NDIS Practice Standards: what an auditor can see on your WordPress website

The NDIS Practice Standards govern how you deliver supports. They say nothing about your website. That is the honest starting point, and also the reason for this article. A few of the outcomes inside them leave a trace that any stranger can see, and most provider sites give the wrong answer.

In brief

• The Practice Standards are about service delivery. No rule in them tells you what to put on a website.
• Some outcomes still show up in public, because they ask whether participants know about something and can reach it.
• A stranger can check 5 of those in 10 minutes, logged out, with no tools.
• We audited 60 Australian NDIS provider websites, home page only, on 9 September 2026. Of those, 55 failed the WCAG 2.2 target size minimum.

What the standards are, and what they are not

The National Disability Insurance Scheme has a quality and safety framework, and the Practice Standards are the part of it that providers are assessed against. The NDIS Quality and Safeguards Commission puts it plainly on its own page: ‘The NDIS Practice Standards specify the quality standards that need to be met by registered NDIS providers delivering supports and services to NDIS participants.’

The same page adds a second purpose that matters more here than it first appears: ‘The Standards also raise participants’ awareness of what quality service provision they should expect from registered providers.’

Read those 2 lines together. The standards bind how you work. They also exist so that participants know what to expect. Awareness has to form somewhere, and for a participant comparing providers at 9 pm, it usually forms on a website.

What follows is ours, not the Commission’s. Nothing in the standards tells you to publish anything. We checked. Across the Commission’s Practice Standards page and both core module pages, read on 4 November 2026, the word website appears once. It is not a requirement. Every suggestion below is a way of meeting an outcome that is quoted, never a rule we have invented for you.

One more boundary before we start. The standards sit alongside the NDIS Code of Conduct, which is a separate instrument. The code binds how people behave, including providers who are not registered, and this article is not about the code of conduct.

This is general information about published standards. It is not advice about your registration, your audit or your obligations.

Which modules you are assessed against

Which standards bind you depends on what you deliver. The Commission splits them 3 ways, in its own words: ‘a core module that applies to all registered NDIS providers delivering higher-risk supports and services’, ‘supplementary modules that apply depending on the types of NDIS supports and services being delivered’, and ‘a verification module that applies to all registered NDIS providers delivering lower-risk supports and services’.

Note the wording. The core module is not simply for everyone. It follows the risk of the supports you deliver, and the verification pathway covers the lower-risk end.

The core module covers 4 areas, as the Commission names them: rights and responsibilities for participants, provider governance and operational management, provision of supports, and provision of supports environments. Supplementary modules sit alongside the core module rather than replacing it.

The supplementary modules, as the Commission lists them on that page, read on 4 November 2026:

• high intensity daily personal activities
• specialist behaviour support
• implementing behaviour support plans
• early childhood supports
• specialised support co-ordination
• specialist disability accommodation
• supported independent living

One of those, supported independent living, has its own dated change this year. That is the last section of this article.

The modules decide which outcomes bind you. They do not give you a different website.

Evidence, and the narrow part of it that is visible without a login

Each module is built the same way, and the NDIS Commission publishes the pair as one document, the NDIS Practice Standards and Quality Indicators. It describes outcomes as ‘high-level and participant-focused’, and quality indicators as the things ‘that auditors use to assess compliance with the NDIS Practice Standards and indicate how providers may show compliance’.

An audit runs on documents, staff records and interviews with workers and participants. An auditor is not browsing your site. No source we read describes a website as an audit input, and this article does not pretend otherwise.

Now the part we are arguing rather than quoting. Some outcomes are not satisfied by a document existing. They are written in terms of whether a participant knows about something and can get to it. For those, a public page is one of the places where knowledge either forms or fails to.

Emergency and disaster management is a good example. The outcome is about planning that keeps supports going when something goes wrong. A participant cannot read your plan, and should not. They can read whether you say anything at all about what happens when supports are interrupted.

So the visible part is narrow and worth stating exactly: whether a process exists and can be reached. What the process produced stays internal. Hold on to that distinction, because the rest of this article depends on it.

The 10-minute check a stranger can run on your site

Open your site in a private window. Do not log in, do not use the menu you built, and do not use anything you know from the inside. You are now a participant, a family member, or an auditor with a browser.

1. Can a stranger find how to complain? The Commission’s outcome is: ‘Each participant has knowledge of and access to the provider’s complaints management and resolution system.’ So: from the home page, in 2 clicks, can you reach a page that says how to raise a concern and to whom? If the answer is no, that outcome is not being helped by your site. Put the path on a page a search engine and a reader can both find.

2. Can they read what you actually do, and what it costs them? The outcome here is: ‘Each participant’s information is easily accessible to the participant and appropriately utilised by relevant workers.’ Your service list is the public end of that. If your services are described in words a funding body uses rather than words a participant uses, rewrite them in plain language.

3. Is there anything about advocates? The core module says: ‘Each participant is provided with information about the use of an advocate (including an independent advocate) and access to an advocate is facilitated’. Almost no provider site mentions advocacy at all. A short paragraph with a link to an independent service is enough.

4. Can they reach you without a phone call? No standard says this. It follows from the first 3. If a phone number is your only contact route, you have closed the door on participants who do not use the phone. Add a form and an email address.

5. Can the page be used at all? Put the mouse away and use the keyboard. Then zoom the browser to 200%. If you cannot tab to the complaints link, or the text collapses, checks 1 to 4 do not matter. The person never got that far.

All 5 checks come from core module outcomes, so they apply whatever you deliver. If you carry a supplementary module, the extra outcomes rarely add a page. They usually mean the description of that one support has to be plainer and more specific than the rest.

If any of this turns into work you would rather hand over, we build WordPress websites to a fixed quote for providers across Australia.

What 60 provider sites actually looked like

Method first, because a number without one is just a claim. We audited 60 Australian NDIS provider websites, home page only, on 9 September 2026. Accessibility was tested with axe-core, speed with PageSpeed Insights on the mobile profile, and touch target size against WCAG 2.2 success criterion 2.5.8.

Now the limits, in the same breath as the numbers. We tested one page per site. Automated tooling reaches only part of the WCAG criteria, so a clean scan is not conformance, and 7 of those 60 sites scanned clean. The data is from 9 September 2026 and will drift.

There is a benchmark worth naming. The DTA, the federal agency that sets Australian Government digital standards, says of its own site: ‘Our website aims to meet the Australian Government’s web accessibility requirements. These include the World Wide Web Consortium’s Web Content Accessibility Guidelines version 2.2 (WCAG 2.2)’. That is the standard the Australian Government applies to its own services. It is not an NDIS obligation, and we are not going to tell you it is a law that binds you.

What must never go on the public page?

There is an opposite failure, and it is worse. Having read this far, the temptation is to prove compliance by publishing the evidence itself. Resist it.

The core module ties participant information to consent: each participant ‘understands and agrees to what personal information will be collected and why, including recorded material in audio and/or visual format’.

Using the distinction from earlier, these stay internal:

• NDIS behaviour support plans and anything taken from them
• records of restrictive practices
• incident reports, and any detail that could identify a participant
• photographs of participants without recorded consent

A public page shows that a process exists and how to reach it. It never shows what the process produced.

What changed, and who it changed for

The NDIS Practice Standards reform has produced one change this year worth dating properly, because sector summaries blur it. The Commission writes: ‘In December 2025 the Minister for the NDIS announced that SIL providers must register from 1 July 2026, and comply with the new NDIS Practice Standards for supported independent living.’

That is scoped to supported independent living. It is not a general revision of the Practice Standards, and if you do not deliver SIL, it does not move anything on your site.

Whatever you deliver, read the version on the NDIS Commission’s own page rather than a summary of it. That includes this one.