missing-error-messages
Critical WCAG 3.3.1What it is
When a form is submitted with invalid or missing data, no error message is shown anywhere in the DOM. The submission fails silently, leaving users with no indication of what went wrong or how to fix it.Why it matters
Without error feedback, users cannot complete the form. This directly blocks task completion for all users — and for screen reader users, even a generic error message is critical since they cannot visually scan the form for visual error indicators.How QAOS detects it
The agent submits forms with required fields left empty or with invalid data, then scans the DOM for any error message elements — including messages in separate<div> elements, data-validation-message attributes, or ARIA live regions.
Examples
How to fix
Display at least one error message when form validation fails. The message should indicate which fields are invalid and what the user needs to do:error-not-visible
Critical WCAG 3.3.1What it is
Error message elements exist in the DOM after a failed submission, but they are hidden via CSS (display: none, visibility: hidden, opacity: 0, or off-screen positioning) and never appear to the user.
Why it matters
This is a particularly confusing failure state: the application generates error information but suppresses it. Users see nothing, have no way to correct their input, and cannot complete the form.How QAOS detects it
After submitting a form with invalid data, the agent checks whether error-related elements exist in the DOM but are hidden by CSS properties that prevent them from being visible.How to fix
Ensure error message elements are visible when validation fails:required-field-not-marked
Medium WCAG 3.3.2What it is
Form fields that are required (via therequired attribute or server-side validation) are not visually indicated as required — no asterisk, no label, no visual cue that helps users understand which fields must be completed before submission.
Why it matters
Users who don’t realize a field is required often skip it, experience validation errors, and feel frustrated. Clear required field indicators reduce form abandonment.How QAOS detects it
The agent identifies<input required> or validated fields that lack any visual indicator (asterisk in label, “required” text, or similar convention).
Examples
How to fix
Mark required fields visually with a consistent indicator (typically*). Include a legend near the top of the form explaining the convention. Use aria-required="true" on the input for screen reader users.
error-not-associated
Low WCAG 1.3.1What it is
Error messages are displayed after a failed submission but are not programmatically linked to the field they describe. The message appears visually near the field but lacksaria-describedby or aria-errormessage linking them.
Why it matters
Screen readers announce input fields by reading their label and any programmatically associated descriptions. Withoutaria-describedby, a screen reader user focusing on a field will not hear the associated error message unless they navigate away to find it.
How QAOS detects it
After submitting invalid data, the agent checks whether fields with visible error messages have correspondingaria-describedby or aria-errormessage attributes pointing to the error element.
How to fix
Link error messages to their fields usingaria-describedby:
placeholder-as-label
Medium WCAG 1.3.1What it is
An input field relies solely on placeholder text to communicate its purpose. There is no visible<label> element, aria-label, or aria-labelledby attribute associated with the field.
Why it matters
Placeholder text disappears as soon as the user starts typing, leaving the field with no label at all. Users who navigate back to a partially filled form see unlabeled fields and cannot recall what they entered. Screen readers also handle placeholders inconsistently — some announce them, others do not.How QAOS detects it
The agent identifies input fields that have a placeholder attribute but no programmatic label association.Examples
How to fix
Always provide a persistent visible label. Use placeholder text only as a supplementary hint, never as the primary label.form-no-submit-button
MediumWhat it is
A form element contains no visible submit button or equivalent (<button type="submit"> or <input type="submit">), making it impossible to submit via keyboard without relying on the Enter key in a text field.
Why it matters
Keyboard-only users and assistive technology users expect a clearly labeled action to submit a form. A form without a submit button is also non-standard and can confuse users who don’t know the Enter-key shortcut.How QAOS detects it
The agent scans form elements for the absence of any submit button or equivalent interactive control that would submit the form.How to fix
Every form should have an explicit submit button:select-missing-label
Medium WCAG 1.3.1What it is
A<select> element has no associated label — no <label for="...">, aria-label, or aria-labelledby — making its purpose opaque to screen readers.
Why it matters
Screen readers announce form controls by reading their label. A<select> without a label is announced only as “combo box” or “list box” with no indication of what the user is selecting.
How QAOS detects it
The agent scans the DOM for<select> elements without a programmatically associated label.
Examples
How to fix
Associate every<select> with a visible label using <label for="...">. If a visible label is not possible, use aria-label:
copy-paste-blocked
MediumWhat it is
An input field (commonly a password confirmation or OTP code field) blocks paste operations, forcing users to type content manually even when they have it copied to the clipboard.Why it matters
Blocking paste discourages the use of password managers (which paste strong, unique passwords), forces users to retype complex credentials (increasing errors), and provides no real security benefit. NIST guidelines explicitly recommend allowing paste in password fields.How QAOS detects it
The agent attempts to paste into input fields using keyboard and programmatic methods and checks whether the paste is suppressed.How to fix
Remove anyonpaste="return false" or paste event listeners that call preventDefault():
input-missing-type
LowWhat it is
An<input> element has no type attribute. The browser defaults to type="text", which may not match the intended data type, missing semantic benefits like numeric keyboards on mobile and built-in validation.
How QAOS detects it
The agent scans the DOM for<input> elements with no type attribute.
Examples
How to fix
Always set an explicittype attribute on every input to get the correct keyboard on mobile, built-in browser validation, and clear semantic meaning.
missing-autocomplete
Low WCAG 1.3.5What it is
Personal data fields — name, email, phone number, address — lack theautocomplete attribute, preventing browsers and password managers from filling them automatically.
Why it matters
Autocomplete saves significant time for users, especially those with motor impairments who find typing difficult. It also improves accuracy by reducing manual entry errors.How QAOS detects it
The agent scans form fields for personal data inputs (by name, type, or label text) that lack theautocomplete attribute.
How to fix
Add the appropriateautocomplete token to personal data fields:
password-no-visibility-toggle
LowWhat it is
A password input field has no show/hide toggle, making it impossible for users to verify what they’ve typed without external tools.Why it matters
Password masking causes typing errors. Without a visibility toggle, users cannot verify their password, leading to failed logins or mismatched password confirmation fields. This is a common usability issue that discourages use of strong passwords.How QAOS detects it
The agent scans the DOM for<input type="password"> elements and checks whether a toggle button is associated with them.
How to fix
Add a toggle button that switches the input betweentype="password" and type="text":
character-count-missing
LowWhat it is
A text input or textarea with a character limit (maxlength) shows no visible character count or remaining-characters indicator, leaving users unaware of the limit until they hit it.
How QAOS detects it
The agent identifies<input> or <textarea> elements with a maxlength attribute and checks whether a character counter is visible near the field.
How to fix
Display a live character count that updates as the user types:ambiguous-date-format
LowWhat it is
Dates are displayed or expected in an ambiguous format — such as01/02/2024 — that could be interpreted differently depending on locale (MM/DD vs DD/MM).
Why it matters
A date like04/05/24 means April 5th in the US and May 4th in Europe. Ambiguous dates lead to booking errors, missed deadlines, and user confusion in international contexts.
How QAOS detects it
The agent scans date display text and date input placeholders for numeric date formats without an unambiguous structure.How to fix
Use unambiguous date formats that don’t rely on locale conventions:<input type="date"> (the browser renders a locale-appropriate picker) or include an explicit format label:
empty-state-missing
LowWhat it is
A dynamic content list — such as a comments section, inbox, notifications panel, or search results — is empty and shows only blank space with no message explaining the empty state.Why it matters
Blank space where content is expected looks like a loading failure or rendering bug. Users don’t know whether the list is genuinely empty, still loading, or broken. An explicit “No results” or “Your inbox is empty” message removes ambiguity.How QAOS detects it
The agent checks list containers (<ul>, <ol>, or labeled content regions) that have no child items and no adjacent explanatory text.