Scanners
Crawl HTML references that no longer resolve
Find broken links, missing images, and other dead HTML references.
overview
What broken-link-checker does
Wire broken-link-checker on a known page URL when you need a dead-reference inventory before takeover or DNS follow-ups. It checks links inside HTML; it does not enumerate hosts.
Operators use it for content health and for security triage: broken external hosts are often the first signal that a third-party name or service was abandoned.
Start with --input, add --recrusive to crawl linked HTML, and set --filter-level plus --requests or --host-requests so the graph depth and concurrency stay controlled. Outputs are a file and folder.
use cases
Where broken-link-checker fits
Inventory dead links across a site
Crawl an HTML document recursively and list every broken link and missing image so content and reliability issues surface in one report.
Surface takeover candidates
Pull the broken external links a page points at, since a dead reference to an unclaimed host is exactly where a subdomain or service takeover begins.
Separate internal and external checks
Exclude internal or external links so a run focuses on either your own content health or the third-party hosts you depend on.
Tune crawl pressure per host
Set concurrent requests and per-host limits so a recursive scan covers a large site without overwhelming any single origin.
reference
broken-link-checker inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| input | STRING | --input | URL to an HTML document to check. |
| recrusive | BOOLEAN | --recrusive | Recursively scan, crawling the linked HTML documents. |
| filter-level | STRING | --filter-level | Which tags count as links, from clickable anchors up to metadata. |
| exclude | STRING | --exclude | A keyword or glob to match links against and skip. |
| exclude-external | BOOLEAN | --exclude-external | Do not check external links. |
| requests | STRING | --requests | Concurrent requests limit. |
| host-requests | STRING | --host-requests | Concurrent requests limit per host. |
| verbose | BOOLEAN | --verbose | Display excluded links. |
Showing key inputs. broken-link-checker exposes 13 inputs in total.
Full flag reference (13 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| get | BOOLEAN | --get | Change request method to GET. |
| input | STRING | --input | URL to an HTML document. |
| follow | BOOLEAN | --follow | Force-follow robot exclusions. |
| exclude | STRING | --exclude | A keyword/glob to match links against |
| ordered | BOOLEAN | --ordered | Maintain the order of links as they appear in their HTML document. |
| verbose | BOOLEAN | --verbose | Display excluded links. |
| requests | STRING | --requests | Concurrent requests limit. |
| recrusive | BOOLEAN | --recrusive | Recursively scan ("crawl") the HTML document(s). |
| user-agent | STRING | --user-agent | The user agent to use for link checks. |
| filter-level | STRING | --filter-level | The types of tags and attributes that are considered links. (options: 0 -> clickable links, 1 -> 0 + media; iframes; meta refreshes, 2 -> 1 + stylesheets; scripts; forms, 3 -> 2 + metadata) |
| host-requests | STRING | --host-requests | Concurrent requests limit per host. |
| exclude-external | BOOLEAN | --exclude-external | Will not check external links. |
| exclude-internal | BOOLEAN | --exclude-internal | Will not check internal links. |
example
Run broken-link-checker
# recursively check links on a site, skip mailto noisebroken-link-checker --input https://www.example.com/ --recrusive --exclude mailto --filter-level 1 --requests 10BROKEN https://old.example.com/docs/guideBROKEN https://cdn.example.net/assets/missing.pngBROKEN https://api.example.com/v0/healthBROKEN https://static.example.org/favicon.icoBROKEN https://blog.example.com/posts/archivedBROKEN https://dev.example.com/legacy/statusOK https://www.example.com/OK https://app.example.com/loginguidance
Choosing broken-link-checker
Use broken-link-checker to map dead links and missing references on a known page or site crawl. It does not discover hosts. Feed broken external hosts into a takeover or DNS tool next.
socialhunter
Crawls for broken social links and flags takeovers. broken-link-checker covers all link types.
katana
Crawls for endpoints rather than checking link health. Find pages there, then check them here.
subjack
Tests subdomains for takeover directly. broken-link-checker surfaces the dead hosts that feed it.
faq
broken-link-checker questions
related
More Scanners tools
ac-scanner
BHUSA Arsenal TLS/SSH crypto inventory with post-quantum readiness signals and CBOM-shaped output.
airixss
Reflection triage for parameter URLs during recon.
bedrock-keys-security
Black Hat Arsenal hunting for phantom IAM users behind Bedrock keys, with offline key decode and org scan.
cmseek
CMS detection and version fingerprinting.
jaeles
Signature-driven web application scanner.
joomscan
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
Run broken-link-checker yourself
A page URL feeds broken-link-checker, which collects dead references and hands the broken hosts to socialhunter so confirmed takeover candidates land as a queryable output.
Facts on this page come from the live Trickest tool library.