An excluded embed URL can hide the actual URL it contains

[shunk031]

Summary

The link checker can miss a broken external link when an HTML page contains an embed URL with another URL in its query string.

A shortcode such as blogcard renders an iframe similar to this:

<iframe src="https://embed.example.test/card?url=<encoded-target>">

If the embed endpoint is listed in an exclude file, lychee 0.24.2 reports the target URL as [EXCLUDED] as well. This can leave readers with a dead link that the site checks do not report.

Reproduction

The current site contains a page with this pattern. Build the site and run lychee with the repository configuration and exclude files:

lychee public \\
  --root-dir "$PWD/public" \\
  --config .lychee/config.toml \\
  --exclude-file .lychee/exclude-temporary.txt \\
  --exclude-file .lychee/exclude-permanent.txt

The page contains both an embedded link and a direct occurrence of the same target. The target redirects once and returns 404 Not Found, but lychee reports it as [EXCLUDED] when the repository exclude file is loaded. If the exclusion is bypassed, lychee reports the target as broken.

The embed endpoint is excluded in .lychee/exclude-temporary.txt.

Expected behavior

Excluding an embed endpoint should exclude only that endpoint. It should not hide a URL carried in its query string or another direct occurrence of the same URL on the page.

If lychee intentionally treats the entire embedded URL as one excluded resource, the behavior should be documented clearly. A direct link to the same target should still be checked.

Possible resolution

• Narrow the exclusion so it matches only the failing embed endpoint.
• Keep direct URLs extracted from embedded markup in the normal link-check path.
• Add a minimal regression fixture covering an excluded embed URL with a broken nested target.