Wordfence accessibility broken

Have you posted in the Wordfence support area where they’re more likely to see this?

I have, Steve. This is just kind of a heads-up for any screenreader users who might stumble across it. They recently updated it, but nothing was done re: the accessibility issue, unfortunately.

Actually Jackie, your complaint about the check boxes was addressed. Unfortunately, we can’t just throw out an untested change without implementing and testing it first which takes time. You asked for the check boxes to be returned to a normal looking checkbox, which we did. You can see what the change looks like here.

https://s10.postimg.org/gy11s92zt/checkboxes.jpg

Tim

Tim, I’m rather suspecting that was an image? If so, then, unfortunately, those using screenreaders can’t interpret them.

The problem is not what the checkbox looks like per se. The problem is does the screenreader know what sort of object it is, & its state. That part was (& still is) seriously broken. &, unfortunately, for those sight-impaired folks who need or want to change the options, then I can’t recommend Wordfence to them till this gets fixed.

As for testing, the concept was working quite well in v. 6. So it has, I should think, been tested fairly extensively, no?

Folks, it is becoming increasingly evident that you’re not understanding what I’m saying &, furthermore, that you do not understand what web accessibility is (specifically, WCAG 2.0) or how to implement it. Since WordPress core is implementing these standards to the AA level, it would be to your advantage to at least understand what these standards are as well as how to implement them.

So, to break it down for you just a bit, accessibility, as used in this context, is the ability of a particular program to be used by those w/disabilities. That can include those who use assistive technology devices, such as screen readers, screen magnifiers, switches, voice, etc. It can also include those who do not, ie, the estimated 8% of the world’s male population who experience some form of color blindness, for example. One of the major parts of accessibility is that the program can be used w/both a mouse & keyboard. Another is that color alone not be used to convey information. The concept of contrast is also important.

For more information, please consult the following:
https://www.w3.org/WAI/intro/wcag
https://www.w3.org/WAI/WCAG20/glance/
This provides a quick overview.
https://www.w3.org/WAI/WCAG20/quickref/
https://www.wuhcag.com/wcag-checklist/

& here’s a tool that can help assess accessibility w/o a screen reader, for use in the Firefox browser:
https://www.marcozehe.de/2018/04/11/introducing-the-accessibility-inspector-in-the-firefox-developer-tools/

Since my difficulty w/the plugin involves screen readers, I will try to explain, *again*, what the major problems are.

A “dirty little secret” of accessibility is that objects must expose themselves. No, we’re not talking about exhibitionism here. This simply means they must reveal value, state, etc. The checkboxes, as currently implemented in Wordfence, simply do not reveal their state, ie, whether they are checked or unchecked. This has nothing to do w/password-protected directories, @zimou13 (it isn’t, btw, I know better than that). It has to do w/code that does not conform to even the most rudimentary of accessibility standards. The other problem is that dropdown lists should open w/the alt+downarrow keystroke in order to access the items inside. The ability to do so in this release is problematic.

Folks, please do not reply to me again until you’ve at least provided me the courtesy of reading & understanding what I’ve presented to you. Whether it’s your intent or not, these replies feel condescending & disrespectful, as they clearly don’t address the issue at hand, nor seemingly do they attempt to. It seems to me that developers ought to at a minim be aware of these concepts, but, evidently not.

I decided to take a look to see what the problem was, and it is pretty bad…

The “checkboxes” are <li> elements, and when checked, it adds an icon inside the <li> element. That icon has aria, but the absolute most unhelpful aria, aria-hidden. If it wasn’t hidden, and at least had a label of checked, that would be a huge improvement, but still barely usable for screen-reader users.

The lack of label elements is really bad too, every input needs a label. If it’s not an actual input element, you need to add an aria-label.

In addition, all the controls need to be able to be modified using the keyboard. This isn’t the case now. The keyboard part doesn’t just affect people who use screen-readers, but also people who use no assistive technology at all. I know quite a few people who use almost exclusively the keyboard in the WordPress admin, just to do things faster.

@wfsupport – is there any way for external contributors to contribute upstream? I would really like to see this fixed. WordFence is one of the most popular WordPress plugins, and it’s concerning that it’s not even close to being at WCAG 2.0 A-level, when all of WordPress is at WCAG 2.0 AA-level.

@lakenh, thank you *so* much! *Finally!* someone who actually understands what I’m saying. I was going to have a look at the code to see if I could point out the problem, but, even then, I didn’t feel I was going to make much headway.

Thanks again! You just made my day. I don’t feel quite as much like I’m yelling down the proverbial sewer pipe now.

I can imagine how difficult it is to use WordFence right now with a screen-reader, just by looking at the source, it doesn’t even look possible. ??

I didn’t do a full audit like I normally do when looking for accessibility problems, all I did was quick glance at a single checkbox’s source. There are probably a substantial amount of problems, unfortunately, and will take quite a bit of time to fix.

This is why it’s so important to think of accessibility problems when building stuff. Did nobody even try to use a keyboard when building the new update? Some of it isn’t even accessibility – it’s valid HTML issues. I understand that people tend to just ignore the W3C guidelines, but they exist for a reason. It’s what any sort of web browsing tool uses to base how it functions. The way you do things may work fine visually, but to a program that parses webpages, invalid HTML doesn’t always work fine. This goes beyond just assistive technologies too.

@lakenh, I have pretty much abandoned trying to use Wordfence. It’s sad when what seems to me to be a fairly major player in the WordPress arena lacks this kind of understanding, as you so aptly pointed out in your previous reply. ?? I already love you & I don’t even know you lol. I hope they allow you to contribute, but I’m not terribly optimistic.

For any screen reader users out there who need a security plugin & who might be interested in any suggestions I may have, I’m recommending Sucuri’s plugin for now unles & until something better comes along.

@lakenh, if you ever need anything, hit me up. I do Slack despite it being a PITA accessibility-wise, so you can DM me there. Please don’t hesitate.

Hey Jackie,
I don’t use WordFence anymore since it seems very unreliable. I’m glad you were able to find out the issue.