Paste the links you paid for or earned. RankProof opens each page and tells you whether your link is still there, gone, or could not be checked, with the proof.
git clone https://github.com/CometWeb-io/rankproof.git
&& npm ci
Four real checks run on 7 Nov 2026 with RankProof 1.0.0: does this page link to that site? Raw response.
Still there, gone, or could not be checked. Never a guess between them.
A bot check, 403 or timeout is reported as “could not check”, not as a lost link.
Check a whole list in one call, from the app, the command line or your own code.
It reads the pages directly. No paid SEO API, account or key.
Domain in, verified backlinks out. Every link on the list was confirmed in the source page's HTML during the scan.
Recorded on 7 Nov 2026 from a local RankProof 1.0.0, US market. The scanning phase is sped up 15×; the scan itself took just under a minute.
Six scored parts you can open one by one. The weakest here is SERP visibility.
Numbers from the recorded run above. A live domain changes, so a new scan will differ.
A yes/no checker has to call every failed fetch "lost". RankProof keeps couldn't check apart from not there, and records how far each negative reaches.
A source page and the exact target URL it should link to.
source_url → target_url
SSRF-guarded request, robots respected, redirects re-checked hop by hop.
http_status · final_url
Every anchor extracted with its raw href, text, rel and placement.
html-anchor-v4
Scheme, host, path and query must match. Fragments are ignored.
exact-http-url-v2
Each observation says what was fetched, when, which parser read it and what matched. Pick a field to see it in a real response.
Real response from a local RankProof 1.0.0 run on 7 Nov 2026, trimmed to one anchor.
The same verification engine sits behind a local web app, a CLI and a versioned HTTP API.
Scan a domain, review verified links and site structure, export an HTML report.
$ rankproof help scan <domain> links, SERP, risk audit serp <domain> positions for keywords gap <domain> linking to rivals, not you doctor engines and parsers OK? -f, --format text | json | csv | html
Scripted scans with text, JSON, CSV or HTML output, ready for cron jobs and CI.
GET /health capabilities: ["backlinks.verify.v1"] POST /v1/backlinks/verify 1–50 source/target pairs ordered observations optional Bearer token
Check capabilities, send pairs, keep the observations in your own system.
Node.js 22 or newer. RankProof is not on npm yet, so it runs from a clone, on your machine, against your list.
Clone the repository and install its dependencies.
It binds to loopback. Set a token before you expose it anywhere.
Up to 50 pairs per request, answered in the order you sent them.
MIT-licensed code, tests on every push and a security policy that tells you exactly what counts as a bug.
Unit tests, browser smoke tests and an install-from-tarball check run in CI before anything lands on main.
Private ranges and cloud metadata are refused, DNS is validated before connecting and every redirect hop is re-checked.
The API binds to loopback. An optional Bearer token protects it when you run it behind another service.
CI fails on any known advisory in the full dependency tree, including the web app's.
Search-engine parsers are tested against frozen pages, so a markup change breaks a test, not your numbers.
No analytics SDK in the code. Requests go to the pages and open sources a scan needs.
A verification tool is only as useful as your understanding of what a result does not cover.
Links injected by scripts after load are not seen. not_found covers fetched HTML only.
It tells you a link exists and how it is marked up, not how Google values it.
Verification checks the pairs you supply. Discovery of unknown links is partial and labelled as such.
Authority, traffic and difficulty scores in the wider toolkit are documented heuristics, not third-party data.
Read the code, run it on your own list and check its answers against your own eyes.
