Accessible Forms: Labels, Errors and Validation
Forms are the point where visitors turn into contacts, sign-ups or customers. Yet this is exactly where many people with disabilities get stuck: the WebAIM Million Report (2024) found 45.9% (WebAIM Million, 2024) of all analyzed home pages with missing or empty form labels. This makes forms one of the most common barriers on the web. Under the German Accessibility Strengthening Act (BFSG), since June 2025 many providers are legally required to make forms operable according to the recognized standards of WCAG 2.2 and EN 301 549. This guide shows in practical terms how programmatic labels, required field marking, error messages, inline validation, focus management and accessible date fields are implemented correctly.
Why Forms So Often Contain Barriers
A form combines several critical interactions in a small space: labeling, input, validation, error handling and submission. Each of these steps can create its own barrier. The most common problems arise when visual design and programmatic structure diverge. A field looks labeled because there is text next to it, but this text is not linked to the field as a . Sighted users recognize the connection, whereas a screen reader only announces input field.
The WebAIM Million Report (2024) shows that 96.3% (WebAIM Million, 2024) of all analyzed home pages have at least one automatically detectable WCAG violation. Missing form labels have consistently ranked among the top errors for years. On top of that: automated testing tools only reliably detect a portion of all barriers (W3C/WAI). With forms in particular, manual tests with keyboard and screen reader are indispensable, because the operation logic and reading behavior only become visible in the real flow.
The Nielsen Norman Group (2023) describes that unclear error messages and poorly placed hints are among the biggest frustration factors in forms - for all users, not only for people with disabilities. An accessibly built form is therefore almost always a more user-friendly form with lower abandonment rates. Our services work precisely at this intersection of accessibility and conversion. This becomes especially visible in the extensive order and address forms of an accessible shop.
Programmatic Labels: the Foundation
Every input field needs a programmatically linked label. The simplest and most robust way is the element with a for attribute pointing to the field's id. Screen readers then automatically announce the label when the field receives focus, and clicking the label moves focus into the field - which also enlarges the click target and helps people with motor impairments. WCAG 2.2 criteria 3.3.2 (Labels or Instructions) and 4.1.2 (Name, Role, Value) require exactly this association (W3C, 2023).
<!-- Recommended: visible label with for/id -->
<label for="email">Email address</label>
<input type="email" id="email" name="email"
autocomplete="email" aria-required="true" />
<!-- Alternative when no visible label is possible -->
<input type="search" id="q" name="q"
aria-label="Search the website" />
<!-- Wrong: placeholder is NOT a label -->
<input type="email" placeholder="Email" />A placeholder is not a substitute for a label. It disappears when typing, is handled inconsistently by screen readers and often has insufficient contrast. If, for design reasons, no visible label is possible - for example with a search field - aria-label or aria-labelledby can be used. Visible text remains the best choice, however, because it helps all users, including people with cognitive disabilities and users of voice input who address the visible label as a command.
Prefer a visible label
. Only switch to aria-label when the design strictly rules it out. Never set both at once - otherwise aria-label overrides the visible text and voice control can no longer find the field.Mark Required Fields Unambiguously
Required fields must be recognizable both visually and programmatically. A red asterisk alone is not enough, since its meaning is not explained and screen readers do not reliably announce it. A robust approach combines the native HTML attribute required (which also activates browser validation) with a visible hint. Additionally, the meaning of the marking should be explained at the start of the form, for example: fields marked with an asterisk are required.
Anyone using the asterisk should either make it readable for screen readers or hide it via aria-hidden and set aria-required="true" instead. Consistency is important: either all required fields are marked or - in forms where almost everything is required - only the optional fields are marked as optional. Duplicate or contradictory hints confuse more than they help.
Label with for/id
Every field has a visible whose for points to the field's id. Clicking the label focuses the field.
Required marked twice
Visually (asterisk plus explanation) and programmatically via required or aria-required. Consistent marking throughout the form.
Error linked
Error message bound to the field via aria-describedby, field set to aria-invalid="true", message in role="alert".
Keyboard operable
All fields, options and buttons reachable via Tab and operable without a mouse. A visible focus indicator on every element.
Autocomplete tokens
Standardized autocomplete values for name, email and address fulfill WCAG 1.3.5 and reduce input burden.
Errors not by color alone
Communicate the error state additionally through text, icon and border. Contrast of text and border at least 4.5:1 or 3:1.
Error Messages: Identify, Describe, Solve
WCAG 2.2 dedicate several criteria to errors: 3.3.1 (Error Identification) requires that an error is detected and named in text form. 3.3.3 (Error Suggestion) requires that, where possible, a specific correction suggestion is made (W3C, 2023). In practice this means: a good error message describes not only the problem but also the solution. Instead of invalid input, better: please enter an email address with an at-sign, for example name@example.com.
Every error message belongs directly at the affected field - not only in a summary at the top of the page. Programmatically, the field is marked with aria-invalid="true" and the message is linked to the field via aria-describedby. On focus, the screen reader then announces label and error message together. So that a newly displayed message is announced immediately, the message container should carry role="alert" (or aria-live="assertive").
<label for="email">Email address</label>
<input type="email" id="email" name="email"
autocomplete="email"
aria-required="true"
aria-invalid="true"
aria-describedby="email-error" />
<p id="email-error" role="alert">
Please enter a complete email address,
for example name@example.com.
</p>With server-side validation, after which the page reloads, an error summary should additionally appear above the form. This lists all errors as links that jump directly to the respective field. After submission, focus is programmatically set to this summary so that screen reader and keyboard users immediately learn that and where something needs correcting. The BITV test procedure and EN 301 549 assess precisely this combination of identification, description and reachable correction (EN 301 549, 2021). Which BFSG requirements apply in detail depends on the type of your offering.
Inline Validation Without New Barriers
Inline validation checks input while the user is still filling in and gives immediate feedback. Implemented correctly, this reduces errors and abandonment; implemented incorrectly, it creates new barriers. The most common mistake is validating on every keystroke: it reports an error while the user is still typing, and a role="alert" would then constantly interrupt. The Nielsen Norman Group (2022) recommends validating only when the field is left (blur) and using positive feedback sparingly.
For live feedback, a region with aria-live="polite" is suitable, announcing changes without interrupting the current task. assertive or role="alert" is reserved only for urgent, blocking messages. It is important that a message which disappears again (for example because the error was fixed) does not steal focus and that the user can follow the correction path. A password field that ticks off requirements live should present them as a list with clear states rather than by color alone.
| Aspect | Barrier | Accessible solution |
|---|---|---|
| Timing | Validation on every keystroke | Validation on leaving the field (blur), acknowledge corrections immediately |
| Announcement | Silent display or constant alert | role=alert for errors, aria-live=polite for status messages |
| Display | Error indicated by red color only | Text, icon and border combined, contrast at least 3:1 |
| Focus | Focus jumps uncontrolled | Focus stays in the field or moves in a controlled way to the error summary |
Manage Focus Deliberately
Focus management determines whether a form remains comprehensible via keyboard and screen reader. Basic rule: the tab order follows the visual reading direction, and every focused element has a clearly visible focus indicator. The criterion 2.4.11 (Focus Not Obscured), newly introduced with WCAG 2.2, requires that the focused element is not hidden by sticky headers, cookie banners or chat windows (W3C, 2023).
After submitting a form with errors, focus is actively set to the error summary or the first erroneous field. If submission was successful, focus should move to the success message so that it is announced. Programmatically set focus on non-interactive elements such as a heading requires a tabindex="-1" so that the element becomes focusable without slipping into the normal tab order. Clean focus management is part of how we approach accessible web development.
Never make focus invisible
outline: none without a visible replacement violates WCAG 2.4.7 (Focus Visible). WCAG 2.2 adds 2.4.13 (Focus Appearance), recommending a sufficiently large and high-contrast focus presentation. Remove the default outline only if you provide an at least equivalent custom indicator.Using Autocomplete Tokens Correctly
WCAG criterion 1.3.5 (Identify Input Purpose) requires that the purpose of input fields collecting personal data is programmatically determinable (W3C, 2023). This is implemented via standardized autocomplete tokens such as given-name, family-name, email, tel, street-address, postal-code or country-name. Browsers and assistive technologies can then offer stored data and enrich fields with icons - a major relief for people with motor or cognitive impairments.
<label for="first-name">First name</label>
<input id="first-name" name="first-name" autocomplete="given-name" />
<label for="zip">Postal code</label>
<input id="zip" name="zip" inputmode="numeric"
autocomplete="postal-code" />
<label for="tel">Phone</label>
<input id="tel" type="tel" name="tel"
inputmode="tel" autocomplete="tel" />In addition, the inputmode attribute controls the on-screen keyboard on mobile devices: numeric for postal codes, email for email fields, tel for phone numbers. Combined with the correct type attribute, this creates an input that produces fewer errors. Anyone operating several forms benefits twice here, because the same tokens can be reused across domains. We implement these details as standard in accessible web development.
Accessible Date and Selection Fields
Date fields are among the most difficult form elements. The native is often the best choice because it brings keyboard operation, localization and screen reader support. Where a custom datepicker widget is needed, it must reflect the complete keyboard pattern: navigation via arrow keys, selection via Enter, closing via Escape and correct ARIA markup as a dialog or grid. An additional text input as an alternative is always important, because not everyone can operate a calendar grid.
The expected date format must be communicated clearly, for example via help text DD.MM.YYYY linked to the field via aria-describedby. Fields split into sub-fields (day, month, year) each need their own label and should be wrapped in a with . For selection lists: the native is robust and keyboard-friendly. Custom dropdowns must fully replicate the combobox or listbox pattern, including type-ahead for long lists.
- Prefer native elements (input type=date, select) because they already support keyboard and screen reader
- Communicate the expected format via aria-describedby (e.g. DD.MM.YYYY)
- Group related fields in fieldset/legend (date of birth, address)
- Make custom widgets fully keyboard operable (arrow keys, Enter, Escape)
- Offer a text input as an alternative to the calendar grid
- Indicate selection states not by color alone, but also by text or icon
Accessible Authentication and CAPTCHAs
WCAG 2.2 added 3.3.8 (Accessible Authentication): sign-in processes must not require a cognitive function test in which users have to, for example, transcribe characters or solve puzzles without a simpler alternative existing (W3C, 2023). Login fields should allow pasting from the password manager and use autocomplete="current-password" or new-password. An image- or text-based CAPTCHA without a low-barrier alternative is a classic barrier.
Where spam protection is needed, invisible methods such as honeypot fields or server-side heuristics are preferable to a puzzle task. If an interactive test is unavoidable, at least one alternative method must be offered, such as confirmation by email. This keeps the form usable for people with visual, hearing or cognitive impairments without giving up protection against automated input. We explain more about the underlying ARIA mechanisms in our article on ARIA roles, states and live regions. Low-barrier authentication is part of our services.
Testing with Keyboard and Screen Reader
No form should be considered accessible without a manual test. Automated testing tools find many technical errors, but only about a third to a half of WCAG requirements can be checked automatically (W3C/WAI). The first manual test is always pure keyboard operation: can every field be reached via Tab, is the order logical, is focus always visible and is no element trapped?
The second test runs with a screen reader. Here it becomes clear whether labels, required field hints and error messages are actually announced and whether the order of announcements makes sense. From our project experience with 50+ (project experience) accessible web projects, most of the remaining form errors only become visible in the combined test of keyboard and screen reader - for example an error message that exists in the code but is not announced due to a wrong live region. Which tests we run is part of our WCAG audit.
A form is only accessible once a person can submit it flawlessly using keyboard and screen reader alone - not when an automated test shows green.
Accessible forms pay off twice