Use risk score for triage, not certification
The technical risk score condenses unsuppressed deterministic and partial failures into a 0–100 remediation priority. It is useful for sorting work and observing trends. It is not a percentage accessible, a standards score, or a legal conclusion.
aps-risk-2 weights and calibration
| Severity | Base weight |
|---|---|
| Blocker | 40 |
| Critical | 20 |
| Major | 8 |
| Minor | 2 |
| Info | 0 |
Each additional occurrence contributes 25% of the base weight, up to four
additional occurrences. Document-wide findings multiply their contribution by
1.5. The resulting raw total r is calibrated as
round(100 × (1 − exp(−r / 100))) and capped at 99. This preserves ordering
and headroom instead of collapsing a small number of severe findings to 100.
Heuristics, manual checks, and suppressed findings do not contribute.
Why two equal scores can mean different things
A score of 40 could represent one blocker, two critical findings, or a larger set of major and minor failures. Always pair the score with severity counts, findings, coverage, and manual review.
The score also does not normalize by page count, DOM size, or document length.
It is intentionally a technical priority signal, not a comparison of
organizational compliance. Historic reports keep their recorded
risk_score_version; do not compare aps-risk-1 and aps-risk-2 as though
they used the same scale.
Recommended product use
- Sort a remediation backlog within one project and policy set.
- Track whether a compatible release trend is improving.
- Draw attention to document-wide or high-severity failures.
- Use the quality gate—not a hand-written risk threshold—to enforce release policy.
Do not use the score in marketing claims such as “92% accessible.” That interpretation is not supported by the model.
Whole-site risk
Whole-site page scores retain aps-risk-1 so each page remains independently traceable. The aggregate uses aps-site-risk-1: the maximum page score for fewer than 20 successfully scanned pages and the 95th percentile for 20 or more. Read the page-risk percentiles, severity instances, affected-page count, and unique issue groups together. Truncation and failed pages affect result and coverage, not the numeric site risk.