What actually happens to your theme
The reason most merchants never fix accessibility is that the tools which can fix it are the tools most likely to break the store. Here is the whole sequence, including the parts we refuse to automate.
1. The scan (free, no install)
A real browser opens your storefront and tests the settled page against WCAG 2.2 AA. Every defect comes back with a screenshot, the success criterion, and the theme section it was rendered from. Nothing is written anywhere; we never see your theme source at this stage.
2. Install (Shopify only)
Repair needs write access to your Liquid source, which only the Shopify Admin API can give. That is why the fixing product is a Shopify app and not a script you paste into a page — a script cannot change your code, it can only paint over it at runtime, which is the overlay model that has repeatedly failed in court.
3. Repair, on a copy first
Fixes are never written straight to your live theme. Curbcut duplicates the theme, applies the changes there, and shows you a before and after for each one. You approve, then it publishes. If anything looks wrong afterwards, one click restores the exact prior version.
Checkout, cart, and payment templates are never modified. Those pages carry your revenue and Shopify controls most of them; the risk of touching them is not worth any defect they might contain.
4. What gets fixed automatically, and what does not
Only a fixed list of defect classes is ever applied without a human decision:
image descriptions · form labels · button and link names · heading order · contrast tokens · language declarations · skip links · focus indicators
Everything else — ARIA structure, keyboard traps, custom widgets, tables, media captions — is queued as a suggestion with the evidence attached, for a person to decide. An over-eager fix that breaks a product page costs more than the defect did.
5. It keeps holding
Themes get updated, apps inject markup, and defects come back. Curbcut re-scans on a schedule and re-applies its fixes after every theme publish, logging each pass.
What this cannot do
- It cannot find every barrier. Automated rules catch what a machine can measure; keyboard traps, confusing flows, and unclear copy need a person with a screen reader.
- It cannot fix a storefront it cannot reach. Headless builds render outside Shopify's theme system, so there is no Liquid for us to repair.
- It cannot tell you where you stand legally. That is a lawyer's job, and anyone selling you software that claims otherwise is selling you a problem.