WCAG 3.3.8: Accessible Authentication (Minimum)
WCAG 3.3.8 Accessible Authentication (Minimum) is a level AA success criterion from WCAG 2.2. Signing in should not force a cognitive test such as remembering a password or transcribing a puzzle, unless there is an alternative, a copy-paste path, or an object recognition CAPTCHA.
People with cognitive disabilities may be blocked by memory tests and puzzles.
How to test
Check login. Password managers and paste should work. There should be another path such as an emailed link.
How to fix
Allow paste, support password managers, and offer an email link. Do not use a puzzle as the only path.
Example that fails
A puzzle CAPTCHA blocks login and paste is disabled on the password field.
Example that passes the check
Paste works, and an email link is offered.
Shopify
Use the customer login that allows password managers. Do not add a script that blocks paste.
WooCommerce
Remove paste-blocking scripts on the account form and avoid puzzle-only gates.
WordPress
Allow paste on the login form.
Wix
Do not block paste on member login.