LinkChecker

About LinkChecker

LinkChecker crawls a single page, an entire site, or a sitemap.xml and reports every problem it finds — grouped by the page it lives on, with the anchor text and the target URL, so you know exactly where to go and what to fix. It starts with links: 404s and the full 4xx/5xx range, DNS failures, SSL errors and certificates about to expire, timeouts, refused connections, and soft 404s that quietly return 200. It follows every redirect chain to its destination and flags loops, mixed 301/302 hops, HTTPS→HTTP downgrades, and internal links that travel through a redirect instead of pointing at the final URL. It verifies that #anchor fragments actually exist on the page they point to. Then it keeps going. More than 160 checks across 18 categories cover: • On-page SEO — titles, meta descriptions, H1s, heading order, canonicals, noindex, Open Graph, Twitter Cards, favicon, charset, viewport, feeds. • Accessibility — image alt text, form labels, button names, iframe titles, empty headings, landmarks, positive tabindex, video captions, html lang, broken label[for] and aria-labelledby references. Optional axe-core pass for deeper coverage. • Security — missing or weak CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, insecure cookies, missing SRI, insecure form actions, HTTP not redirecting to HTTPS, and open redirects (actively probed, never followed). • Performance — heavy HTML, images without dimensions, missing compression, missing Cache-Control, slow responses, oversized images. • hreflang — invalid locales, missing self-reference and x-default, missing return tags, lang mismatches, broken targets. • Sitemap — fetch and parse errors, non-canonical URLs, invalid lastmod, noindex pages, files over Google's 50k-URL limit. • Content — duplicate and near-duplicate titles, descriptions and pages, thin content, missing structured data, malformed JSON-LD. • Internal linking — orphan pages, pages missing from the sitemap, pages with a single incoming link, pages buried too deep, the same anchor text pointing at different URLs. • Scan credibility — tells you when a result is incomplete: crawl truncated, server rate-limiting, JS-rendered pages, suspected crawl traps. Optionally, cross-check every scanned page and outbound link against Google Safe Browsing for malware and phishing, using your own API key. Four presets get you started — Quick check, Polite crawl, Full audit, Broken links only — and every check can be switched on or off individually. Set crawl depth, page cap, concurrency, and a delay between requests; respect or ignore robots.txt; include subdomains; skip URLs with glob or regex exclusion patterns; check pages without crawling deeper into them; narrow the report to specific status codes such as 404 only or all 4xx and 5xx. Pause and resume a running scan, or cancel it and still get a report from everything collected so far. The report groups issues by type or by source page, filters by severity, and searches across URLs, anchor text, and details. Expand any redirect issue to see each hop and its status code. Re-check a single link on the spot without re-running the whole scan, ignore the findings you have decided not to act on, and save filter combinations you use often. Export to JSON, CSV, or a self-contained HTML file you can send to someone else. Your last 30 scans stay in the sidebar, where you can rename, tag, color-label, and pin them, and re-run any of them with one click using its original settings. When you scan a URL you have scanned before, a banner shows what is new and what has been fixed since last time — so you can verify a fix instead of reading the whole report again. Everything runs on your Mac. No account, no telemetry, no data sent anywhere. The only exception is the Google Safe Browsing check, which is off until you add your own API key and tell it to run.