Broken internal links
Internal links from the crawled pages, fetched to see where they land. A broken one is a dead end for visitors and a wasted crawl for search engines.
Internal links are the links between pages of your own site: menus, footers, related articles, buttons. When one points to a page that no longer exists, visitors hit an error page and usually leave, and search engines waste crawl budget on dead addresses. Broken internal links typically appear after a page is renamed or deleted, a URL structure changes, or a migration rewrites paths without redirects.
How SiteScan checks it
While crawling, the scanner collects the internal links it found on the pages it visited but did not crawl itself. It then requests a sample of up to ten of them, following up to five redirects, and records where each one lands. A link that ends in a 4xx or 5xx status is broken: the row turns red and up to five broken paths are listed below it with their status codes. A 405 or 501 means only that the server does not accept HEAD requests, so it is not counted as broken. Links that work only after a redirect are reported separately as a smaller issue.
How to fix
For each broken path, find the pages that link to it and update the link to the current address. If the page was moved, add a permanent 301 redirect from the old address so external links and bookmarks keep working too. If it was removed for good, remove the link. The sample is small, so run a full crawl after large changes. More in the article on broken links.
See this check on your own site
Run a free scan: the report shows this row for your domain along with the other checks of the site audit.
More in “Internal links”
What SiteScan checks
TLS certificate
- TLS certificate expiry
- Outdated TLS versions (TLS 1.0/1.1)
- TLS certificate chain
- TLS certificate issuer
- Certificate signature algorithm
Domain registration
- Domain registration expiry
- Registered domain name
- Domain registrar
- Domain registration date
- Domain last updated date
- Domain status codes (EPP)
- Domain transfer lock
- Registrar abuse contact
- RDAP and WHOIS data source
Indexing
- robots.txt file
- CSS and JS blocked in robots.txt
- XML sitemap
- Sitemap index file
- Off-domain URLs in the sitemap
- Sitemap lastmod dates
- Broken URLs in the sitemap
- RSS and Atom feed
Addresses & redirects
Security headers
- HTTP security headers and grade
- Strict-Transport-Security (HSTS) header
- Content-Security-Policy (CSP) header
- X-Content-Type-Options: nosniff
- X-Frame-Options and clickjacking
- Referrer-Policy header
- Permissions-Policy header
- HSTS preload list
- CORS and cross-origin reads
- HTTP TRACE method
Delivery & reputation
- Cache-Control header for HTML
- ETag and Last-Modified revalidation
- HTTP/3 and QUIC support
- Server version disclosure in headers
- DNS blocklist (DNSBL) check
Internal links
Exposure
- Exposed sensitive files (.env, .git, backups)
- Directory listing enabled
- Public JavaScript source maps
- Exposed WordPress endpoints
Well-known files
- security.txt file
- llms.txt for AI assistants
- llms-full.txt file
- ads.txt authorized sellers file
- humans.txt file
- Well-known change-password URL
DNS & email
- MX records (mail servers)
- SPF record
- DMARC record and policy
- DNSSEC signing
- CAA record
- Nameserver redundancy
- IPv6 support (AAAA record)
- MTA-STS policy
- TLS-RPT reporting record
- BIMI record (brand logo in email)
- Wildcard DNS record
- Dangling CNAME and subdomain takeover
Privacy & consent
- Analytics and tracking scripts
- Cookie consent banner
- Privacy policy link
- Terms of service link
- Imprint (Impressum)
- Accessibility statement
Core Web Vitals
- Lighthouse performance score
- Largest Contentful Paint (LCP)
- Cumulative Layout Shift (CLS)
- Interaction to Next Paint (INP)
- CrUX field data vs lab data