Dragon Broken Links

Dragon Broken Links scans your posts, pages and every other public post type (WooCommerce products included) for links, images, embeds and media that no longer work, and lets you fix them without leaving WordPress. The checking runs on your own server – there is no third-party checking service, no account, no per-link credits and no monthly quota.

Why this one

Most broken-link plugins either meter the free version to a few hundred links a month or push the real checking into a paid cloud subscription. Dragon Broken Links does the opposite: internal and external checking is free and unlimited, and it is built to be a good citizen on your server and on the sites it checks.

What it checks

• Links, images, embeds and media in every published post, page, product and custom post type – including inside reusable (synced) patterns – with no link limit. Narrow the list of post types under Settings if you want to.
• Internal links without touching your site – resolved against your database: links to deleted, trashed, unpublished or renamed content, and images missing from your uploads folder, are flagged instantly with no requests to your own server.
• External links politely – one request per unique URL no matter how many posts use it, a few at a time, never more than a handful to the same site in one go.

No false alarms

• A link is only marked Broken after a hard failure (404, 410, dead domain, connection refused) is confirmed on three separate checks.
• A first failure shows as Suspected and is re-checked before it counts.
• Ambiguous answers (bot-blocking 403s, rate limits, timeouts, server errors) go to Needs review, never counted as broken.
• Servers that refuse HEAD requests get a second, body-free GET before the answer counts.

Fix in place

• Edit a link’s URL or remove the link (keeping its text) straight from the report – block-editor aware, so both the block data and the rendered HTML are updated together and the editor never reports invalid content.
• Dismiss a URL everywhere it appears, and restore it later from the Dismissed view.
• Re-check any single link on demand.
• Scan now with live progress, plus a background re-check every 15 minutes that works through every link on the cadence you choose – daily, weekly, monthly or never (a very large site, or slow hosts, can take longer).
• WP-CLI: wp dragon-broken-links scan, list and recheck for large or headless sites.

Secure by design

External checks refuse to reach private, internal, link-local, cloud-metadata and reserved addresses, re-validate every redirect hop, pin the connection to the address that was validated, and never read more than the first few kilobytes of a response.

Works with Dragon Redirect Manager

If Dragon Redirect Manager is active, a broken internal link gets a one-click Create redirect action, so you can point the old address somewhere sensible without leaving the report.

What the free version includes

Everything above is free, fully functional and unlimited – no link cap, no cloud account, no upsell nags.

Dragon Broken Links Pro

Dragon Broken Links Pro adds, for a one-time price:

• Email, Slack and signed-webhook alerts on newly broken links.
• Bulk fixing and site-wide domain find-and-replace.
• Scheduled monitoring with history and CSV export.
• Scanning of links held in custom fields and comments.

Multisite

Works per site. Each site has its own report, settings and background re-check; there is no network-wide view.

External services

This plugin makes no connection to Dragon Core or any third-party checking service, and sends no data about your site anywhere.

To test an external link it sends an HTTP HEAD request (then a GET, if HEAD is refused) to that URL from your own server, once per unique URL, with the User-Agent Mozilla/5.0 (compatible; DragonBrokenLinks/<version>; +https://dragoncore.ltd/plugins/dragon-broken-links). The linked site therefore sees a normal request for that page coming from your server’s IP address; nothing about your site, its content or its users is included. Internal links are checked against your database and are never requested. Requests to private, loopback, link-local and reserved addresses are refused.