# Pages with broken Link headers

A per-URL report: one row per page that matches, over the pages a crawl reached.

## What this report returns

Link response headers (RFC 8288) advertise machine-readable relationships (alternates, APIs, licensing) that agents can follow without parsing HTML.

A row appears here when any of these is wrong, worst first:

-   **Malformed Syntax**A \`Link\` value breaks the RFC 8288 grammar (target not in <angle brackets>, a parameter with a bad name or no value, or an unterminated quote), so a strict parser may drop it. A dangling \`;\` is not flagged: the RFC's own parsing algorithm reads past it.**Fix** Emit each link as <`https://example.com/target&gt`;; `rel="alternate"`, with parameter values quoted.
-   **Missing Rel**A \`Link\` value declares no relation (the rel parameter is absent or empty, and RFC 8288 requires it), so agents can't tell what the link is for and ignore it.**Fix** Add a rel naming the relationship, e.g. `rel="canonical"`.
-   **Invalid URI**A \`Link\` value's target (or anchor) isn't a valid URI-Reference, so the reference points nowhere.**Fix** Emit a syntactically valid URI (relative and cross-scheme targets are fine; stray spaces and unescaped characters are not).
-   **Foreign Anchor**A Link header uses anchor= to make a claim about a resource on another host, and RFC 8288 suggests applications may discard such third-party assertions, so agents may ignore it.**Fix** Drop the anchor, or publish the link from the host it describes.
-   **Insecure Target**This https response's Link header points an agent at a plain http:// target, so following it downgrades to content that can be altered in transit. A Lumar bar: RFC 8288 allows it. `Name-only` relations (type, profile, license) are not judged.**Fix** Link the https URL.
-   **Duplicate Rel**A \`Link\` value repeats the rel parameter, which RFC 8288 forbids, so parsers ignore all but the first and the intent is ambiguous.**Fix** Keep a single rel per value (multiple relation types go inside one rel: `rel="alternate canonical"`).
-   **Invalid Rel**A \`Link\` value's rel isn't valid relation-type(s): each space-separated type must be a registered token or an absolute-URI extension relation.**Fix** Use a registered IANA relation name (canonical, alternate, ...) or a full URI for a custom relation.

Security checks are provisional; precision has not yet been measured. A clean row is not a security assessment.

## The columns it shows

Every defect this technology can carry is a column in the grid, worst first, so nothing is hidden behind a filter you have to know to apply.

-   Link Header Valid`linkHeaderValid`
-   Link Header Conformance Issue Detected`linkHeaderConformanceIssueDetected`
-   Link Header Security Risk Detected`linkHeaderSecurityRiskDetected`
-   Link Header Findings`linkHeaderFindings`
-   Link Header Offending Value Samples`linkHeaderOffendingValueSamples`
-   Link Header Relations`linkHeaderRels`
-   Link Header Malformed Syntax`linkHeaderMalformedSyntax`
-   Link Header Missing Rel`linkHeaderMissingRel`
-   Link Header Invalid URI`linkHeaderInvalidUri`
-   Link Header Foreign Anchor`linkHeaderForeignAnchor`
-   Link Header Insecure Target`linkHeaderInsecureTarget`
-   Link Header Duplicate Rel`linkHeaderDuplicateRel`
-   Link Header Invalid Rel`linkHeaderInvalidRel`
-   Ruleset Version`rulesetVersion`
-   Security Check Status`securityCheckStatus`
-   Related Security Frameworks`securityFrameworkReferences`

## About HTTP Link header

Relations declared in headers, readable without parsing the body.

[Read how HTTP Link header is checked](https://agentic-readiness.lumar.io/docs/discoverability/link-header), including the specification it is validated against and a worked correct and broken example.

## Running it

This report comes with Agentic Readiness in Lumar and appears on every crawl of any project that has it turned on. [See the whole set](https://agentic-readiness.lumar.io/scan-at-scale), or check a single URL with the [scanner on this site](https://agentic-readiness.lumar.io/), which runs the same code with no account.

[Get Lumar pricing →](https://www.lumar.io/pricing/)