Web Application Testing Checklist for 2026

Web applications have gotten dramatically more complex in the last five years. Client-side rendering, edge functions, microservices, third-party integrations, and real-time data have created layers of risk that didn't exist when "web testing" meant clicking through pages.

Here's the five-layer checklist we use at QA Labs. It covers everything a modern web app needs to be tested for.

Layer 1 — Functional testing

All user flows work end-to-end

Form validation catches bad input

Error states display correctly

Auth flows (signup, login, reset, logout) behave

Permission roles gate access correctly

Edge cases (empty inputs, huge inputs, invalid characters) handled

Session handling is correct

Data persists across refreshes

Layer 2 — API testing

Every endpoint returns expected data

Auth headers required and validated

Rate limits enforce

Timeouts handled gracefully

Concurrent requests don't corrupt data

Third-party integrations handle failures

Layer 3 — Visual testing

Layouts consistent across Chrome, Safari, Firefox, Edge

Responsive design works on all breakpoints

Fonts, colors, spacing match design

No layout shift on load

Images, icons, graphics render correctly

Dark mode works (if applicable)

Layer 4 — Accessibility testing

WCAG 2.1/2.2 AA compliance

Keyboard-only navigation works

Screen reader compatibility (VoiceOver, NVDA, TalkBack)

Contrast ratios meet minimums

Form labels and ARIA attributes correct

Focus states visible

Reduced-motion preferences respected

Layer 5 — Performance testing

Core Web Vitals meet targets (LCP <2.5s, INP <200ms, CLS <0.1)

Load testing at expected peak traffic

Stress testing beyond peak

API response times meet SLOs

CDN caching works

Images optimized

Bundle size within budget

How to run this checklist

Functional + API + Visual: Every release

Accessibility: Every feature touching UI

Performance: Before major releases and after infrastructure changes

Full 5-layer: Before major launches

Common mistakes

Testing only the happy path

Skipping accessibility because "users don't complain"

Ignoring visual regression until users report it

Treating performance as a pre-launch check instead of continuous

Not integrating any of this into CI