We checked the websites of 600 NDIS providers, chosen at random from the NDIS Quality and Safeguards Commission’s register of approved providers. Three in four fail at least one basic accessibility check. Half don’t link to a privacy policy. Almost none mention Easy Read.
These are the websites people with disability, their families and support coordinators use to choose a provider. Many of the problems we found shut out the very people these providers exist to support, and most take less than a day to fix.
How often each problem appears
Share of the 499 NDIS provider homepages we could check
Accessibility basics are being missed
We ran six automated checks that line up with the Web Content Accessibility Guidelines (WCAG): page language, pinch-to-zoom, image descriptions (alt text), form labels, named links and buttons, and a main heading. 378 of the 499 homepages we could check (76%) failed at least one.
- Forms screen readers can’t read. Of the 290 homepages with an enquiry or contact form, 147 (51%) had at least one field with no label. A blind person hears “edit text” instead of “Your phone number”.
- Icon-only links. 45% had three or more links or buttons with no readable name, usually social media icons and menu buttons. A screen reader just announces “link”.
- No main heading. 30% had no H1 heading, and 55% had a muddled heading structure. Screen reader users jump between headings to find their way around.
- Zoom switched off. 18% tell phones not to let people pinch to zoom. For someone with low vision, that can make the site unusable.
- Missing image descriptions. 26% of homepages with images had at least one with no alt text.
Automated tests only catch part of the picture. Colour contrast, keyboard use and plain language need a person to check, so the real share of sites with accessibility barriers is likely higher.
Half have no privacy policy in sight
264 homepages had no link to a privacy policy. We checked 19 of these by hand, and none mentioned a privacy policy anywhere on the page.
NDIS providers collect names, addresses, NDIS numbers and often health information, frequently through the very forms on their homepage. Under the Australian Privacy Principles, organisations covered by the Privacy Act need a clearly expressed privacy policy that people can get for free, and the usual place for it is the website. The small business exemption does not apply to organisations that provide a health service and hold health information, which covers many NDIS providers.
Complaints and registration details are hard to find
Registered providers must have a complaints management system and help participants understand how to use it. Yet 69% of homepages had no link to or mention of feedback or complaints. And 65% didn’t say whether the provider is NDIS registered, often the first thing a participant or support coordinator wants to know.
Only 5% mentioned interpreters or support in other languages, even though free interpreting is available through TIS National.
Easy Read is almost absent
Easy Read uses short sentences and pictures to help people with intellectual disability, low literacy or limited English. Just 4 of the 499 homepages mentioned Easy Read information, and only 10% linked to an accessibility statement explaining how to get information in another format.
Security and upkeep
- Out-of-date WordPress. WordPress runs 54% of the sites we checked. Of the 201 where we could read the version, 51 were two or more major versions behind. Out-of-date sites are the most common way in for hackers, and a hacked website can put participants’ personal information at risk.
- Missing security headers. 52% were missing all three basic security headers that help protect visitors.
- Broken HTTPS. 3% had a broken secure (https) version and only worked insecurely, and 8% didn’t send visitors from the plain http:// address to the secure one.
- Slow servers. 15% took more than 1.8 seconds just to start sending the page.
Dead ends on the register
Of the 600 websites listed on the register, 44 (7%) didn’t work when we checked. 20 pointed to a web address that no longer exists. Others returned server errors, timed out or had a broken security certificate. For a participant looking up a provider on the register, that’s a dead end.
No state does much better
Scores were remarkably even across the country, so this is a sector-wide problem rather than a regional one.
| State (head office) | Sites checked | Median score |
|---|---|---|
| New South Wales | 159 | 76 |
| Victoria | 136 | 76 |
| Queensland | 99 | 77 |
| South Australia | 43 | 78 |
| Western Australia | 40 | 79 |
| ACT, Tasmania and NT (combined) | 22 | 74.5 |
The score is the percentage of our 29 checks a homepage passed, with a partial pass counting as half.
Check your own website
Our free NDIS website checker runs the same tests we used in this study. Enter your web address and you’ll get a score, plus a plain-English list of what to fix, in about 20 seconds.
Check my websiteWhat providers can fix this week
Most of these fixes are small and can be done in a day. If your site needs more than a quick fix, our NDIS website design page explains what a well-built provider website should include.
- Add a privacy policy and link it in your footer.
- Add a “Feedback and complaints” page, including how to contact the NDIS Commission.
- State your NDIS registration status and number on your homepage or in your footer.
- Give every form field a visible label, not just placeholder text.
- Add names such as “Facebook” to icon-only links and buttons.
- Remove “user-scalable=no” or “maximum-scale=1” from your viewport settings so people can zoom.
- Describe meaningful images in their alt text.
- Make your phone number a tap-to-call link so mobile visitors can ring you in one tap.
- Offer Easy Read versions of key information, and mention free interpreting through TIS National (131 450).
- Keep WordPress, plugins and your theme up to date, or have managed hosting and maintenance do it for you.
How we did the study
- Source
- The NDIS Quality and Safeguards Commission’s public register of providers, downloaded on 27 September 2026. We kept providers marked “Approved” with a usable website address.
- Sample
- 600 websites chosen at random (seed 20260927). The mix of states matches the register.
- What we checked
- Each homepage, loaded the way a visitor’s browser does, against 29 checks for security, speed, accessibility, NDIS trust signals and Google visibility. Nothing was changed on any site.
- Limits
- Homepages only, and automated checks only. Percentages are accurate to within about 4.4 points, 19 times out of 20. Figures for smaller groups (sites with forms, WordPress sites) have wider margins, up to about 7 points.
- Privacy
- We report totals only and don’t name any provider.
- Using these figures
- You’re welcome to quote this study. Please credit Uniweb and link to this page. For the full data tables, email info@uniwebau.com or call 02 8003 7308.
Need help with your NDIS website?
Uniweb is a Sydney web design agency that builds and looks after websites for NDIS providers across Australia.
