Broken Link Finder: a free link checker that reports what it actually finds

Why JWWD built a free broken link checker for our own site audits, and how we made it accurate without letting it be turned against other people’s servers.

The problem

Broken links are one of the most common and most fixable problems on a website. They hurt search rankings and quietly erode trust, but most owners don’t know how many they have until a visitor complains.

When we audited client sites, the options were paid crawlers or free checkers that capped scans at a handful of pages or skipped external links altogether. Many also report only where a redirect ends up, which hides the 301s and 302s that are worth cleaning up.

What we built

Broken Link Finder scans the page you give it and checks every link on it with a real HTTP request. No signup and no upsell.

  • Extract: every link on the page is resolved to a full URL, stripped of fragments and deduplicated, up to 150 links.
  • Check: each link gets a real request, with its status code, response time and anchor text recorded.
  • Sort: results are split into working, redirect, broken and timeout, with a filter tab for each.
  • Grade: the page gets an A to F health grade based on the share of links that work.

How it's built

  • Plain PHP, no framework and no database: One page serves both the tool and its JSON endpoint. Cache and rate-limit state live in small files.
  • Parallel checks that stay polite: Links are checked in batches of 20 with curl_multi, spread round-robin across hosts so no server sees more than four requests from us at once. Twenty simultaneous hits on one host often get dropped, and a healthy page gets reported as timing out.
  • HEAD first, GET as a fallback: Servers that reject HEAD get a GET limited to a small byte range, so we never download whole pages just to check they exist.
  • Redirects shown, not followed: A 301 is reported as a 301, not hidden behind its final destination.
  • Links resolved against where the page landed: If example.com redirects to www.example.com, relative links resolve against the www host, so internal links aren’t wrongly flagged as redirects.

Making it safe to leave open

Each scan sends up to 150 requests in our name, so an open checker is an easy amplifier for abuse. The tool is protected in layers:

  • SSRF guard: every link host is resolved first, anything pointing at a private or reserved address is skipped, and the checked IPs are pinned for the request.
  • Cheap checks first: a bot heuristic and a honeypot field, then per-visitor rate limits.
  • Caching and a ceiling: repeat scans of the same page within 15 minutes are served from cache, and a global hourly cap limits total outbound requests.
  • Cloudflare-aware: the visitor IP header is only trusted when the request really came through Cloudflare, and IPs are hashed before they’re stored.

The result

A fast, honest link checker that we use on our own client audits and keep free, because tools developers reach for every day should be. The same engine also produces Broken Link Finder’s published research on link rot across Australian websites, including every government, university and charity domain in the Tranco top million list, so the reports describe exactly the tool anyone can run. See the Broken Link Finder tool page for a quick overview.

Have a project like this in mind? Talk to JWWD.