Accessible Authentication (Minimum)

What it requires

Logging in by typing a memorized password is a cognitive function test. WCAG 2.2 SC 3.3.8 requires that a working alternative exist — typically a copy-paste-friendly password input, browser autofill compatibility, or an alternative authentication method (passkey, magic link, OAuth).

CAPTCHA and "type the characters in this image" puzzles are also cognitive function tests. Sites must provide an accessible alternative (audio CAPTCHA, no-CAPTCHA reCAPTCHA, or an entirely different verification method).

Common Shopify failure

Customer-account login form blocks paste on the password field. Custom signup flow with image-CAPTCHA and no audio alternative.

How to fix it

Remove `onpaste="return false"` and `autocomplete="off"` on password fields. Replace image CAPTCHA with reCAPTCHA v3 or hCaptcha (which include audio).

Merchant QA checklist

• Scan the storefront page where this pattern appears: product pages, collection pages, cart drawer, customer-account pages, and any landing page built with theme sections.
• Confirm the issue is fixed in the rendered browser output, not only in the Liquid file. Shopify section settings, app blocks, and third-party scripts can reintroduce the same 3.3.8 failure after a theme edit.
• Re-test the affected component with keyboard navigation and a screen-reader accessibility tree before publishing the theme, especially when the fix changes markup or ARIA attributes.

How AccessComply handles it

AccessComply treats WCAG 3.3.8 as a rendered-storefront issue first. The scanner checks the live DOM and computed styles, maps the finding back to the Shopify theme file that produced it, then classifies the fix as a safe automatic fix. When automation is safe, the app writes the smallest theme-code change needed and keeps the original theme backup available. When merchant judgment is required, the issue is surfaced for manual review instead of pretending the page is fixed.

Primary source: W3C — WCAG 2.2 Understanding 3.3.8