What it asks for, in plain English
If your content imposes a time limit, for example a session that logs people out, a checkout that releases the basket, a quiz timer, or a page that redirects after a few seconds, then people must be able to do at least one of these: turn the limit off before it starts, set it to at least ten times the default, or extend it. Extending means being warned at least 20 seconds before the time runs out, and being able to extend with a simple action such as pressing a key, at least ten times.
There are three exceptions: the limit is part of a real-time event like a live auction, the limit is essential and extending it would change the activity (a timed exam), or the limit is longer than 20 hours.
Moving or auto-updating content has its own criterion (2.2.2). Timed redirects on a page count here.
This is an independent explanation. The binding wording is the W3C Recommendation, and the W3C's own Understanding 2.2.1 page has the full intent, techniques and definitions.
Who it affects
Someone with a cognitive impairment who reads slowly is logged out halfway through a long form and loses everything typed.
A screen reader user takes longer to work through a page and finds the session has expired when they press Submit.
A person who is interrupted by a carer or a child comes back to a 'your basket has been emptied' message.
How to check it
- Find every time limit: sign in and leave the page open, start a checkout and wait, look for countdowns and auto-redirects.
- When a limit approaches, check a warning appears at least 20 seconds before it ends, and that pressing a key or button extends it.
- Check the warning itself is reachable: it should take focus or be announced, not just appear in a corner.
- Look in settings for a way to switch the limit off or make it much longer.
What Websight checks for 2.2.1
Websight runs this automated check for 2.2.1:
Websight flags a meta refresh tag that reloads or redirects the page after a short delay. Session timeouts, countdowns and basket expiry live in your server and scripts, so only a person can check those.
Practical tips
- Make session timeouts generous and save form progress on the server so a timeout costs nothing.
- Show the warning as a dialog with a single 'Stay signed in' button that works with Enter.
- Never redirect on a timer. Offer a link instead.
Other criteria in guideline 2.2, Enough Time
- 2.2.2 Pause, Stop, Hide (level A)