Offer undo when restoration is reliable; confirm when the consequence cannot be safely reversed.
Problem
An action could remove something important.
Choose confirmation or undo
- Confirm before permanently deleting an account or shared data that cannot be restored.
- Offer undo after removing an item when all affected data and state can be reliably restored.
Confirmation and undo mistakes to avoid
- A generic 'Are you sure?' for routine actions people perform repeatedly.
- Promising undo when external effects, messages, or permissions cannot be restored.
Example
Website redesign
Archived projects in this example can be restored.
Implementation
- Name the item, what changes, who is affected, and any limits on recovery. Use a specific action label such as “Delete project” and a clear Cancel action.
- If confirmation uses a dialog, give it an accessible name and follow modal keyboard and focus behavior. For a hard-to-reverse action, consider initial focus on Cancel; this is a design recommendation, not a universal rule.
- For undo, retain everything needed to restore the item. Prefer a lasting recovery route such as Trash or history; a brief Undo timeout needs an equivalent untimed route or must satisfy WCAG 2.2.1’s timing rules and exceptions.
- WCAG 3.3.4 requires a safeguard for covered changes to stored user data: reversal, checking with correction, or review and confirmation. It does not require a confirmation dialog for every routine save.
- After removal, move focus to a logical control if its current target disappears. Make the outcome and any restoration feedback available to assistive technology.
Tradeoffs
Confirmation adds friction and can become habitual. Undo is faster but shifts responsibility to recovery. The correct choice depends on actual reversibility, not how dramatic the button looks.
Verification
Can users identify the affected item and consequences, cancel before an irreversible action, and find and use recovery whenever it is offered?