Broken images
A sample of the images the pages embed, fetched to check they load. One that does not shows as a broken picture on the page.
Images are referenced by address like any other resource, and that address can break: the file was deleted from the media library, a folder was renamed, a CDN path changed, or the site moved and the image URLs still point at the old domain. The page itself loads fine, so a broken image is easy to miss in your own testing — especially when the browser still has the file in its cache — yet every visitor sees an empty frame or a broken-picture icon in its place.
How SiteScan checks it
The scanner collects the images embedded in the crawled pages and requests a sample of up to eight of them. An image that answers with a 4xx or 5xx status counts as not loading: the row turns red and up to three of the failing paths are listed with their status codes. 405 and 501 only mean the server refuses HEAD requests, so they are not counted. The same requests also reveal images over half a megabyte, which the report raises separately as a performance issue.
How to fix
Re-upload the missing file or correct the path in the page or template. After a migration, search the database for the old domain or old upload folder and replace it. Prefer root-relative paths (/images/photo.webp) over absolute URLs with the domain. Give every image meaningful alt text, so that if it fails, the text still says what was there. See also the guide to image optimisation.
See this check on your own site
Run a free scan: the report shows this row for your domain along with the other checks of the site audit.
More in “Internal links”
What SiteScan checks
TLS certificate
- TLS certificate expiry
- Outdated TLS versions (TLS 1.0/1.1)
- TLS certificate chain
- TLS certificate issuer
- Certificate signature algorithm
Domain registration
- Domain registration expiry
- Registered domain name
- Domain registrar
- Domain registration date
- Domain last updated date
- Domain status codes (EPP)
- Domain transfer lock
- Registrar abuse contact
- RDAP and WHOIS data source
Indexing
- robots.txt file
- CSS and JS blocked in robots.txt
- XML sitemap
- Sitemap index file
- Off-domain URLs in the sitemap
- Sitemap lastmod dates
- Broken URLs in the sitemap
- RSS and Atom feed
Addresses & redirects
Security headers
- HTTP security headers and grade
- Strict-Transport-Security (HSTS) header
- Content-Security-Policy (CSP) header
- X-Content-Type-Options: nosniff
- X-Frame-Options and clickjacking
- Referrer-Policy header
- Permissions-Policy header
- HSTS preload list
- CORS and cross-origin reads
- HTTP TRACE method
Delivery & reputation
- Cache-Control header for HTML
- ETag and Last-Modified revalidation
- HTTP/3 and QUIC support
- Server version disclosure in headers
- DNS blocklist (DNSBL) check
Internal links
Exposure
- Exposed sensitive files (.env, .git, backups)
- Directory listing enabled
- Public JavaScript source maps
- Exposed WordPress endpoints
Well-known files
- security.txt file
- llms.txt for AI assistants
- llms-full.txt file
- ads.txt authorized sellers file
- humans.txt file
- Well-known change-password URL
DNS & email
- MX records (mail servers)
- SPF record
- DMARC record and policy
- DNSSEC signing
- CAA record
- Nameserver redundancy
- IPv6 support (AAAA record)
- MTA-STS policy
- TLS-RPT reporting record
- BIMI record (brand logo in email)
- Wildcard DNS record
- Dangling CNAME and subdomain takeover
Privacy & consent
- Analytics and tracking scripts
- Cookie consent banner
- Privacy policy link
- Terms of service link
- Imprint (Impressum)
- Accessibility statement
Core Web Vitals
- Lighthouse performance score
- Largest Contentful Paint (LCP)
- Cumulative Layout Shift (CLS)
- Interaction to Next Paint (INP)
- CrUX field data vs lab data