Onsite Link Verdict — Broken Link Checker

Description

Onsite Link Verdict checks the links and images in your posts, pages and comments and tells you which ones are dead.

It knows the difference between “broken” and “I could not check it”

This distinction is the whole reason this plugin exists.

Plenty of servers refuse automated requests. Amazon answers 503 to bots. X answers 403. LinkedIn answers 999. A site behind a firewall throws a challenge page. None of those links are broken — they open perfectly well in your browser. Report them as broken and you hand the user a list of two hundred problems, of which one hundred and ninety are not problems, and they stop trusting the list.

So Onsite Link Verdict only ever calls a link broken when it has proof:

• The destination server says the page is gone — 404 or 410. And even then we ask a second time, with a different method, before accusing the link: there are servers that answer 404 to one kind of request and 200 to another, and a wrong accusation here is the most expensive kind.
• Or there is no server answering at all, three checks in a row — a domain that expired, a host that vanished.

Everything else goes to a separate “Unverifiable” tab, with a plain-language note about what happened. If a server answered us — with 403, 503, a rate limit, a challenge page, anything that is not 404 or 410 — it answered, and that is not proof the page died. Your list of real problems stays short, and short means believable.

It runs on your own server, and stays out of the way

There is no account to create, no cloud service and no credit card. Your posts, pages and comments are not uploaded anywhere — see “External services” below for everything that does leave your site, and why.

Checking links is real work for the same server that answers your readers. Onsite Link Verdict is built around that:

• No checking work happens inside the page your visitor is waiting for. It runs on your site’s cron, in a request of its own.
• At most 100 links per run, and never more than 45 seconds of wall clock, whichever comes first. Both are configurable; both are hard ceilings, not intentions.
• HEAD requests first, falling back to GET only when a verdict depends on it. At most 2 KB of any response body is ever read.
• The same URL repeated across fifty posts is fetched once, not fifty times. Measured: 90 links across 15 posts, pointing at 6 different addresses, cost 8 requests.
• A site that already told us it does not talk to robots is not asked again the next day.

What it checks

• Internal links — links to your own posts and pages. If one points at something that is still a draft, private or pending, you are told exactly that, instead of being told the page no longer exists
• External links — links out to other sites
• Images, including the ones a page builder pulls in
• Links inside comments
• Redirects — it follows the chain, and says so when the chain loops or never arrives anywhere

A local broken link checker: no cloud service, no credits

The link scanner runs locally, on your own site’s cron, on the same server that answers your readers. There is no cloud service behind the plugin, no API key and no account to create: the results live in a table in your own database, and your content is never uploaded anywhere.

Some things do go out of your site — the servers hosting the links being checked, and Freemius, which runs our licensing and checkout. They are set out one by one, with the domains and with what you can decline, under “External services” below.

What that buys you:

• Nothing is metered. How many links you check does not change the price, because there is no price. Fifty thousand links cost the same as fifty. One structural limit worth knowing: a single post or comment with more than 1,000 links is checked to the first 1,000, and the panel tells you when that happens.
• No back end holds your data. There is nowhere for your content to be uploaded to, because there is no service on the other end holding it. What that means for your own processing records is your call — this is a description of the plugin, not legal advice.
• It works from inside the site. A staging site, an intranet, a site behind HTTP authentication or a firewall is not reachable from the public internet — but the plugin is not arriving from the internet, it is already there. Those pages get checked like any other.

The privacy note for the plugin is at https://onsitetools.dev/privacy/ and says the same thing in more detail.

Once the first sweep is done it keeps monitoring. Every link is checked again after a week, and one that is failing after a day, so a page that dies next month turns up next month — you do not have to remember to run an audit.

What you get

• Checks links and images, in posts, pages, custom post types and comments
• Sees inside page builders. On a page built with Elementor, Divi, SiteOrigin or Beaver the links are not in the stored post content — they are assembled when the page is rendered. Onsite Link Verdict renders the page first and reads what a visitor sees, so those links are found
• Four clear tabs: Broken, Warnings, Unverifiable, Good
• Plain-language explanation of the results that matter — not just a bare status code
• It knows your own site. A link to one of your pages that is still a draft, private or pending gives visitors a 404 — and instead of telling you the page no longer exists, Onsite Link Verdict tells you it exists and is not published, and which status it is in
• Automatic checks on your site’s cron, or start a full-site scan with one click. The scan itself is done in small slices and picks up where it left off, so it never has to finish inside a single request
• Progress you can actually see — “750 of 1,000 links checked (75%)”, with a rough time estimate, so you know it is working and not stuck
• Recheck any link on demand — it goes to the front of the queue and is checked on the next pass
• Entries disappear when the content does: remove a link from a post, trash the post, or delete a comment, and the entry leaves the list. The table does not grow forever
• Warns you if your site’s cron is disabled, so checks do not silently never run
• Clean uninstall — removes its table, options and scheduled events

What it does not do

Onsite Link Verdict finds broken links and tells you exactly which post, page or comment each one is in. It does not edit your content: you fix each link in the editor, where you can see it in context.

That is deliberate. Where a link should point is a judgement about your content, and the editor is where you can see the sentence it sits in.

Replacing one URL across an entire site in a single step is the obvious next thing to want. That is what Pro is for, below.

Onsite Link Verdict Pro

Everything above is free, and stays free. Pro does the mechanical part, for people with more than a handful of links to fix:

• Bulk-replace a URL everywhere at once. You type the new address, you see a list of every place it will change with the text around it, and only then does anything happen. There is an undo, and the undo refuses to run if you edited the content afterwards.
• It will not touch what it cannot verify. If a link comes from a shortcode, a page builder or a theme filter, the address is not in the content we would be saving. Onsite Link Verdict says so and leaves it alone, so the report you get matches what actually changed.
• Silence the domains that never answer bots. One pattern per line, and they stop appearing.
• Export any tab to CSV, in a form that opens correctly in Excel.

Pro is an annual licence, from 29 EUR a year plus VAT, for one site. It is bought from https://onsitetools.dev/onsite-link-verdict/ and there is a link inside the plugin. The free version never asks you for an email address of its own: the only place an email is shared is the activation opt-in described above, which you can decline.

External services

This plugin contacts two external destinations: the websites you link to, and Freemius, which
handles our licensing and payments. Here is what goes to each, and when.

1. The websites you link to

Checking whether a link is alive means requesting it from the server that hosts it. That server
receives the address being checked and, in the User-Agent header that identifies the checker,
your site’s address and the plugin’s version. This happens for every link in your content, on the
plugin’s own schedule. It is what the plugin is for, and it cannot be switched off without
switching off the checking.

Links to your own site are requested the same way, over HTTP, from your own server. When one of
those answers 404 or 410, the plugin then looks the address up in your own database, so it can
tell you the page exists but is a draft, private or pending, instead of reporting it gone.

2. Freemius

Freemius Inc. runs our licensing, updates and checkout. It is contacted in four situations, and
only the first is optional.

On activation, if you opt in. WordPress shows you a screen asking whether to share information
about your site. There are four groups, and you can clear all but the first:

• your WordPress user’s first and last name and email address (required to opt in at all);
• the home page address and title, the WordPress and PHP versions, and the site language;
• this plugin’s own version and whether it is active or uninstalled;
• the names, slugs and versions of the plugins and themes installed on the site, and whether each
  is active. This one is ticked for you unless you clear it.

You can decline the whole screen, and the plugin works exactly the same — declining is handled
entirely inside your own site and sends nothing.

On a schedule, if you opted in. Your site then checks in with Freemius periodically to see
whether a licence has been bought or changed. This happens in the free version too, and needs no
licence key.

When you open the “Change Plan” screen inside WordPress. That screen loads the current prices
from Freemius when you open it, whether or not you opted in.

When you deactivate the plugin. WordPress shows a short form asking why; if you fill it in, the
reason goes to Freemius. Closing it sends nothing.

And, in the paid add-on only, your licence key is validated with the same service.

Domains contacted: api.freemius.com, wp.freemius.com, checkout.freemius.com.
Freemius terms: https://freemius.com/terms/ · Freemius privacy: https://freemius.com/privacy/

Nothing else

No other destination is contacted. Your posts, pages and comments are not uploaded anywhere, and
the result of every check is stored in a table in your own database.