Glossary

About Octopus Scanner

Plain definitions of the accessibility, reporting and product terms used in Octopus Scanner and across these guides.

1. Accessibility and standards

Accessible name
The name that assistive technology announces for an element, such as a button, link or form field. It usually comes from the visible text, a label or an ARIA attribute. Buttons and links with no accessible name are among the most common findings.
ARIA
Accessible Rich Internet Applications, a W3C specification of roles, states and properties that tell assistive technology what a custom control is and what it is doing. Automated rules can detect invalid or misused ARIA, but not whether a component behaves as its role describes. See Scope of Automated Testing.
Assistive technology
Software or hardware that people use to access a computer in a way that suits them, such as screen readers, screen magnifiers, switch devices and voice control. Testing with assistive technology is part of the manual testing that a scan can't replace.
Automated testing
Checking pages with rules that code can evaluate, such as whether an image has a text alternative or text meets a contrast ratio. It finds a portion of accessibility issues, not all of them, and a clean report isn't proof of compliance. See Scope of Automated Testing.
axe-core
The open-source accessibility rules engine, maintained by Deque Systems, that produces Octopus Scanner's findings. A copy ships with the app and runs inside Chrome on your computer. A newer version is installed only after you approve its update notice.
axe rule
A single check in axe-core, such as the rule that every image needs a text alternative. Each issue type in a report is one axe rule, and you can turn rules off or run only the rules you choose under Axe Scan Rules.
Contrast ratio
A measure of the difference in brightness between text and its background, from 1:1 to 21:1. WCAG Level AA asks for at least 4.5:1 for normal text and 3:1 for large text. Contrast over images or gradients can't be measured reliably, so it appears under Needs Review.
Landmark
A region of a page, such as the header, navigation, main content or footer, that screen reader users can jump between. Force-Reveal Hidden Content helps prevent false "missing landmark" reports on animated sites.
Level A, AA and AAA
The three conformance levels of WCAG. Level A covers the most basic requirements, Level AA is the level most laws and policies ask for, and Level AAA is the strictest. Scans test WCAG 2.0, 2.1 and 2.2 at Levels A and AA, plus Best Practice, by default.
Manual testing
Checks a person carries out, such as using a page with only the keyboard, listening to it with a screen reader, zooming to 400% and judging whether text alternatives are accurate. After Your Scan lists the checks to do next.
Screen reader
Assistive technology that reads the content of the screen aloud or sends it to a braille display, such as VoiceOver on macOS or NVDA on Windows. Whether a page makes sense with a screen reader can only be confirmed by testing with one.
Success criterion
A single testable requirement in WCAG, such as 1.4.3 Contrast (Minimum). Each issue mapped to WCAG names its success criterion and links to the official W3C Understanding page. See Report Anatomy.
WCAG
The Web Content Accessibility Guidelines, published by the W3C and the basis of most accessibility laws and standards. Octopus Scanner can test against WCAG 2.0, 2.1 and 2.2. See Scope of Automated Testing.

2. Report and findings

Approve
A report control that confirms a Needs Review item is a real problem. The item moves into its severity group and every figure in the report updates. See Report Anatomy.
Companion CSV
The CSV file created alongside every HTML report, listing every instance in full even when the HTML report keeps fewer. It shares the HTML report's file name, with .csv in place of .html. See Report File Formats.
Critical
The highest axe-core impact level. Critical issues are the most likely to stop someone using a page at all, such as a button with no name. Fix these first.
CSV report
A spreadsheet file listing every instance found. Every HTML scan also produces a companion CSV. You can also choose CSV as the only report format. See Report File Formats.
Instance
One occurrence of an issue type on one element of one page. A single issue type can have hundreds of instances, which often share one fix in a shared component.
Issue type
A distinct problem found by one axe rule, grouping all of its instances across the pages scanned. The At a Glance bar and the severity tabs count issue types, with the number of instances alongside.
LLM Review
A report section of possible issues suggested by Local LLM Review. They aren't confirmed issues: Approve moves an item into its suggested severity group, and Remove removes it from the report. It appears only when Local LLM Review is turned on and the model suggested something. See Local LLM Review.
Minor
The lowest axe-core impact level, for problems that cause some inconvenience but are unlikely to stop someone completing a task.
Moderate
The axe-core impact level between Serious and Minor, for problems that make a page harder to use for some people without usually blocking them.
Move To
A report control that changes the severity of an issue. The issue moves to the chosen group, and every count, tab and chart updates.
Needs Review
Findings axe-core can't confirm automatically, such as text over a background image, kept in their own tab for a person to assess. They appear only when Include Needs Review Section is turned on, which is off by default. See After Your Scan.
Remove
A report control that discards a Needs Review item that doesn't apply. The item also leaves CSV and JSON exports made from the report.
Review priority
How soon to check a Needs Review item by hand, shown as High, Medium or Low in tickets and on Needs Review items. It reflects how serious the issue would be if confirmed, not how likely it is to be real, because the rules engine couldn't decide either way.
Selector
The CSS selector that identifies the exact failing element on the page. Use Copy Selector on an instance to find the element in your browser's developer tools. Issues inside frames name the frame as well as the element.
Serious
The axe-core impact level below Critical, for problems that cause significant difficulty and can block some people. Fix these after Critical issues.
Skipped page
A page the scanner found but didn't audit, for example because robots.txt disallows it, it matches an exclusion pattern or it isn't an HTML page. Skipped pages are listed in the report with their reason and a category, such as Bot protection, HTTP error or Caps and duplicates. See Messages and Skipped Pages.
Ticket
A structured write-up of one issue, opened with View Ticket, with its description, why it matters, how to fix it, the WCAG criterion, steps to recreate it, affected pages, environment, review priority for Needs Review items and screenshots. Its ticket severity is based on the WCAG level it fails or, for best-practice rules, on its impact. See Report Anatomy.

3. Scanning features

Crawl
Following links from the starting page to discover more pages to scan. Max Crawl Depth, Crawl Delay, Exclude URL Patterns and the other limits are under Crawl Options.
Dark Mode Auditing
A second audit of each page in its dark colour scheme, turned on with Scan Dark Mode, which is on by default. It runs only when the page actually responds to the system dark-mode preference, and issues found only in dark mode are badged in the report.
Deduplication
Skipping pages that would repeat work already done, for example by canonical URL or content fingerprint, and capping repeated pagination, filter and sort, search, locale and section variants. It is controlled by Apply Smart Dedup & Coverage Caps, and every skipped page is recorded in the report with its reason.
Deep Scan
The setting Enable Content Interaction (Deep Scan), which selects tabs, accordions and other interactive elements to reveal and scan content hidden when the page loads. Buttons that look like they would log out, delete, buy, pay or submit something, among others, are never selected. Off by default.
Force-Reveal Hidden Content
The setting Force-Reveal Hidden Content For Scanning, which makes fade-in and scroll-triggered content render and expands accordions, tabs and details elements before the audit. On by default. See Scan Behaviour.
Iframe and frame
An element that embeds another document inside a page, often from another site, such as a video player or map. Scan Iframes, on by default, audits their content, and frames that couldn't be reached are reported as not tested. See Troubleshooting Guide.
Interactive Mode
A way of scanning in which you browse the site yourself in a visible browser and select Scan in its control panel to capture specific states, such as an open menu. Not available with Parallel Processing.
Local LLM Review
An optional feature, off by default, that asks a large language model (LLM) you run on your own computer or local network for a second opinion on axe-core findings and for suggestions of issues axe-core can't detect. Cloud AI providers aren't accepted, and its findings are suggestions, not confirmed issues. See Local LLM Review.
Max Crawl Size
The total number of unique pages allowed in a single report. Default 1,000. Only pages actually taken on for scanning count towards it.
Parallel Processing
Scanning several pages at once in separate browser tabs, turned on with Enable Parallel Processing. While it is on, Interactive Mode, User Journey and Pause are unavailable.
Route capture
Recording the addresses a single-page application moves to without loading a new page, so they can be added to the pages to scan. It is part of how Octopus Scanner discovers pages that standard links don't reveal.
Shadow DOM
A separate, encapsulated part of the page used by web components to hold their own markup. Octopus Scanner audits content in open shadow roots, and Deep Scan can select controls inside them.
Single-page application
A website that changes its content and address with JavaScript instead of loading a new page for each view. Octopus Scanner follows these route changes to find pages that have no ordinary link.
Sitemap
An XML file listing a site's pages. Give its address in Sitemap XML URL and the scanner reads it, including gzipped and nested sitemaps, to build the list of pages to scan. See Target & Scope.
Smart Crawl
The setting Enable Smart Crawl, which skips addresses that look like crawler traps, such as endless calendars or faceted filters, and samples pages that are near-duplicates of a page already scanned. On by default.
Stealth Mode
A setting that hides automation signals and presents the scan as an ordinary copy of Chrome on your computer, so scans are harder for bot protection to single out. On by default. See Troubleshooting Guide.
Two-phase scanning
When Force-Reveal Hidden Content expands content, the page is audited in both its expanded and collapsed states, and the results are merged so nothing is reported twice.
User Journey
A recorded or hand-built sequence of steps, such as clicks, typing and key presses, that the scanner replays during the scan. It must include at least one Scan Page step, which runs an audit at that point. See Target & Scope.
Viewport
The visible area of the browser, set to a screen size or device. By default each page is scanned at Desktop (1280x800) and Mobile (375x667), and Scan All Viewports adds Large Desktop and Tablet. See Viewport & Device.
Visual Scanner Progress
A dropdown in the scanning interface that shows a live view of the scanning browser, so you can check where the scan is. Available for HTML reports with screenshots turned on.

4. The app

Configuration
A named set of scan settings, saved under Save & Load Configurations so you can run the same scan again, or exported as a JSON file to share. Sensitive Values are never saved. See Save & Load Configurations.
Connection Recovery
An option in Preferences that pauses a scan while the network connection is down and resumes it when the connection returns. On by default, and a change applies the next time the scanner starts. See Preferences: Options.
Dependency Patching
Installing updates to the components the scanner runs on between releases, once each has passed the waiting period and safety checks. This is how Octopus Scanner is maintained each month, and you can revert at any time. See Dependency Patching and How Octopus Scanner stays up to date.
Idle Screen
An optional display that covers the screen after a period of inactivity, showing scan progress or the time and date. It isn't a lock screen. Off by default. See Preferences: Idle Screen.
Octopus Server window
The desktop window that runs the scanning engine. It shows the engine status, CPU, RAM and Disk use and the System Activity log, and holds Open Interface, Restart Scanner when the engine has stopped and Preferences. See The Octopus Server window.
Scanning interface
The window where you enter a website address, choose settings and start a scan. Open it with Open Interface in the Octopus Server window. See Main controls.
Show All Settings
A button under Options in the scanning interface that shows the advanced settings hidden by default.
Updated components
Dependencies or a Node.js runtime that you have updated since your version of Octopus Scanner was released, through Dependency Patching or Node Runtime. They keep the app current, and everything works as usual while they are in use. Revert in Preferences > Options > Advanced returns to the components this version shipped with. See Updated components and Revert.

5. Security and privacy

Component Safety Check
A check of the components the scanner runs on against osv.dev, a public database of malicious packages and security advisories that includes the OpenSSF list of malicious packages, every time Octopus Scanner starts and once a day while it stays open. Component updates are also checked before they are installed. Only component names and versions are sent. See Component Safety Check.
Gatekeeper
The macOS feature that checks apps downloaded from the internet. Because Octopus Scanner isn't notarised, Gatekeeper blocks it the first time you open it. See Security Warnings Guide.
Integrity hash
A SHA-256 hash shown in the footer of every HTML report, identifying the exact file Octopus Scanner produced. CSV and JSON reports don't have one. A copy that is edited or saved again with Save & Download HTML keeps the original hash, so it no longer matches the file. See Report File Formats.
Local processing
All scanning, analysis and reporting happen on your own computer. Page content, findings and screenshots are never uploaded by the app. The only exception is the optional Local LLM Review, which, if you turn it on, sends page details to an LLM server you run on your own computer or local network. See Data, Privacy & Security.
Offline Mode
An option in Preferences > Options > Advanced that stops Octopus Scanner contacting the internet on its own, turning off update checks and the Component Safety Check. Scans still reach the sites you scan. Off by default.
SHA-256
A hash, or fingerprint, of a file. Compare the SHA-256 value of your download with the one on the Download page to confirm the file hasn't been altered. See Security Warnings Guide.
SmartScreen
Microsoft Defender SmartScreen, the Windows feature that warns about apps from unverified publishers. Once you have checked the file, select More info, then Run anyway. See Security Warnings Guide.
Unsigned app
An app not signed with a verified developer certificate. Octopus Scanner is unsigned and not notarised, so Windows and macOS warn that its publisher is unverified, not that it contains malware. See Security Warnings Guide.
Waiting period
How long an update must have been public before Octopus Scanner offers it: 7, 14 or 30 days. 14 days is the default and is recommended, giving the community time to spot problems. It applies to dependency and Node.js runtime updates. axe-core engine updates are offered as soon as they are released. See How Octopus Scanner stays up to date.

Was this page helpful? Email your feedback.