What Broken Link Checker does on your site
Broken Link Checker looks for links and images in your content that no longer respond, then lists them in a report where you can change the URL, remove the link while keeping its text, or dismiss the alert. A dead link to one of your own pages sends visitors to a 404 error; links that go through too many redirects get flagged too.
The plugin ships with two engines. The local engine, the older one, runs on your server: it goes through posts, comments and custom fields in the database, rechecks every link on a schedule through WP-Cron and can send email alerts. The newer cloud engine crawls your public pages from WPMU DEV servers, with no load on your hosting, and shows the full report in the WPMU DEV Hub; it requires connecting the site to a WPMU DEV account, which can be a free one.
The developer, WPMU DEV, gives the plugin away for free on wordpress.org. There is no paid edition of Broken Link Checker: a WPMU DEV membership only lifts the limits of the free account and unlocks other Hub services, such as scanning for broken backlinks.
Which sites Broken Link Checker suits best
- Older blogs and content sites: hundreds of posts pointing to third-party sites pile up dead links, and the plugin finds them without a manual review.
- Sites after a redesign or migration: a full scan surfaces forgotten internal links and images that no longer load.
- Agencies: the cloud engine gathers reports for several sites in the Hub and emails scheduled scan reports.
It is not a redirect manager: it spots broken links but does not create a 301 redirect for a page you moved. Pair it with Redirection instead. On very limited shared hosting, also avoid the local engine on a large site.
Broken Link Checker strengths and limitations
Strengths
- Fixes without opening the editor. Editing the URL, unlinking or ignoring happens right in the report, one link at a time or in bulk.
- Two engines to choose from. The local one needs no outside service, the cloud one spares your server, and you can switch between them.
- Completely free. Scanning, fixing, notifications and scheduled scans need no license.
- A polite cloud crawler. It follows your robots.txt file, including Crawl-delay, and identifies itself with a dedicated user agent.
Limitations
- The local engine taxes your server. It checks links from your hosting account, which is why it comes with load-limiting settings.
- The cloud engine depends on WPMU DEV. An account is required, free accounts wait 15 minutes between scans, and private or maintenance-mode pages are out of reach.
- Fixes limited to content. Links saved by the Site Editor, the Customizer or some page builders have to be fixed by hand.
- A heavy security record in 2026. Several unauthenticated flaws were patched this year, including a remote code execution bug.
The settings we recommend for Broken Link Checker
You pick the engine from the Link Checker menu. The other settings apply to the local engine, under Link Checker > Local [old] > Settings.
| Setting | Recommended value | Why |
|---|---|---|
| Checking engine Link Checker > Cloud [new] or Local [old] | Cloud for a public site; Local for a private, members-only or maintenance-mode site | The cloud engine only sees public pages; the local one reads the database but works on your server. |
| Check each link Settings > General | 72 hours (default), longer on a large site | Spacing out checks cuts the number of outgoing requests from your server. |
| Send me e-mail notifications about newly detected broken links Settings > General | On (default) | You get alerted without opening the report. |
| Show uncertain or minor problems as "warnings" instead of "broken" Settings > General | On (default) | A temporary outage on a third-party site shows up as a warning rather than a false alarm. |
| Stop search engines from following broken links Settings > General | Off (default) | It adds rel="nofollow" to broken links; fixing or removing the link solves the actual problem. |
| Post statuses Settings > Look For Links In | Published only (default) | Drafts often hold placeholder links that clutter the report. |
| Exclusion list Settings > Which Links To Check | Domains that block bots, such as linkedin.com | These sites often refuse automated checks and get wrongly reported as broken. |
| Run continuously while the Dashboard is open Settings > Advanced > Link monitor | Off on shared hosting, keeping "Run hourly in the background" | Continuous checking adds load during every admin session. |
| Target resource usage Settings > Advanced | 25% (default) or lower | Caps the share of server resources the local engine allows itself. |
- If the cloud scan fails or finds no links, allow the
WPMU DEV Broken Link Checker Spideruser agent and the IP addresses published by WPMU DEV in your firewall. - Make sure your site uses a trusted certificate: with a self-signed one, the cloud engine will not start.
- Before unlinking in bulk from the cloud report, export the list as CSV and test the action on a single link.
Broken Link Checker security: a string of patches in 2026
A plugin that reads comments and sends requests to outside URLs has a real attack surface. The 2026 vulnerabilities worth knowing:
- CVE-2026-18937, fixed in 2.4.12: on sites with plain permalinks, an unauthenticated visitor could overwrite PHP global variables, up to remote code execution (rated critical by WPScan).
- CVE-2026-75528, fixed in 2.4.13.1: unauthenticated stored XSS through the URL entered in a comment, triggered when an administrator rechecks that link (CVSS 7.2).
- CVE-2026-84772, fixed in 2.4.14.1: SSRF exploitable with an Editor account.
- CVE-2026-96562, fixed in 2.4.15: arbitrary shortcode execution from a comment, once that comment is approved (CVSS 6.5).
Keep the plugin up to date, ideally with automatic plugin updates. That said, version 2.4.10 fixed a database schema upgrade error, so on an important site, test updates on staging first. WP Masquerade Pro removes the broken-link-checker folder name from the plugin’s file URLs, which makes it harder for bots targeting these flaws to spot, without replacing updates; the broken_link class stays visible in your pages if you keep broken-link styling on.
What WP Masquerade hides for Broken Link Checker
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to Broken Link Checker: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- folder name
- tag IDs
Still visible
- CSS classes
broken_link (option to style broken links)
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
Broken Link Checker FAQ
Is Broken Link Checker really free?
Yes. The local engine needs no account. The cloud engine needs a WPMU DEV account, which can be free; in that case you wait 15 minutes after a scan before starting another, a delay a WPMU DEV membership removes.
Cloud engine or local engine: which should I use?
Cloud suits a public site that wants to spare its server. Local suits a private, members-only or maintenance-mode site, or anyone who would rather not connect the site to an outside service. On a network-activated multisite, only the main site can use the cloud engine.
Why do working links show up as broken?
Some sites turn bots away with an error, often a 403, while the page opens fine in a browser. Add those domains to the local engine’s exclusion list, or ignore them in the cloud report (up to 500 ignored URLs).
Can the plugin fix links in my menu or footer?
Not always. The cloud engine’s Edit and Unlink actions work on posts, their metadata, user profiles and comments; links saved by the Site Editor or the Customizer have to be fixed by hand.