The State of Motion Accessibility on WordPress.
We scanned 50 real, independently-run WordPress sites for two specific motion-accessibility problems. Unguarded and unstoppable motion turned out to be the norm — not the exception.
Unguarded and unstoppable motion is the norm, not the exception.
ship motion that ignores the visitor’s “reduce motion” setting (WCAG 2.3.3)
run animation you can’t pause (WCAG 2.2.2, Level A)
median motion-accessibility score
sites verified clean, out of 50
And these are floor numbers: a static CSS scan under-reports JavaScript, GSAP and canvas motion by design, so the real failure rate is at least this high — not lower.
This started with a security scare. That part isn’t ours.
wp2shell (CVE-2026-63030) is an actively-exploited, unauthenticated remote-code-execution flaw in WordPress core, disclosed by Adam Kues of Searchlight Cyber. If that’s why you’re here, the thing you need is on their advisory, not ours.
We don’t fix that, and we won’t pretend to. But the wp2shell moment has WordPress admins auditing their sites this week — so it’s a fair time to point at the other liability sitting on the same sites, the one nobody is checking: motion accessibility. The European Accessibility Act is in force, and nearly two-thirds of the sites we scanned fail a Level-A criterion its baseline (WCAG 2.1 AA) includes.
Check your site’s motion accessibility.
Paste a public URL. We statically scan the page’s CSS motion against two WCAG motion criteria and show exactly what we’d fix. It’s the same MIT engine that powers MotionSpec — not a mock. It doesn’t see JavaScript-driven motion.
Honest scope: static scan of linked CSS + <style> only. Not a full accessibility audit, not a compliance verdict; runtime JS/GSAP motion isn’t covered. Nothing you submit is stored.
Across 50 verified WordPress sites, more than nine in ten shipped a motion violation.
Four sites scored 100 — but every one of those was “no CSS motion found,” meaning the static scan had nothing to grade, not that the site was verified accessible. So zero sites in the sample were confirmed clean-with-visible-motion.
The violations were not hand-written — they came from a handful of ubiquitous plugins and themes: page-builder entrance animations, Font-Awesome spinners, recipe- and form-plugin loaders, carousel libraries. That’s the useful part: because the motion comes from the same few sources, a single site-wide prefers-reduced-motion guard resolves the whole class in one move.
| Site (anonymized) | Stack | Score | Flagged occurrences |
|---|---|---|---|
| German recipe blog | Divi + Thrive | 15 | 1,408 |
| US personal-injury law firm | Page builder | 15 | 1,041 |
| Animal-rescue nonprofit | Theme + loaders | 15 | 590 |
| US design/tech magazine | Self-hosted WordPress | 15 | 336 |
| German food blog | Recipe + form plugins | 15 | 269 |
| Independent local news | Publishing platform | 15 | 172 |
| US marketing blog | Contact Form 7 | 15 | 111 |
| Boutique hotel | SEO + slider plugin | 27 | 110 |
| US food blog (well-built) | Managed WordPress | 62 | 48 |
| German baking blog | Lazy-load only | 85 | 3 |
Site identities are withheld on purpose — this is about the state of the ecosystem, not naming individual businesses. The full anonymized per-site dataset (all 50 sites) is available to download as CSV (CC‑BY‑4.0).
MotionSpec Motion Guard.
Because the offending motion comes from shared plugins and themes, you don’t have to edit any of them. Motion Guard is a free WordPress plugin that does two small, honest things.
Scan
It runs the same audit as above and shows each finding with its fix, right in wp-admin.
Fix the biggest class in one step
A site-wide reduced-motion guard (WCAG 2.3.3) that only changes anything for visitors who turned on “reduce motion” — so it never alters your default design — plus an optional visible pause control (WCAG 2.2.2).
Small, honest, and stated up front.
We searched for real business and organization websites across many verticals and countries, and confirmed each runs WordPress from the audit itself — WordPress-specific selectors surfaced in the scan (Gutenberg wp-block, WP Recipe Maker, Contact Form 7, WooCommerce, Jetpack, Divi, Elementor and the like) — or, for a few major media titles, a publicly-documented WordPress deployment. Each confirmed site was scanned once with MotionSpec’s public static motion audit.
N = 50, a convenience sample, not a census: it over-samples content and food/recipe sites (where WordPress plus fingerprint-able plugins concentrate — about half the sample), and skews US (37 of 50, with 10 German). Not randomized.
The audit is a static, single-page CSS scan — it under-reports JavaScript / GSAP / canvas motion by design, which is why the scores are a floor.
WCAG 2.3.3 is Level AAA / best practice; only 2.2.2 is Level A and sits inside the EAA’s WCAG 2.1 AA baseline. Failing 2.3.3 is not automatically “non-compliant.”
A score is a motion-accessibility signal, not a legal verdict.
Questions, answered plainly.
Is this the same thing as the wp2shell vulnerability?
No. wp2shell (CVE-2026-63030) is an unauthenticated remote-code-execution security bug in WordPress core; the fix is updating core to 6.9.5 / 7.0.2 or later (see wp2shell.com). This study is about motion accessibility — a completely separate, non-security issue. We keep the two apart on purpose.
Does Motion Guard protect against wp2shell or other attacks?
No. It’s an accessibility tool and does not touch security. To protect against wp2shell, update core. If you can’t patch immediately, a separate generic virtual-patch mu-plugin and Cloudflare WAF rule are available — security hardening, not a MotionSpec feature.
Does a plugin make my site legally compliant?
No, and we won’t claim it. Motion Guard fixes a specific, machine-checkable slice (motion) and tells you what it can and cannot see. It is not an overlay and does not promise WCAG or legal compliance.
How reliable are these numbers?
They’re a floor. 50 verified WordPress sites, US-skewed and food-heavy, each scanned with a static single-page audit that under-reports JavaScript / GSAP motion by design — so the true failure rate is at least this high, not lower. Every site was confirmed WordPress from selectors in the scan itself.
Disclosure. MotionSpec makes the free checker and the Motion Guard plugin referenced here, so we have a commercial interest in motion accessibility being taken seriously. We’ve tried to keep the study honest about that: the method, the sample size, and the limits are all stated above, and the raw dataset is available for anyone who wants to check the math. wp2shell and its remediation are the work of Searchlight Cyber, linked above; we claim none of it.