Dragon Broken Links

Find and fix broken links with a local engine - unlimited checking, no cloud account, no credits.

#Requirements

WordPress 6.2+, PHP 8.0+. No external services: all checking runs on your own server.

#Getting started

1. Activate the plugin and open Tools → Broken Links.
2. Press Scan now. The scan runs in bounded batches: it reads every link, image, iframe, video/audio source and reusable (synced) pattern in your published content (every public post type, or the ones you tick under Settings), dedupes the URLs (each unique URL is checked once, however many posts share it), then checks them. The status line shows which phase it is in ("Reading posts 12 of 40", then "Checking links - 57 remaining").
3. Every press of Scan now re-reads all posts; a post is also re-scanned whenever it is saved. Background re-checks run every 15 minutes on WP-Cron, inside a 20-second budget, working through every link about once a week (a very large site, or slow hosts, can take longer).

#How checking works

• Internal links are never fetched over HTTP. They resolve against your own database: links to trashed, draft, deleted or renamed content (old slugs are followed) and images missing from the uploads folder are detected instantly, and a slow site can't false-flag itself. Archive, term and custom-route URLs, WordPress's own paths and real files in the site root are left as OK rather than guessed at.
• External links are fetched politely (a few at a time, at most three per site per batch) with a HEAD request and a body-free GET fallback for servers that refuse HEAD; no more than 64 KB of any response is ever read. Redirects are followed hop-by-hop with safety checks on every hop, and a redirect back onto your own site is never followed.
• Three buckets, not one: clear failures (404, 410, dead domain, connection refused) become Suspected and are only promoted to Broken after three separate failures - a flaky server never instantly pollutes your report. Ambiguous responses (403, 429, timeouts, server errors) go to Needs review and are never auto-promoted, because sites that block bots aren't broken. Every row shows a plain-English reason.
• Security: requests to private, internal, link-local, cloud-metadata, multicast and IPv6-transition addresses are refused, and the connection is pinned to the address that passed that check.

#Fixing from the report

Each row offers:

• Edit URL - change the URL in that post (the prompt is pre-filled with the current one). The fix is block-aware: block data and rendered HTML are updated together, every JSON escape is preserved, and a revision is created so you can undo.
• Remove link - unlink the anchor but keep its text (or keep the image, for image links).
• Re-check - check that URL again right now.
• Dismiss everywhere - hide a URL you've decided is fine, in every post it appears in. Dismissed links stay dismissed across scans and edits; the Dismissed view lists them with a Restore action.
• Create redirect - if Dragon Redirect Manager is active, turn a broken internal URL into a redirect in one click (path-style links only - a /?p=123 link has no path of its own).

#Importing from Broken Link Checker

If the site previously ran Broken Link Checker, Tools → Broken Links → Settings carries your dismissed links across so you don't re-triage them. Nothing is removed from the other plugin.

#WP-CLI

wp dragon-broken-links scan                 # run a full scan to completion (waits if another scan is running)
wp dragon-broken-links scan --fresh         # re-read every post even mid-scan
wp dragon-broken-links list [--status=...]  # list links: broken, warning, suspected or dismissed
wp dragon-broken-links recheck <url_id>     # check one URL now and print its new state

#Data & privacy

The plugin stores its link index in two tables of your own database. Nothing leaves your server except the outbound link checks themselves. Uninstalling keeps your data by default so a reinstall picks up where you left off; tick Delete all data on uninstall in Settings if you want removal instead.

#Troubleshooting

• Nothing gets checked between visits - WP-Cron only fires on traffic. Use "Scan now", the WP-CLI command, or a server cron.
• A working site shows as Needs review - its firewall is blocking automated checks (common with 403/429). That's what the bucket is for: eyeball it and dismiss.

#Dragon Broken Links Pro

Adds email/signed-webhook alerts on new broken links, bulk fixing and site-wide domain find-and-replace, scheduled full scans with history and CSV export, and scanning of links held in custom fields and comments.

#Uninstall

Deleting the plugin keeps all its data by default, so a reinstall picks up where you left off. To remove everything on uninstall, tick Delete all data on uninstall in the plugin's settings first (this sets the dragonbrokenlinks_delete_data_on_uninstall option).