Broken Link Checker for Confluence / Updated 20 September 2026
Security and permissions
Broken Link Checker reads links in Confluence pages that the current user can access. Public HTTPS links are checked automatically; a space administrator can exclude exact hostnames or URLs. Broken Link Checker publishes a URL replacement only after an authorized user reviews the preview and saves it.
Optional owner reminders are off by default. When enabled, Broken Link Checker can add a native Confluence comment for open, confirmed broken links.
Where the app runs
Broken Link Checker runs on Atlassian Forge using Custom UI, backend resolvers, KVS and Async Events. It does not operate a separate application server or remote database.
Permissions and why they are needed
| Permission | Purpose |
|---|---|
| read:space:confluence | List accessible spaces and check whether the current user can administer a space. |
| read:page:confluence | Extract links, read current ownership, validate source/target access and compare page versions. |
| read:user:confluence | Display the current owner's name in an accessible result. |
| write:page:confluence | Publish only the replacements explicitly reviewed and saved by an authorized user. |
| write:comment:confluence | Add optional owner reminder comments to pages with open confirmed broken links. |
| storage:app | Store scan results, hashes, settings and work state in installation-scoped Forge storage. |
Access and replacement safeguards
Backend checks require a signed-in user, current space access and current page access. Scan configuration and deletion require a space administrator. Work actions require the current owner or space administrator. Replacements additionally check Confluence edit permission, preview signature/expiry, page version, body hash and unpublished draft changes. Page writes use the user's Confluence identity; background reads and optional reminder comments use the app identity.
External link checks
External checks require public DNS addresses, HTTPS on port 443, manual redirect validation, a six-second deadline and a response sample capped at 16 KiB. Explicit domain and URL exclusions apply before each DNS lookup and redirect request. IP literals, local hostnames, embedded credentials and obvious secret-bearing query parameters are rejected. Authentication credentials are not forwarded. Wildcard Forge egress permission allows public destinations; the application applies these restrictions before each request. Plain HTTP is unsupported by the Forge runtime's HTTPS-only outbound policy, and the app does not substitute HTTPS. Forge's proxy performs its own resolution, so the app does not claim DNS pinning. The DNS preflight alone does not establish protection against DNS rebinding; confirmation of the proxy's connection-time address restrictions is pending.
App resources and diagnostic logs
The UI uses bundled resources and Confluence theme tokens without third-party fonts or analytics. CSV exports escape formula prefixes. Logs deliberately exclude page bodies, URL destinations, profile data, cookies and authorization headers. Dependency auditing and access/queue/URL/replacement regression tests form part of release validation.
Certifications and vulnerability reporting
The app does not claim an independent penetration test, a SOC 2 report, Cloud Fortified status or Runs on Atlassian status. Atlassian's own platform certifications do not constitute a separate certification of this app. See the support page for vulnerability reporting.