A dead link is a hyperlink that no longer works because its destination is missing or unreachable. In practice it is often used interchangeably with broken link, and it points to the same failure mode of a link resolving to an error page or nothing at all.
What a dead link means in practice
A dead link is not just a small usability flaw. It is a content integrity failure that breaks navigation, interrupts user journeys, and can make a page or resource feel outdated or unmaintained. For readers, the immediate effect is friction; for site owners, it is a signal that the destination has moved, been removed, or is otherwise no longer reachable.
Common causes of dead links
Dead links usually appear when the target page is deleted, renamed, or moved without a redirect. They can also result from typoed URLs, expired campaign pages, removed files, or external sites that change structure over time. The failure mode is the same: the browser cannot resolve the intended destination, so the hyperlink no longer performs its job.
On larger sites, dead links often accumulate after content migrations, redesigns, CMS changes, or mergers. In that sense, they are frequently a maintenance problem rather than a single-point technical fault. The more links a site has, the more important it becomes to preserve link hygiene across templates, archives, and external references.
Why dead links matter for trust and discoverability
Dead links damage credibility because they suggest stale content or weak editorial control. They also reduce discoverability: internal dead links can hide important pages from users and crawlers, while external dead links can leave citations and references unusable. A page with repeated dead links can create a poor experience even when the surrounding content is accurate.
They are especially harmful in documentation, policy pages, help centres, and research material, where readers rely on links to verify claims or continue a workflow. In those settings, a dead link can make an otherwise useful page harder to trust and harder to act on.
How organisations manage and fix dead links
The practical response is to identify broken destinations, determine whether the content has moved, and either restore the page, update the link, or apply a redirect where appropriate. For external references, a replacement source may be better than pointing users to an archive or an error page. For internal content, preserving stable URLs and maintaining redirects is usually the cleanest way to protect long-lived references.
NIST SP 800-53 Rev 5 Security and Privacy Controls is useful here because link integrity sits naturally alongside configuration management, monitoring, and content maintenance controls. Site teams that treat link health as part of routine governance are less likely to lose important destinations during change.
NIST Cybersecurity Framework 2.0 also maps well to dead-link management because it encourages disciplined governance, asset awareness, and recovery of disrupted services and content paths.
How to monitor and prevent dead links
Prevention is usually a combination of automated checking and disciplined publishing practice. Regular link scans, redirect reviews, URL change control, and post-migration validation help catch failures before users do. The most reliable teams also check externally referenced pages during content reviews, because outside dependencies can disappear without warning.
OWASP Non-Human Identity Top 10 is not about dead links specifically, but it is a useful reminder that many operational failures come from unmanaged dependencies and stale references. That same maintenance mindset applies to link integrity: if a destination matters, it needs ownership, review, and lifecycle control.
CIS Benchmarks are also relevant in a broader sense because hardened, well-governed environments tend to have better operational hygiene, including more reliable content and configuration management practices.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OC-01 — Organizational Context | Dead links affect content governance and ownership of published resources. |
| ID.AM-01 — Physical Devices and Systems Inventory | Dead-link management depends on knowing what published assets and destinations exist. | |
| Recommendation — Assign ownership for link integrity across content lifecycles. Maintain an inventory of published pages and linked destinations. | ||
| NIST SP 800-53 Rev 5 | CM-2 — Baseline Configuration | Stable URLs and redirects are part of controlled content configuration. |
| AU-6 — Audit Review, Analysis, and Reporting | Broken-link scans and reports support ongoing detection of link failures. | |
| Recommendation — Control URL changes through managed configuration baselines. Review link-check reports to find and remediate failures quickly. | ||
| CIS Controls v8 | CIS-17 — Incident Response Management | Dead links can surface after migrations or outages and need tracked remediation. |
| Recommendation — Track recurring broken links as operational issues and close them through change control. | ||
Related resources from NHI Mgmt Group
- What is the difference between public link control and standard access review?
- How can security teams keep recovery processes from becoming the weakest link?
- Which framework best frames the link between patching and identity security here?
- How can organisations link benchmarking to continuous improvement?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org