Beyond <a href> — Auditing iframe, embed, sameAs, and JSON-LD Links That Other Tools Miss

April 18, 2026

What it captures

Source	Why it matters
`<a href>`	Standard outbound links — what every tool catches.
`<iframe src>`	Third-party documents loaded inside your page. They run their own JavaScript and can rewrite their own contents. Trust each domain.
`<embed src>`, `<object data>`	Older media containers. Often missed by SEO tools.
`<video src>`, `<audio>` sources	Media URLs — frequently CDN-hosted, can change without you noticing.
`<img src>` + `srcset` + `<picture><source srcset>`	Every image origin. CDN domains, third-party CMS hosts.
`<script src>`	Third-party scripts — ad networks, analytics, embeds. Each one is a trust boundary.
`<link href>` by rel	Stylesheets, icons, manifests, AMP, alternate, canonical, preconnect.
Open Graph + Twitter Card meta	`og:image`, `og:video`, `twitter:image`, `twitter:player`.
Meta refresh	The forgotten redirect mechanism. Still in use.
JSON-LD blocks	`sameAs`, `url`, `contentUrl`, `thumbnailUrl`, `image`, `logo`, `@id`, `isBasedOn`, `citation`, `license`. The structured-data graph.

Open /tools/backlink-parser/ in your browser.
Paste the URL you want to inventory and click Parse.
Review the stats — pay attention to the Missing rel=noopener count (a security risk) and the Iframes count (each is a trust boundary).
Scan top external domains — anything you do not recognize is worth investigating.
Download the CSV for your records and copy the AI fix prompt to generate the cleanup checklist.

Iframes from unknown domains → either remove or sandbox (<iframe sandbox>).
External links opening in new tab without rel="noopener" → add the attribute everywhere. Without it, the destination page can read window.opener and redirect the original tab.
Affiliate links → add rel="sponsored". Honest disclosure protects rankings.
User-generated comment links → add rel="ugc". Tells Google not to pass authority.
Same-As URLs in JSON-LD → verify each profile links back to your site. Bidirectional verification is what makes sameAs work for E-E-A-T.

This tool pairs with Link Graph (site-wide topology), Internal Link Auditor (404 + redirect-chain detection), and Schema Validator (deeper JSON-LD validation).