Website compliance review sample report
This complete fictional report shows the format your team can use to assign and check fixes. It requires tailoring and responsible review.
No real website or customer was assessed. The report, evidence references, and retest observations are invented.
The sample and customer reports use the same report renderer and content structure.
Document control
- Reference
- BCT-FICTIONAL-2026-001
- Version
- 1.1
- Prepared on
- 2026-10-26
- Organization
- Fictional Example Outdoor Co.
- Reviewer
- Victor Humenhuk, Reviewer
- Classification
- Fictional sample. Requires tailoring.
Source information
Fictional example requiring tailoring. Every website observation and evidence reference is invented. No real organization was assessed.
Summary
11 findings: 4 high, 4 medium, 3 low priority.
Fix these 4 high-priority findings first. They affect customers most directly or carry the clearest risk.
| ID | Area | Recommended fix |
|---|---|---|
| AC-01 | Accessibility | Keep focus within the open dialog and return it to the initiating control when closed. |
| PV-01 | Privacy and tracking | Identify the request purpose and applicable rules, then retest the agreed consent behavior. |
| PR-01 | Pricing and subscriptions | Show $0 for 14 days, then $29/month beside the signup button. |
| CJ-01 | Customer journeys | Repair the destination and retest the complete signed-in and recovery paths. |
Scope
Fictional Complete review of one US-facing outdoor equipment store in English. This illustrates all eleven review areas; it is not a real completed assessment.
The sample covers ten invented public pages, five policy pages, two customer journeys, five representative templates, two documents, five message types, ten claims, and five approved paired regional pages. All page and evidence references are invented.
The scope includes passive HTTPS and security header observations on ten invented URLs and search and loading observations on five invented pages.
Method
Agree on the website, representative pages, customer journeys, evidence, and access before review. Record the observation date, viewport, and relevant state for each capture.
Compare the policies and offer promises with the observed customer experience. Check the agreed accessibility interactions, consent behavior, price disclosures, messages, identity, claims, regional consistency, public security settings, and search basics.
Retain an evidence reference with each finding. Explain the customer impact and a recommended fix. Priority describes the practical review order, not a legal finding. This fictional sample does not cite law to establish a breach.
Finding index
| ID | Area | Priority |
|---|---|---|
| PO-01 | Policies | Medium |
| AC-01 | Accessibility | High |
| PV-01 | Privacy and tracking | High |
| PR-01 | Pricing and subscriptions | High |
| CJ-01 | Customer journeys | High |
| PC-01 | Post-purchase communication | Medium |
| BI-01 | Business identity and contact | Medium |
| MC-01 | Marketing claims | Medium |
| LR-01 | Language and regional consistency | Low |
| SC-01 | Public security configuration | Low |
| PS-01 | Performance and search basics | Low |
PO-01 Policies
| Field | Record |
|---|---|
| Observed | The refund policy allows 30 days; the checkout FAQ allows 14 days. |
| Evidence reference | Fictional capture PO-01. No real website tested. |
| Customer impact | Customers receive conflicting refund information. |
| Recommended fix | Agree on the applicable period and use it consistently. |
| Priority | Medium |
AC-01 Accessibility
| Field | Record |
|---|---|
| Observed | Keyboard focus leaves the checkout dialog while it remains open. |
| Evidence reference | Fictional capture AC-01. No real website tested. |
| Customer impact | Keyboard users can lose their place and miss checkout controls. |
| Recommended fix | Keep focus within the open dialog and return it to the initiating control when closed. |
| Priority | High |
PV-01 Privacy and tracking
| Field | Record |
|---|---|
| Observed | A third-party advertising request loads before a choice is recorded in the tested session. |
| Evidence reference | Fictional capture PV-01. No real website tested. |
| Customer impact | The observed request may conflict with the stated consent behavior. |
| Recommended fix | Identify the request purpose and applicable rules, then retest the agreed consent behavior. |
| Priority | High |
PR-01 Pricing and subscriptions
| Field | Record |
|---|---|
| Observed | The trial page says $0 today; the $29 monthly renewal appears only in the terms. |
| Evidence reference | Fictional capture PR-01. No real website tested. |
| Customer impact | Customers may begin a trial without seeing the recurring charge. |
| Recommended fix | Show $0 for 14 days, then $29/month beside the signup button. |
| Priority | High |
CJ-01 Customer journeys
| Field | Record |
|---|---|
| Observed | The mobile cancellation link opens an expired account recovery screen. |
| Evidence reference | Fictional capture CJ-01. No real website tested. |
| Customer impact | Customers cannot reach the cancellation task through the tested path. |
| Recommended fix | Repair the destination and retest the complete signed-in and recovery paths. |
| Priority | High |
PC-01 Post-purchase communication
| Field | Record |
|---|---|
| Observed | The welcome email describes annual billing after a monthly purchase. |
| Evidence reference | Fictional capture PC-01. No real website tested. |
| Customer impact | The message contradicts the agreed billing interval. |
| Recommended fix | Use the purchased plan and interval in the confirmation. |
| Priority | Medium |
BI-01 Business identity and contact
| Field | Record |
|---|---|
| Observed | The footer support address differs from the refund page address. |
| Evidence reference | Fictional capture BI-01. No real website tested. |
| Customer impact | A refund inquiry may reach the wrong destination. |
| Recommended fix | Confirm and publish the monitored address consistently. |
| Priority | Medium |
MC-01 Marketing claims
| Field | Record |
|---|---|
| Observed | A security badge appears without an issuer or supporting record. |
| Evidence reference | Fictional capture MC-01. No real website tested. |
| Customer impact | Visitors cannot verify what the badge represents. |
| Recommended fix | Provide the current supporting record or remove the badge. |
| Priority | Medium |
LR-01 Language and regional consistency
| Field | Record |
|---|---|
| Observed | The approved translated returns page shows a different deadline from the English page. |
| Evidence reference | Fictional capture LR-01. No real website tested. |
| Customer impact | Customers see different conditions depending on the selected language. |
| Recommended fix | Confirm the approved condition and correct the paired translation. |
| Priority | Low |
SC-01 Public security configuration
| Field | Record |
|---|---|
| Observed | The tested HTTPS page has no observed HSTS header. |
| Evidence reference | Fictional capture SC-01. No real website tested. |
| Customer impact | The response does not announce a browser HTTPS-only policy. |
| Recommended fix | Assess the HTTPS deployment and introduce an appropriate HSTS policy after testing. |
| Priority | Low |
PS-01 Performance and search basics
| Field | Record |
|---|---|
| Observed | The main product page declares another product page as canonical. |
| Evidence reference | Fictional capture PS-01. No real website tested. |
| Customer impact | Search engines receive a conflicting preferred URL. |
| Recommended fix | Confirm the intended canonical and align the page and sitemap. |
| Priority | Low |
Retest record
The agreed retest covers up to ten original findings and must be requested within 60 days. New pages and issues require a separate scope.
Retest PR-01
| Field | Record |
|---|---|
| Status | Fictional resolved observation |
| Observation | The invented signup page now shows the trial and renewal price beside the button. This does not determine legal compliance. |
| Evidence | Fictional retest capture RT-01. |
Retest AC-01
| Field | Record |
|---|---|
| Status | Fictional unresolved observation |
| Observation | Keyboard focus still leaves the invented checkout dialog. |
| Evidence | Fictional retest capture RT-02. |
Review limits
This report records observations within its agreed sample and evidence. It is not legal advice, a legal opinion, or compliance certification. Your team decides and implements changes.
A sampled accessibility review does not establish full WCAG conformance. Privacy checks do not assess an entire data protection program. Security checks exclude penetration testing.
Choose a review
Complete review with one retest. Core review.
Request a review. We confirm the scope by email, then send an invoice or payment details.