What Scanfully does not scan
Scanfully crawls your site from the outside, the way a visitor who is not logged in sees it. Both the links crawl and the media crawl work from the HTML your server sends when a page loads.
Scanfully does not log in, does not click or fill in anything, does not run your page’s JavaScript, and does not read your WordPress database or internal APIs.
Content that is not scanned
Section titled “Content that is not scanned”Some links and media never appear in the report because the crawl cannot see them. This includes links and media that:
- only appear after a click, a form submission or another interaction,
- need a login or user-specific permissions,
- are added by JavaScript after the page loads,
- depend on cookies, location or other visitor state.
Pages that are not crawled
Section titled “Pages that are not crawled”- Pages too far from the home page: Scanfully follows links up to the maximum depth. Add the pages to your sitemap or to Extra pages to have them checked anyway.
- Pages on other domains and subdomains: links to them are checked, but the pages themselves are not crawled. A subdomain such as
shop.example.comis a separate site; add it as its own site to crawl it. - Pages that match an exclusion rule in the crawl settings.
- Pages that answer with an error, or that redirect to another domain: Scanfully does not check the links on them. A broken page you link to shows up as a broken link instead.
Links and media that are always left out
Section titled “Links and media that are always left out”Scanfully leaves out some addresses by itself, because they are not web pages or because checking them only produces false alarms. For links: mailto:, tel: and javascript: links, anchors on the same page, and links to Facebook, Instagram, LinkedIn, Bluesky and Google Maps. For media: inline data: files, Google Analytics, Google Tag Manager, Google Fonts and Google Maps. Cloudflare’s /cdn-cgi/ addresses are left out of both.
Addresses that are not on the public internet, such as localhost or a private network address like 192.168.1.10, are not checked either.
Access restrictions and firewalls
Section titled “Access restrictions and firewalls”If your site uses a firewall, geo-blocking, bot protection or an IP allowlist, it may block Scanfully from some pages, links or media. Those can then show as broken (often with a 403 or 429) while they work for your visitors. Scanfully has no fixed IP addresses to allow, so send a header your firewall recognizes with custom request headers and allow requests that carry it.
The same happens with other sites you link to: many block crawlers. When a target works in your browser, add it to Links to ignore or Media to ignore in the crawl settings.
What Scanfully does not decide for you
Section titled “What Scanfully does not decide for you”Scanfully reports what happens, not what was meant. It does not guess whether a broken link is intentional or whether a missing file is acceptable: if it fails to load, it is reported. Use the ignore lists for the ones you want to keep.
Why these limits exist
Section titled “Why these limits exist”Scanning from the outside means Scanfully adds no work to your WordPress site, stores nothing in it, and reports what real visitors get.