Tidy Broken Link Scan – Broken Link & Image Checker

BLC scans every published post, page and public custom post type on your WordPress site for broken links and images. It checks <a href>, <img src>, <img srcset>, and <source srcset> — all natively, using the WordPress HTTP API. No SaaS, no API key, no external dependency. Features:

• Detects broken links (4xx, 5xx, timeouts)
• Checks images including srcset and <picture> elements
• Automatic daily scan via WP-Cron
• Instant re-scan when you save a post
• Admin dashboard with filtering (all / broken / ok)
• Direct link to edit the source post
• Works on any WordPress hosting

Need a full-site crawl? This plugin checks the links and images inside your published posts, pages and custom post types. For a complete crawl of your whole site — every URL discovered through your sitemap, plus SSL and redirect-chain checks — you can run a free scan with our companion cloud scanner at brokenlinkscan.com. It runs in your browser, needs no installation, and is made by the same author. More from Tidy Plugins If you like this plugin, take a look at the rest of the Tidy suite:

• Tidy Table of Contents — automatic, accessible table of contents
• Tidy Draft Share — share drafts via secure, expiring preview links
• Tidy Author Box — author bio box with avatar and social links

2.5.1

• The dashboard cloud-scanner tip now prefills your site URL, so the companion full-site scan on brokenlinkscan.com starts one click away.

2.5.0

• Scans now cover every public post type (posts, pages and custom post types) instead of only posts and pages — full scans, the daily auto-scan, the on-save re-scan, the post editor meta box and WP-CLI all use the same scope. Added a blsc_scannable_post_types filter to customise the list.

2.4.9

• Scan history now shows every recorded entry (up to the 30 the plugin stores) instead of being capped.
• Domain and URL exclusions are now fully configurable from the Settings screen — enter the domains or URLs to skip during scans.

2.4.8

• Replaced all direct cURL calls with the WordPress HTTP API (wp_remote_*) for link and image checking, including the batch scanner. Redirects are now followed via the HTTP API while still reporting redirect chains and loops.
• WP-CLI blc export now writes CSV to STDOUT only (use shell redirection, e.g. wp blc export > report.csv); the arbitrary --file path option was removed.

2.4.7

• WordPress.org coding-standards hardening: explicit output escaping in the admin dashboard and post meta box, documented safe $wpdb queries, and translators comments for all i18n placeholders (Plugin Check compliance).

2.4.6

• Added a dismissible tip on the dashboard linking to the companion cloud scanner (brokenlinkscan.com) for a full-site crawl beyond posts and pages.

2.4.5

• Replaced PHP short echo tags (<?=) with full <?php echo in the post meta box (WordPress.org coding-standards compliance).
• Bumped "Tested up to" to WordPress 7.0 and aligned the readme plugin name with the plugin header.

2.4.4

• Hardened admin output escaping: replaced phpcs:ignore suppressions with explicit wp_kses(), esc_attr() and (int) casts in the dashboard view (WordPress.org coding-standards compliance).

2.4.3

• Document outbound HTTP scanning behavior under the new "External services" section of the readme (WordPress.org guideline 6 compliance).

2.4.2

• Removed the ACF field scanner from the free plugin (the code only ran when the Pro add-on enabled the related setting). ACF scanning is now provided entirely by the companion Pro plugin via the new blsc_extra_links filter.

2.4.1

• Removed all licence checks and premium-feature gating from the free plugin code (premium features — auto-scan cron, email/Slack notifications, ACF scanning, exclusions, CSV/XLSX export — are now distributed via a separate companion plugin).
• Removed the now-unnecessary load_plugin_textdomain() call (handled by WordPress.org translation system since WP 4.6).
• Added extension hooks for add-on plugins (settings defaults/sanitisation, scan-complete notification, scan/exclusion filters, admin UI).

2.4.0

• Added: Broken anchor detection (missing #id targets)
• Added: Redirect chain tracking and reporting
• Added: Slack notifications for scan results
• Added: Scan diff — compare results between consecutive scans
• Added: Health score dashboard with summary cards

2.2.0

• Fixed: Plugin header version now matches internal constant
• Fixed: SSL_VERIFYHOST set to 2 (was incorrectly disabled, MITM vulnerability)
• Fixed: Plugin action links basename corrected (Settings link now works on Plugins page)
• Fixed: Double scan race condition — pending state now blocks duplicate starts
• Fixed: Raw $_POST passed to settings save without wp_unslash()
• Fixed: save_scan_history() query now uses $wpdb->prepare()
• Improved: Nonce caching in list table rows (performance)
• Improved: Hardcoded French strings in admin.js replaced with i18n keys
• Removed: Dead code (page_by_post method, by-post.php template, unused CSS, blsc_manual_ok_urls option)
• Added: Missing admin notice keys (settings_saved, export_empty)

2.1.0

• Parallel HTTP checks via curl_multi
• Email alerts for new broken links
• Scan history and delta reporting
• XLSX export support
• Ignore list with persistent overrides
• By-post view integrated into dashboard

1.0.0

• Initial release