

If the audience is the general layperson, we need to write as if speaking to 13-year-olds. Our language should be clear and simple.

Over a decade ago, I wrote about this for the A11yProject.com. The post is still up and accurate. I’ll relist the resources for testing before the next step.

AI has many great features. One is its ability to identify when text should be simpler. I use it all the time to help clarify my writing. You may be able to use AI-based tools for this. It depends on your access to the admin portion or source code.

Resources:

Step 6 – WCAG SC

When it seems that I have completed my testing, I bring out the WCAG Quickref again. One by one, I read each guideline’s purpose and understanding. For each one, I’ll think through if I might have missed this in my testing. I check each page in scope and log anything I forgot to log earlier.

Follow Up

Now what do you do? Well, this depends on your contract. Good things to do with your client are review the list. Pull out 5-10 of the most important issues. Explain why you pulled them, their impact to users, and how to fix them. Leave them with a priority list of fixes. You could complete a VPAT and issue an ACR. You can work with their team on remediation efforts.

You don’t want to leave the client hanging. Don’t just log 100 or more bugs and walk away. Because next year when they update the product, they’ll need more testing. When they roll out a new product, they will need more testing. Help the client improve through training, fixing, or guiding them.

Don’t do this for free either. When I was independent, I would charge for the evaluation based on scope, not hours. But I’d also put in a recurring monthly support charge. This included 5 – 10 hours monthly paid up front. It is a retainer I take regardless if they use that support. If the time used in a month exceeds the retainer, that gets added to the next invoice. But now we’re entering business practices and that is a different blog post.

Happy Global Accessibility Awareness Day (GAAD)! Have questions or want to discuss this, hit me up on LinkedIn and BlueSky.

A little bonus – Level Access has a lot going on today if you’d like to check out training.

1 Comment