Honest about CORS

Broken Link Checker

Paste a list of URLs and check each one, five at a time, right from your own browser — with a clear, honest explanation of what CORS lets a browser actually see.

Before you check: browsers only expose a real HTTP status code for same-origin requests or cross-origin servers that opt in with CORS headers. For everything else, this tool falls back to a no-cors reachability check that can only tell you "something answered," not whether it was a 200 or a 404. Results are labeled clearly so you always know which kind of answer you're looking at.
0OK
0Error status
0Status hidden
0Unreachable

Paste some URLs above and click "Check links" to see results here.

Concurrency-limited

Up to five URLs are checked at once so a long list doesn't hammer any single server.

🔒

Runs in your browser

Every request comes straight from your machine. Nothing is proxied through a server.

Honest about limits

Hidden-status results are never guessed at or faked — they're labeled exactly for what they are.

How to use the broken link checker

Test a batch of links quickly, straight from your browser.

  1. Paste your URLsOne URL per line, including the protocol (https://).
  2. Click Check linksUp to five checks run at a time using fetch, with a CORS attempt first.
  3. Read the resultsEach row shows a real status when possible, or an honest "status hidden" or "unreachable" label.

Why some results say "status hidden"

Browser security (the same-origin policy) exists specifically to stop a webpage's JavaScript from reading responses from other sites. A cross-origin fetch either needs the target server's explicit permission through CORS headers, or it can only be sent in "no-cors" mode, which lets the request go out but hides the response entirely from your code. This tool tries the honest, informative option first and only falls back to the limited one when it has to.

Full status (CORS)

When a cross-origin server sends Access-Control-Allow-Origin headers, or the URL is same-origin, the real HTTP status code and ok/fail result are shown.

Status hidden (no-cors)

When the CORS request fails, a no-cors fetch is tried. If it resolves at all, the URL is marked reachable but its status stays hidden by browser design.

Unreachable

If both attempts throw, the most likely causes are DNS failure, no listener on that host, a strict security policy, or an extension actively blocking the request.

For full certainty

A server-side link checker or a tool like curl avoids the browser's cross-origin restrictions entirely and can always read the real status code.

Broken link checker FAQ

Questions about CORS, reachability results and privacy.

Why can't I see the real status code for every link?

Browsers enforce the same-origin policy. A cross-origin fetch only exposes response.status when the remote server opts in with permissive CORS headers. Most ordinary websites don't send those headers, so the browser hides the status of the response entirely for security reasons.

What does "Reachable (status hidden)" mean?

It means a no-cors fetch to that URL resolved without a network error. The browser did get some kind of response, but because it's an opaque response, JavaScript cannot read its status code, so this tool can't tell you whether it was a 200 or a 404.

What causes a URL to show as "Unreachable"?

Both the CORS and no-cors fetch attempts failed outright, which usually means a DNS failure, no server listening, a strict Content-Security-Policy, an ad blocker or browser extension, or the target actively refusing the connection.

Does this tool work better for links on my own site?

Yes. Same-origin requests, and any cross-origin server that sends permissive CORS headers, return a fully readable status code and pass/fail result instead of the hidden-status fallback.

Is my list of URLs sent to a server?

No. Every request is made directly from your own browser to each URL you paste. This tool has no backend and never stores or transmits your list.