Pages with broken Link headers

What this report returns

Link response headers (RFC 8288) advertise machine-readable relationships (alternates, APIs, licensing) that agents can follow without parsing HTML.

A row appears here when any of these is wrong, worst first:

• Malformed SyntaxA `Link` value breaks the RFC 8288 grammar (target not in <angle brackets>, a parameter with a bad name or no value, or an unterminated quote), so a strict parser may drop it. A dangling `;` is not flagged: the RFC's own parsing algorithm reads past it.Fix Emit each link as <https://example.com/target&gt;; rel="alternate", with parameter values quoted.
• Missing RelA `Link` value declares no relation (the rel parameter is absent or empty, and RFC 8288 requires it), so agents can't tell what the link is for and ignore it.Fix Add a rel naming the relationship, e.g. rel="canonical".
• Invalid URIA `Link` value's target (or anchor) isn't a valid URI-Reference, so the reference points nowhere.Fix Emit a syntactically valid URI (relative and cross-scheme targets are fine; stray spaces and unescaped characters are not).
• Foreign AnchorA Link header uses anchor= to make a claim about a resource on another host, and RFC 8288 suggests applications may discard such third-party assertions, so agents may ignore it.Fix Drop the anchor, or publish the link from the host it describes.
• Insecure TargetThis https response's Link header points an agent at a plain http:// target, so following it downgrades to content that can be altered in transit. A Lumar bar: RFC 8288 allows it. Name-only relations (type, profile, license) are not judged.Fix Link the https URL.
• Duplicate RelA `Link` value repeats the rel parameter, which RFC 8288 forbids, so parsers ignore all but the first and the intent is ambiguous.Fix Keep a single rel per value (multiple relation types go inside one rel: rel="alternate canonical").
• Invalid RelA `Link` value's rel isn't valid relation-type(s): each space-separated type must be a registered token or an absolute-URI extension relation.Fix Use a registered IANA relation name (canonical, alternate, ...) or a full URI for a custom relation.

Security checks are provisional; precision has not yet been measured. A clean row is not a security assessment.

The columns it shows

Every defect this technology can carry is a column in the grid, worst first, so nothing is hidden behind a filter you have to know to apply.

• Link Header ValidlinkHeaderValid
• Link Header Conformance Issue DetectedlinkHeaderConformanceIssueDetected
• Link Header Security Risk DetectedlinkHeaderSecurityRiskDetected
• Link Header FindingslinkHeaderFindings
• Link Header Offending Value SampleslinkHeaderOffendingValueSamples
• Link Header RelationslinkHeaderRels
• Link Header Malformed SyntaxlinkHeaderMalformedSyntax
• Link Header Missing RellinkHeaderMissingRel
• Link Header Invalid URIlinkHeaderInvalidUri
• Link Header Foreign AnchorlinkHeaderForeignAnchor
• Link Header Insecure TargetlinkHeaderInsecureTarget
• Link Header Duplicate RellinkHeaderDuplicateRel
• Link Header Invalid RellinkHeaderInvalidRel
• Ruleset VersionrulesetVersion
• Security Check StatussecurityCheckStatus
• Related Security FrameworkssecurityFrameworkReferences

About HTTP Link header

Relations declared in headers, readable without parsing the body.

Read how HTTP Link header is checked, including the specification it is validated against and a worked correct and broken example.

Running it

This report comes with Agentic Readiness in Lumar and appears on every crawl of any project that has it turned on. See the whole set, or check a single URL with the scanner on this site, which runs the same code with no account.

Get Lumar pricing →