A broken link is a hyperlink that no longer reaches its intended destination. It usually happens when the target page is removed, renamed, or moved, and the browser returns an error or an unexpected page instead of the expected content.
What broken links are
A broken link is a hyperlink that no longer leads to the page, file, or resource it was meant to open. The destination may have been deleted, renamed, moved, or made inaccessible, so the click produces an error, a redirect loop, or an unrelated page instead of the intended content.
Broken links matter because they interrupt navigation and weaken trust in the content behind them. On a public website, a broken link can make guidance harder to verify, break user journeys, and reduce the usefulness of supporting references, especially when a page depends on external sources or internal documentation.
Common causes of broken links
Broken links often appear after routine content changes rather than from a technical fault in the browser. Common causes include URL changes during site migrations, deleted pages, case-sensitive path changes, renamed files, expired campaign pages, and broken anchors that point to a section that no longer exists.
They can also be created by content management mistakes, such as copying an old URL, pasting the wrong protocol, or linking to a page that exists only in one environment. External links are especially fragile because the destination site controls the target URL, structure, and retention policy. For API-linked destinations, broken references can have a different shape, and the OWASP API Security Top 10 is a useful reminder that broken references and exposure issues are often part of a wider access-control problem.
How broken links affect security and reliability
Most broken links are a quality or usability problem, but they can also affect security posture. If users cannot reach an authoritative source, they may rely on stale copies, search-engine snippets, or lookalike pages. In security documentation, that can hide important updates, such as changed guidance, retired controls, or revised incident-response steps.
Broken links can also be used as a trust signal in phishing or content-tampering scenarios when users become accustomed to navigating around missing pages. In operational terms, link rot reduces confidence in the integrity of published material and can weaken evidence chains when security teams need to validate references quickly. The NIST Cybersecurity Framework 2.0 is a practical reminder that resilience depends on maintaining dependable access to the information users need to govern, protect, detect, respond, and recover.
How organisations prevent and repair broken links
Preventing broken links is mainly a content governance problem. Stable URL design, redirects for moved content, and link checks during publishing all reduce the chance that readers hit dead ends. Good content ownership also matters, because someone must be responsible for updating links when a page is renamed, retired, or consolidated.
When broken links are found, the right fix depends on whether the destination should still exist. If the content was moved, a redirect and an updated source link are usually best. If the content is gone, replace the reference, remove it, or point readers to a maintained canonical source. For broader website hygiene, CIS Benchmarks provide the kind of hardening discipline that helps keep web platforms predictable, while OWASP SAMM is useful when teams want link and content checks embedded into the software delivery process.
Why broken links matter for maintainability
Broken links are a signal that content lifecycle management is weak. A site with many dead links often has broader problems in ownership, review cadence, redirects, and source control. That can be especially costly on long-lived pages, where outdated references accumulate silently over time.
In practice, link health is part of keeping published information usable. When teams treat link integrity as a routine maintenance task, they make documentation easier to trust, reduce confusion during incidents, and preserve the value of references that support decisions. Where content is generated or updated at scale, automated link validation is usually more reliable than occasional manual review.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and OWASP SAMM set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP API Security Top 10 | API9 — Improper Inventory Management | Broken references often stem from unmanaged or outdated API and content inventories. |
| Recommendation — Track published endpoints and references so moved or retired destinations are updated or removed promptly. | ||
| NIST CSF 2.0 | PR.DS-01 — Data-at-rest is protected | Reliable references support the integrity and availability of published security information. |
| Recommendation — Maintain current reference links so users can reach authoritative guidance without dead ends. | ||
| CIS Controls v8 | CIS-16 — Application Software Security | Web content and publishing workflows benefit from automated validation of links and references. |
| Recommendation — Add link checking to publishing controls so broken references are detected before release. | ||
| OWASP SAMM | Governance — Governance | Broken-link prevention depends on ownership, review, and change control in content delivery. |
| Recommendation — Assign ownership for content review so redirects and retired links are handled consistently. | ||
Related resources from NHI Mgmt Group
- Why do AI agents make broken authorization more dangerous?
- What is the difference between public link control and standard access review?
- How can security teams keep recovery processes from becoming the weakest link?
- What is the difference between broken access control and security misconfiguration in NHI environments?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org