Government website requirements: The complete checklist for federal, state and local sites

What a government website has to meet depends on who runs it. A federal agency answers to Section 508, the 21st Century IDEA and the Office of Management and Budget (OMB) guidance that implements it. A state, county or city answers to ADA Title II and its own state laws. The overlap is large, but the standards, dates and enforcement are not the same, and a checklist that treats them as one list sends teams after the wrong target.

This checklist is organized by requirement. Each step says which rules drive it and what they ask for, so federal and state and local teams can each see what applies to them.

1. Know which rules apply to your site

Start by placing your organization in the table below. Everything else in this checklist follows from it.

Two points cause most of the confusion. First, Section 508 binds federal agencies. It doesn’t apply directly to state or local governments, which are reached through Title II, their own state accessibility laws and, in some cases, conditions on federal funding. Second, the Title II extension moved the dates, not the obligation. Title II already requires state and local governments to make their services, programs and activities accessible, including the ones delivered online. For a closer look at the Title II rule, see how government websites meet ADA Title II, and for federal reporting, see the Section 508 compliance updates.

Public sector bodies in the European Union work under a different framework, the EU Web Accessibility Directive. For a wider view across jurisdictions, see this overview of website accessibility laws.

2. Make the site accessible, and prove it

An estimated 1.3 billion people, or 16% of the world’s population, experience significant disability, according to the World Health Organization. For them, an inaccessible government site isn’t an inconvenience. It can be the difference between getting a benefit, permit or answer and not getting it.

WCAG is organized around four principles. Content must be:

1. Perceivable: information and interface components are presented in ways users can perceive, such as text alternatives for images and captions for video.
2. Operable: users can operate the interface and navigation, including by keyboard alone.
3. Understandable: information and the way the interface works are clear and predictable.
4. Robust: content works reliably across browsers and assistive technologies, now and as they change.

Your site conforms to WCAG at a given level (Level AA, for most government sites) only when every page in scope meets every success criterion at that level. In practice, that means checking at least:

• Text alternatives for meaningful images, and decorative images marked so screen readers skip them
• Captions for prerecorded video and transcripts for audio
• Logical heading structure and descriptive page titles
• Link text that makes sense out of context
• Forms with labels, instructions and clear error messages
• Sufficient color contrast
• Full keyboard access with a visible focus indicator
• Accessible PDFs and other documents, which are often the largest backlog on a government site

Test the way M-23-22 asks federal agencies to: automated scanning, manual testing and usability testing with people with disabilities, built into the release process so issues are caught before code ships. Automated checks only detect some issues, so they can’t be the whole program.

Publish an accessibility statement with a way for users to report problems. Federal agencies must link to theirs from the footer of their principal website under M-23-22. The Title II rule doesn’t list a statement among its technical requirements, but a statement with a working feedback route is how users reach you when something breaks.

3. Follow design standards and make the site recognizably official

M-23-22 requires all public-facing federal websites and digital services to comply with the Federal website standards published by GSA’s Technology Transformation Services, which incorporate the U.S. Web Design System (USWDS). It also asks agencies to apply their brand identity consistently, publish their design standards in one place, and use a .gov or .mil domain for official public-facing sites.

State and local governments aren’t bound by those federal standards, but the reasoning applies to them too. People need to know they’re on an official site before they enter personal information. A .gov domain, a consistent look across departments and clear agency branding all help. USWDS components and guidance are public, so state and local teams can use them as a starting point rather than designing every pattern from scratch.

Keep presentation simple. Pay particular attention to navigation, on-site search and content types that break on small screens, such as wide tables.

4. Keep content current, accurate and plain

Government sites accumulate redundant, outdated and trivial (ROT) content faster than most, because many teams publish to one domain and few own removal. M-23-22 sets out what good content governance looks like for federal agencies, and most of it transfers to any public body:

• One answer per question: remove outdated and inaccurate content, redirect removed pages with a 301 to the current source, and deduplicate content across sites.
• Regular review: review any content that isn’t actively maintained at least once every three years, and show last-updated dates so readers can judge freshness.
• Plain language: federal agencies must use plain language under the Plain Writing Act of 2010 for content people need to obtain a service or benefit, that describes one, or that explains how to comply with a requirement. The memo asks agencies to write general-audience content so the average reader, who reads at an eighth-grade level, can fully understand it.
• Feedback on content: give users a way to report pages that are confusing, wrong or out of date.
• Quality basics: broken links, misspellings and missing documents erode trust quickly on a site people rely on for official information.

5. Make information easy to find

M-23-22 notes that the public reaches federal information and services primarily through external search engines, not agency homepages. It requires federal public-facing sites to offer site-wide search and to structure content so search engines can crawl and index it, with sitemaps, descriptive metadata and no restrictions on which crawlers can access public content. The memo also notes that a well-structured site is friendlier to assistive technology. Clean headings, descriptive titles and semantic markup serve both.

Write for the questions people actually ask. Use the terms the public uses rather than internal program names, and check search results for your top tasks to see whether your official page is the one that appears.

6. Secure the site by default

Under M-23-22, federal agencies must:

• Serve all web traffic over HTTPS and preload their registered .gov and .mil domains as HTTPS-only
• Publish a vulnerability disclosure policy that covers all internet-accessible sites, names a security contact and is linked from the footer of the principal website
• Avoid embedding static code libraries, fonts or stylesheets hosted on third-party services they don’t control
• Make sign-in secure and usable, including support for password managers

State and local teams can treat that list as a baseline. Add regular checks on outbound links: a link to a domain that has expired or been compromised can send residents to phishing or malware pages under your name.

7. Be clear about privacy

Federal agencies must post a plain-language privacy policy on every public-facing website and digital service, link to it from major entry points and any page that collects personal information, and maintain a privacy program page on their principal site. A Privacy Act statement is required wherever information collected will become part of a system of records.

State and local privacy obligations vary by state, so confirm what yours requires with your legal or privacy office. Whatever the rules, say plainly what you collect, why and how it’s used, and keep that notice current.

8. Measure the experience, then improve it

People compare government sites with the best commercial services they use, and the comparison rarely flatters government. Closing that gap starts with knowing where users struggle.

Federal agencies are required to participate in GSA’s Digital Analytics Program, and M-23-22 asks them to measure task completion, study user flows, collect satisfaction feedback and test with real users, not rely on analytics alone. For any government team, the useful questions are the same:

• Which tasks bring people to the site, and how many complete them?
• Where do users abandon forms or search without finding an answer?
• Which pages generate calls or emails that a clearer page would prevent?
• How do results differ for mobile users and for people using assistive technology?

9. Design for mobile first

M-23-22 notes that a majority of the public accesses federal information and services online, increasingly from mobile devices, and the Digital Analytics Program publishes the current device split for federal sites. For many residents, especially those on low-bandwidth connections, a phone is the only way they reach government online.

• Design: use responsive, mobile-first layouts that work across screen sizes and common mobile browsers.
• Performance: keep pages light and fast, and test on real devices or throttled connections, not only on office desktops.
• Usage data: check which devices and browsers your own users rely on, and test in proportion to that mix.

Make the checklist hold over time

A site that passes this checklist once won’t stay that way. New pages, documents and vendors arrive every week. Three things keep the work from resetting:

1. Education: everyone who publishes, from content contributors to developers, needs to know which standards apply and what they ask of their role.
2. Systematic monitoring: no team can check thousands of pages and documents by hand. Automated scanning across the whole estate, combined with manual testing, shows where issues are and which matter most.
3. Defined process: clear owners, review cycles and release checks turn fixes into habits rather than one-off projects.

Frequently asked questions

What are the requirements for a government website?

It depends on the entity. Federal agency sites must meet the Revised 508 Standards, which incorporate WCAG 2.0 Level AA, and M-23-22’s requirements for design standards, search, security, privacy and mobile access. State and local government sites must meet WCAG 2.1 Level AA under the ADA Title II rule by April 26, 2027 or April 26, 2028, depending on population, plus any state law.

Does Section 508 apply to state government websites?

Not directly. Section 508 applies to federal agencies. State and local governments are covered by ADA Title II, and many states have their own accessibility laws or policies.

Do state and local government websites have to use USWDS?

No. The requirement to comply with the Federal website standards, which incorporate USWDS, applies to federal agencies under M-23-22. State and local teams can use USWDS voluntarily.

How often should government website content be reviewed?

M-23-22 asks federal agencies to review content that isn’t actively maintained at least once every three years. Time-sensitive and high-traffic pages need review far more often.

This article is for general information and isn’t legal advice. Legal obligations depend on your jurisdiction and circumstances, so confirm them with qualified counsel.