How NHS Recruitment Websites Achieved WCAG 2.2 Accessibility and Security Compliance

Results at a glance

• 95% WCAG 2.2 accessibility score
• Zero critical accessibility issues
• Grade A security rating
• GDPR compliant
• Government submission ready

Background

IMT Recruitment and PHST Recruitment are the NHS physician recruitment websites Rapid Solutions has maintained for over fifteen years. IMT covers Internal Medicine Training, PHST covers Physician Higher Specialty Training, and between them they are where aspiring physicians across the UK go to understand the training pathway and apply for a place. Both sites dominate their organic search rankings and are the primary resource in their field.

These are not vanity websites. They carry real traffic, serve a professional audience and sit at the centre of how NHS physician recruitment actually works. When the people using a site are doctors relying on it to build their careers, and the body behind it is the NHS, accessibility and security stop being nice to have. They are the job.

Over the years we have kept both sites running on tight budgets, doing what was needed without pushing for a rebuild that was not necessary. That approach has served the client well. The sites still work, still rank and still convert. So when the government introduced updated accessibility and security requirements, the question was not whether to rebuild. It was how to bring both sites up to standard efficiently, without disrupting what was already working.

The requirement

Public sector and NHS connected websites are required to meet WCAG 2.2 Level AA accessibility standards and demonstrate security compliance as part of government submission. Both IMT and PHST needed to evidence compliance across accessibility, security and data privacy, with documentation ready for submission.

The sites were built before current accessibility standards existed. The HTML structure, form handling, mobile layout and security configuration all needed updating to meet the current bar.

What the work involved

HTML5 and accessibility updates

The most significant part of the work was updating the HTML structure across both sites to meet WCAG 2.2 Level AA. This meant rebuilding page structures with proper semantic HTML5, correct heading hierarchies and ARIA labels so that screen readers and assistive technologies could navigate content correctly. Recruitment application forms were updated with proper labels, error handling and keyboard navigation, which is critical on sites where the form is the primary action a visitor takes.

Mobile compatibility and readability

Both sites needed CSS and layout updates to improve mobile compatibility and readability. Colour contrast ratios were brought up to WCAG 2.2 standards. Text sizing, spacing and touch targets were updated to work properly on smaller screens. The aim throughout was to improve the experience for real users without altering the visual character of sites that were already well established and trusted.

 

Security and performance audit

The CMS was fully vetted for security vulnerabilities. Modern security headers were implemented including Content Security Policy, X-Frame-Options and HTTP Strict Transport Security. HTTPS encryption was confirmed across all traffic. Cloudflare was configured for DDoS protection and performance. The result was a Grade A security rating with no vulnerabilities found across either site.

GDPR and data privacy

Privacy policies, cookie consent and data handling practices were updated to meet GDPR requirements. Both sites process personal data from physicians applying for NHS training positions, so getting this right was not optional.

 

Government submission documentation

Both clients received a full compliance documentation package: detailed WCAG 2.2 reports, security test results and completed government submission spreadsheets with evidence attached. Everything needed for submission was prepared and ready to upload.

Compliance results

Does this sound familiar?

This project may be relevant if you have a website that has served you well for years but now needs to meet updated compliance requirements, whether accessibility, security or both, without the cost and disruption of a full rebuild.

We work with public sector organisations, NHS connected services and regulated businesses that need existing websites brought up to current standards. Sometimes the right answer is not a new site. It is making sure what you already have continues to do its job properly.