How to find all PDFs on a website and decide what to fix first

The first step in any PDF accessibility plan is to find all PDFs on a website, including the ones on platforms you forgot you use. No single method finds everything. A crawler sees what is linked, your content management system (CMS) knows what was uploaded, and analytics show what people open. Put them together and you have an inventory you can sort, size and hand out. This guide covers where PDFs hide, five ways to find them, what to record for each file, and how to decide what to fix first under ADA Title II or HHS Section 504. It ends with a free option if you would rather have Ockem run the count.

Why counting comes first

Every later decision depends on the list. The Title II and Section 504 exceptions turn on dates and use: a file posted before your compliance date can be exempt unless people currently use it "to apply for, gain access to, or participate in" your services or programs. You cannot apply that test to files you have not found. Budgets work the same way, since most pricing models multiply by documents or pages. And staff time depends on how many files each department owns.

A count costs nothing but time, which makes it the right first step in any Title II or Section 504 plan. As of October 2026, the Title II dates are April 26, 2027 for governments serving 50,000 or more people and April 26, 2028 for smaller governments and special districts. The Section 504 dates for HHS recipients are May 11, 2027 for those with 15 or more employees and May 10, 2028 for smaller ones.

Where PDFs hide on government and health websites

Most organizations publish PDFs from more places than the web team knows about. Check each of these.

• The main CMS media library, including files uploaded years ago and never linked again.
• Department and program microsites, such as parks, libraries, public health, a hospital foundation or a tourism site.
• Subdomains, such as permits.example.gov or library.example.gov, which a crawl of the main domain may skip.
• Agenda and meeting platforms that host agendas, packets and minutes.
• Document centers and archive sections inside your CMS.
• Permit, licensing and payment portals that offer downloadable forms and instructions.
• Vendor-hosted pages posted for you. Title II covers content you provide "directly or through contractual, licensing, or other arrangements," and HHS's rule uses the same words.
• PDFs on other hosts, such as cloud storage share links in your pages.
• Newsletters, both PDF issues and email newsletters that link to PDFs.

Ways to find all PDFs on a website

Each method sees a different slice, so use at least two.

This comparison was written by Ockem. Tool details are from each vendor's documentation as of October 2026.

Search engine query

Google indexes PDF files and documents the filetype: operator, so site:example.gov filetype:pdf lists the PDFs it has indexed on your domain. Google also says the site: operator "doesn't necessarily return all the URLs that are indexed under the prefix specified in the query," and that bigger sites should not expect to see all their URLs. Treat the result as a quick sample, not a count.

CMS export and server listing

Your CMS knows every file uploaded through it. In WordPress, for example, the Media Library list view can be filtered by media type and date, and it shows each file's upload date and the post or page it was uploaded to. Ask your web administrator for a full export of files ending in .pdf. A listing of the web server's folders, or of the storage bucket behind your CMS, goes one step further and finds orphaned files that no page links to. Orphans are often the easiest files to remove, once you confirm no one needs them.

Website crawler

A crawler follows links the way a visitor would and lists every file it finds. In the Screaming Frog SEO Spider, linked PDFs appear under the Internal tab's PDF filter, and the Inlinks column shows the number of internal links to each one. With PDF property extraction turned on, it also reports page count and creation and modification dates. The free version stops at 500 URLs, and every page it crawls counts toward that limit, so a large site needs the paid license or another crawler.

Analytics

In Google Analytics 4, enhanced measurement records a file_download event "when a user clicks a link leading to a file (with a common file extension)," including PDF, with the file name and link address. It counts clicks from your own pages, so it misses people who open a PDF straight from a search result or an email. Search Console's Performance report fills part of that gap by showing clicks and impressions from Google Search, grouped by page.

What to record for each PDF

A spreadsheet is enough. One row per file, with these columns.

A free checker will tell you whether a file is tagged. Our guide to free PDF accessibility checkers compares the options, and scanned PDFs and OCR explains what scans need.

How to decide which PDFs to fix first

Sort every row into one of five groups. These are typical patterns, and counsel should confirm the ones you adopt.

A simple score helps you order the work and spot files that may not need fixing. Rate each file from 0 to 3 on three things. Use: 3 if people use it to apply for or take part in a service, 2 if it states current rules or schedules, 1 if it is reference reading, 0 if it is only a record. Traffic: 3 for your most downloaded files, down to 0 for files nobody opened last year. Recency: 3 if posted or updated in the last year, down to 0 for the oldest. Multiply the three. Work from the highest score down, but put anything scoring 3 on use into Fix now whatever its traffic. Apart from that rule, a file that scores 0 on any factor drops out of the queue and becomes a candidate to archive, keep or remove.

Turn the list into a size

Add two totals to your spreadsheet: the number of documents in the fix groups and their total pages. Long files cost more under per-page pricing. Under per-document pricing, they count in steps, so a 120-page PDF counts as three documents where the unit is 50 pages. Our cost guide does the arithmetic for each model.

Keep your PDF inventory current

An inventory goes stale the week you finish it. After your compliance date, every new or updated PDF must meet WCAG 2.1 AA unless an exception applies, so each inaccessible upload joins the backlog.

• Re-run the count quarterly with the same methods, and compare it with the last one.
• Assign an owner to every file and every new upload, by department.
• Watch updated files. A preexisting document that is edited after your compliance date loses the exception.
• Add a check before publishing, so new files are tagged and readable before they go live.
• Publish as a web page where you can, for content such as press releases and notices.

Let Ockem count them for you

If you would rather not run the crawl yourself, our free PDF inventory tool does the first pass. You enter your domain. Our team runs Ockem Proof, our product, on your site: it counts every linked PDF, then assesses a sample of your documents (12 by default, up to 100 for requests we qualify) against WCAG 2.1 AA. You get a live scorecard and a price per document for the whole library at list prices. We review each request.

For the inventory, Ockem keeps each PDF's metadata: page count, tagging and producer. A document we sample is deleted 30 days later. If we import your public documents in full, every copy is deleted 90 days after the assessment's last activity. The scorecard is kept.

To see what you get back, open the sample scorecard (opens an external site) for the City of Alderbrook, a fictional city. As of October 4, 2026, it covers 86 documents and 3,161 pages of original files, before any fix. It shows which issues clear automatically, which need your reviewers (AI drafts to accept or reject, and checks to confirm), and which wait on a prerequisite Ockem handles. Results are rolled up by site section, and the scorecard says plainly that it is not a full conformance audit.

Two limits to keep in mind. The count finds linked PDFs, so pair it with your server listing to catch orphans. And the sorting decisions (what to archive, keep or remove) stay with you and counsel.

Inside Proof, the domain crawler respects robots.txt and can resume an interrupted crawl. The imports hub re-checks documents you already hold against their source and refreshes them when the published copy changes, and scheduled source monitoring re-checks each publication address daily, weekly or monthly. That catches changes to documents you already track. New uploads still need a fresh crawl. In Ockem's measurements of production documents in August 2026, the median document needs one manual check from your team, and the 90th percentile needs two.

Next steps

Request your free count with the PDF inventory tool, or try one PDF (opens an external site) of up to 10 pages free, with no account. The WCAG coverage map shows what Proof fixes and what a person decides. To sort what you find, read archive, keep or fix, Title II and PDFs and, for HHS recipients, the Section 504 guide. To budget, see the cost guide.

Questions

This guide explains the rules in plain language. It isn’t legal advice. Check how they apply to your organization with counsel.