Fixing TYPO3 linkvalidator false positives on external URLs

A TYPO3 site can show an external link as healthy in a browser while Link Validator marks it as broken. The reason may be as vague as “not accessible”, “malformed URL”, a timeout, or a redirect error. That usually indicates a difference between the visitor’s browser and the server-side request, not that every visitor is affected.

The reliable approach is to reproduce the request from the TYPO3 server, identify the exact URL or HTTP failure, and fix that cause. Excluding a domain may hide a genuine outage, while rewriting content can remove the warning without making the destination healthier.

Reproduce the failure outside TYPO3

Copy the actual href from the rendered HTML rather than relying on the visible link text. Check for trailing spaces, duplicated query parameters, missing schemes, escaped characters and changed paths. A .com.au domain is just as case-sensitive in its path as any other domain, even though the hostname itself is not.

Run both common HTTP methods and record the status, redirect chain and final URL:

curl -I -L --max-redirs 5 "$TARGET_URL"
curl -L -o /dev/null -sS -w '%{http_code} %{url_effective}\n' "$TARGET_URL"

Comparing HEAD and GET matters because some servers reject HEAD with 405 Method Not Allowed while serving GET normally. If the TYPO3 release uses HEAD, that difference can explain the false positive. If both methods fail, investigate DNS, TLS and network routing.

Run the check from the same host and network as PHP-FPM. A useful public control is Brightnewt's public homepage: if it succeeds from the application server while the customer’s URL fails, the problem is narrower than a general loss of outbound connectivity.

Read the validator result in context

Open the Link Validator backend module for the relevant workspace and expand the affected record. Note the exact checked URL, response status, timestamp and detailed reason. Confirm that the content field is included in the validation scope and rerun an older result before treating it as current.

The validator acts as an HTTP client, not as a complete browser. It may not execute JavaScript, retain browser cookies, accept a security challenge or pass a consent screen. A web application firewall can return 403 Forbidden to an automated request while allowing a browser through with cookies, JavaScript and a trusted user agent.

Also compare the stored field with the generated anchor. HTML query separators may correctly appear as & in source markup, but the parser should decode them. Do not replace every ampersand globally. Percent-encode spaces, convert internationalised domains to punycode where necessary and ensure the stored value uses the scheme and characters expected by the checker.

Separate link defects from access policy

A 403 or 429 response usually means the destination exists but denied or delayed the request. Common causes include WAF rules, rate limiting, geographic restrictions, IP reputation and authenticated gateways. Australian sites often use global CDNs with Sydney, Melbourne or Brisbane points of presence, so a request from the TYPO3 server may follow a different route from an Australian visitor.

A 405 on HEAD combined with 200 on GET is a method problem. If the installed linkvalidator release exposes request-method configuration, use GET only after confirming that the target supports it safely. Authentication failures such as 401 and proxy responses such as 407 point towards credentials or network configuration rather than malformed content.

Timeouts can come from DNS, IPv6 routing, certificate negotiation or an outbound firewall. Compare dig A, dig AAAA, curl -4 and curl -6, then test the TLS chain. A NBN-connected office router does not describe the hosting server’s route, and connections through Telstra, Optus or Aussie Broadband can behave differently from business data-centre egress.

Trace redirects and canonical hosts

Follow the complete redirect chain with curl -I -L. Redirects between www and the apex domain, or between HTTP and HTTPS, may be intentional, but Link Validator can report them as warnings or errors depending on the TYPO3 release. Store the final canonical HTTPS URL when it is stable, while avoiding links that append tracking parameters or depend on a session.

Some redirect loops occur because a protected resource sends the checker to a login or consent page that redirects back again. Others come from a stale host mapping. Australian organisations commonly maintain .com.au domains alongside .com or .au properties and state-specific paths such as /nsw/, /qld/ or /vic/; each may redirect to a different regional destination.

Correcting the source link is preferable to suppressing every redirect warning. An exclusion should cover only the proven false positive, such as one authenticated host or a temporary campaign path. A broad rule for an entire domain can conceal a takeover, an expired certificate or a genuine content outage.

Compare the TYPO3 runtime with your shell

A successful command on a developer’s laptop does not prove that the TYPO3 backend can reach the same URL. PHP-FPM or a container may use another DNS resolver, proxy, CA bundle, user account and IPv6 route. Run the diagnostic as the application service account and from inside the same container or server environment.

Check the PHP cURL extension, CA certificates, request timeout and any HTTP_PROXY or HTTPS_PROXY settings used by the application. PHP-FPM often does not inherit proxy variables exported in an interactive shell. A working curl binary can also hide a PHP-specific problem when its TLS library or trust store differs.

My separate NDK build issues note follows the same environment-first principle: correcting the host and toolchain mismatch is usually more durable than changing application code. For Link Validator, repeat the exact request inside TYPO3 and record the final URL and status without logging cookies, query secrets or response bodies.

Apply durable fixes with a verification checklist

Once the evidence identifies the layer, apply the narrowest correction. Repair malformed source URLs in TYPO3, publish valid DNS and certificate records, adjust server-side request settings or ask the destination provider to authorise the traffic. Keep TYPO3 and its linkvalidator extension on supported patch levels because HTTP handling can change between releases.

• Store a clean, absolute HTTPS URL at the source of the link.
• Test the exact URL with GET and the method used by the validator.
• Compare DNS, IPv4, IPv6 and TLS results from the TYPO3 runtime.
• Ask the provider to adjust WAF, rate-limit or geographic rules.
• Exclude only a specific host and path when the target genuinely requires authentication.
• Record the response status, final URL, timestamp and applied correction.

Document why each exception exists and set a review date. A permanent exclusion is rarely appropriate for a temporary firewall block, while a recurring provider redirect should be removed at source. After changing configuration, clear cached Link Validator results if necessary and run a fresh check.

Choose the narrowest durable correction

Match the observed response to its likely layer before changing production settings. The quickest diagnosis comes from reproducing the request with the same method, headers and network path as TYPO3.

Observed result	Likely layer	Best evidence	Preferred correction
GET returns 200, HEAD returns 405	Request method	Repeat both methods	Configure GET or use a suitable endpoint
403 or 429 only from TYPO3	WAF, geography or rate limit	Compare source IP and headers	Adjust provider rules or request frequency
Redirect chain or redirect loop	Host mapping or authentication	Follow every Location header	Store the canonical URL or repair the target
DNS, IPv6 or TLS timeout	Network or certificate	Compare A/AAAA records and TLS chain	Repair routing, DNS or certificate deployment
Malformed result despite a working browser	Stored URL or parser	Compare field value with rendered HTML	Rewrite the source value cleanly
200 response with a missing resource	Soft 404 or scripted page	Inspect the final response	Correct the destination or narrowly exclude it

A 403 is evidence of an access policy, not automatically a broken link, while a 200 can still hide a soft 404. Preserve the raw evidence so the chosen correction addresses the actual failure.

Before resolving the ticket, rerun the original request from the TYPO3 runtime and then rerun Link Validator. Save the status, final URL and timestamp in the maintenance note, giving the next investigation a reproducible baseline rather than another unexplained failure.