@@ -213,7 +213,7 @@ Script options:
 | Command | Options |
 | --- | --- |
 | `node site/build.mjs` | `--clean` empties `site/dist` first (otherwise only changed files are written) |
-| `node site/check-links.mjs` | `--report <file.md>` writes the report to a file; `--stale-days <n>` (365) flags entries verified longer ago. Set `GITHUB_TOKEN`: without it the archived-repository checks hit GitHub's anonymous API limit and report "Could not check" |
+| `node site/check-links.mjs` | `--report <file.md>` writes the report to a file; `--stale-days <n>` (365) flags entries verified longer ago. Set `GITHUB_TOKEN`: without it the archived-repository checks hit GitHub's anonymous API limit and report "Could not check" It also fetches the licence pages quoted in each entry's Evidence and reports one that no longer loads. Entries on hosts in `site/config.json` → `linkCheck.manualHosts` (hosts that refuse scripts every week) are listed as checked by hand with their verified date, not as refused. |
 | `node site/reverify-batch.mjs` | `--report <file.md>`; `--size <n>` overrides the computed batch size |
 | `node site/thumbs.mjs` | `--only <id,id>` limits the run to those entries; `--force` refetches records that are not due; `--limit <n>` caps fetches per run; `--dry-run` writes nothing; `--report <file.md>` |
 | `node site/serve.mjs` | `--port <n>`, or the `PORT` environment variable (3000) |
 
@@ -28,12 +28,16 @@ import { safeFetch } from "./lib/safe-fetch.mjs";
 import { isListed } from "./lib/shared.mjs";
 import { normalizeEntry } from "./lib/entry-fields.mjs";
 import { cliArgs } from "./lib/cli.mjs";
-import { checkMaintenanceRepos, classify, reportUrl, staleDaysFrom } from "./lib/link-check.mjs";
+import { checkMaintenanceRepos, classify, evidenceUrls, manualHostReason, reportUrl, staleDaysFrom } from "./lib/link-check.mjs";
+import { evidenceSection } from "./lib/frontmatter.mjs";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const ROOT = path.resolve(__dirname, "..");
 const CATALOG = path.join(ROOT, "catalog");
-const REPO = JSON.parse(fs.readFileSync(path.join(__dirname, "config.json"), "utf8")).site.repo;
+const CONFIG = JSON.parse(fs.readFileSync(path.join(__dirname, "config.json"), "utf8"));
+const REPO = CONFIG.site.repo;
+// Hosts that refuse scripts every week (#89): listed as checked by hand.
+const MANUAL_HOSTS = CONFIG.linkCheck?.manualHosts || {};
 const CONCURRENCY = 8;
 const TIMEOUT_MS = 20000;
 const UA =
@@ -46,7 +50,9 @@ function loadEntries() {
   for (const r of readCatalog(CATALOG, { root: ROOT })) {
     if (!usableRecord(r) || !r.parsed.meta.url) continue;
     const { id, url, verified, status, maintenance = null } = normalizeEntry(r.parsed.meta, r.rel);
-    out.push({ id, url, verified, status, maintenance, rel: r.rel });
+    // The licence pages the Evidence quotes, other than the entry's own url.
+    const licencePages = evidenceUrls(evidenceSection(r.parsed.body)).filter((u) => u !== url);
+    out.push({ id, url, verified, status, maintenance, rel: r.rel, licencePages });
   }
   return out.sort((a, b) => a.id.localeCompare(b.id));
 }
@@ -76,6 +82,8 @@ async function run(entries) {
         // One retry for anything that did not answer cleanly, except a full
         // 20 s timeout: a second one would cost a worker 40 s per dead host.
         if (r.kind === "dead" && !r.timedOut) r = await check(entries[i]);
+        // A refusal is not retried, and the checker never poses as a browser:
+        // a host that refuses scripts goes on the manual list (config.json).
         results[i] = r;
       }
     })
@@ -107,6 +115,11 @@ if (staleArg.error) {
 const staleDays = staleArg.days;
 const entries = loadEntries().filter(isListed);
 const results = await run(entries);
+// Licence pages quoted in Evidence, each fetched once (#89). Only a page that
+// is gone is reported; a refusal says nothing about the licence.
+const pageJobs = [...new Map(entries.flatMap((e) => e.licencePages.map((url) => [url, { id: e.id, rel: e.rel, url }]))).values()];
+const pageResults = await run(pageJobs);
+const deadPages = pageJobs.map((j, i) => ({ ...j, ...pageResults[i] })).filter((r) => r.kind === "dead");
 const { mismatches: maintenance, skipped } = await checkMaintenance(entries);
 const cutoff = new Date(Date.now() - staleDays * 86400000).toISOString().slice(0, 10);
 const rows = entries.map((e, i) => ({ ...e, ...results[i] }));
@@ -116,8 +129,10 @@ const line = (r) => `- [ ] [\`${r.id}\`](${REPO}/blob/main/${r.rel}): ${reportUr
 
 const dead = pick("dead");
 const moved = pick("moved");
-const blocked = pick("blocked");
-const problems = dead.length + moved.length + stale.length + maintenance.length;
+const refused = pick("blocked");
+const blocked = refused.filter((r) => !manualHostReason(r.url, MANUAL_HOSTS));
+const byHand = refused.filter((r) => manualHostReason(r.url, MANUAL_HOSTS));
+const problems = dead.length + moved.length + stale.length + maintenance.length + deadPages.length;
 const date = new Date().toISOString().slice(0, 10);
 const report = [
   `Link check of ${entries.length} active and needs-review entries, run ${date}.`,
@@ -132,6 +147,10 @@ const report = [
   "",
   ...(moved.length ? moved.map(line) : ["None."]),
   "",
+  `### Licence pages quoted in Evidence that no longer load (${deadPages.length})`,
+  "",
+  ...(deadPages.length ? deadPages.map(line) : ["None."]),
+  "",
   `### Verified more than ${staleDays} days ago (${stale.length})`,
   "",
   ...(stale.length ? stale.map((e) => `- [ ] [\`${e.id}\`](${REPO}/blob/main/${e.rel}): verified ${e.verified}`) : ["None."]),
@@ -151,10 +170,16 @@ const report = [
   "",
   "</details>",
   "",
+  `<details><summary>Checked by hand (${byHand.length}): hosts that refuse scripts (site/config.json linkCheck), last read on the verified date</summary>`,
+  "",
+  ...(byHand.length ? byHand.map((r) => `- [\`${r.id}\`](${REPO}/blob/main/${r.rel}): verified ${r.verified || "never"} (${manualHostReason(r.url, MANUAL_HOSTS)})`) : ["None."]),
+  "",
+  "</details>",
+  "",
 ].join("\n");
 
 const reportPath = flags.report ?? null;
 if (reportPath) fs.writeFileSync(reportPath, report);
 else process.stdout.write(report);
 if (process.env.GITHUB_OUTPUT) fs.appendFileSync(process.env.GITHUB_OUTPUT, `problems=${problems}\n`);
-console.error(`${entries.length} checked: ${dead.length} dead, ${moved.length} moved, ${stale.length} stale, ${maintenance.length} maintenance, ${blocked.length} blocked, ${skipped.length} API checks skipped`);
+console.error(`${entries.length} checked: ${dead.length} dead, ${moved.length} moved, ${stale.length} stale, ${maintenance.length} maintenance, ${deadPages.length} dead licence pages, ${blocked.length} blocked, ${byHand.length} checked by hand, ${skipped.length} API checks skipped`);
@@ -7,6 +7,28 @@
     "siteUrl": "https://tmhsdigital.github.io/Free-Game-Dev-Assets/"
   },
   "expectedEntryCount": 421,
+  "linkCheck": {
+    "_comment": "Hosts that refuse scripted requests whatever the source's health (403/429 every week in the link report, #77). check-links lists their entries under 'Checked by hand' with the entry's verified date instead of 'Refused'. Remove a host when it starts answering.",
+    "manualHosts": {
+      "fab.com": "Fab answers scripts with 403; read listings in a browser",
+      "blendkit.com": "answers scripts with 403",
+      "pixabay.com": "answers scripts with 403",
+      "pexels.com": "answers scripts with 403",
+      "zapsplat.com": "answers scripts with 403",
+      "vidsplay.com": "answers scripts with 403",
+      "si.edu": "answers scripts with 403",
+      "myminifactory.com": "answers scripts with 403",
+      "earthdata.nasa.gov": "answers scripts with 403",
+      "destockd.com": "answers scripts with 403",
+      "cloudcompare.org": "answers scripts with 403",
+      "vroid.com": "answers scripts with 403",
+      "sonniss.com": "answers scripts with 403",
+      "simpleicons.org": "answers scripts with 403",
+      "poly.pizza": "answers scripts with 403",
+      "musopen.org": "answers scripts with 403",
+      "freepbr.com": "answers scripts with 403"
+    }
+  },
   "categories": {
     "3d": { "label": "3D", "blurb": "Models, scans, PBR textures", "view": "cards" },
     "environment": { "label": "Environment", "blurb": "HDRI, terrain, geodata", "view": "cards" },
 
@@ -2398,6 +2398,25 @@ await section("shortlist owes and view actions (#110)", async () => {
   for (const id of ["shortlist-owes", "view-actions", "copy-view-link"]) has(`homepage has #${id}`, tpl, `id="${id}"`);
 });
 
+/* link check: manual hosts and licence pages (#89) ------------------------- */
+await section("link check: manual hosts and licence pages (#89)", async () => {
+  const { manualHostReason, evidenceUrls } = await import("./link-check.mjs");
+  const hosts = { "fab.com": "403 to scripts", "earthdata.nasa.gov": "403" };
+  eq("manual host: www. is ignored", manualHostReason("https://www.fab.com/listings/x", hosts), "403 to scripts");
+  eq("manual host: a subdomain matches", manualHostReason("https://cdn.fab.com/x", hosts), "403 to scripts");
+  eq("manual host: a lookalike does not", manualHostReason("https://notfab.com/x", hosts), null);
+  eq("manual host: a sibling of a listed subdomain does not", manualHostReason("https://www.nasa.gov/x", hosts), null);
+  eq("manual host: not a URL", manualHostReason("nope", hosts), null);
+  const ev = "## Evidence\n- Licence page (2026-09-01): https://x.test/licence. \"CC0\"\n- Repo LICENSE (2026-09-01): <https://github.com/o/r/blob/main/LICENSE>\n- Again: https://x.test/licence";
+  eq("evidence urls: in order, once, without trailing punctuation", evidenceUrls(ev).join(" "), "https://x.test/licence https://github.com/o/r/blob/main/LICENSE");
+  eq("evidence urls: none", evidenceUrls(null).length, 0);
+  const fsm = (await import("node:fs")).default;
+  const cfg = JSON.parse(fsm.readFileSync(new URL("../config.json", import.meta.url), "utf8"));
+  for (const [host, reason] of Object.entries(cfg.linkCheck.manualHosts)) {
+    eq(`config manual host ${host} is a bare lower-case host with a reason`, /^[a-z0-9.-]+\.[a-z]+$/.test(host) && !host.startsWith("www.") && reason.length > 0, true);
+  }
+});
+
 /* report (keep last) ------------------------------------------------------ */
 if (failures.length) {
   console.error(`lib.test failed (${failures.length}):`);
 
@@ -21,6 +21,38 @@ export function siteOf(hostname) {
   return labels.slice(-take).join(".");
 }
 
+/**
+ * The reason a host is on the manual-check list (site/config.json
+ * linkCheck.manualHosts), or null. A listed host matches itself and its
+ * subdomains (#89).
+ */
+export function manualHostReason(url, manualHosts = {}) {
+  let host;
+  try {
+    host = new URL(url).hostname.toLowerCase().replace(/^www\./, "");
+  } catch {
+    return null;
+  }
+  for (const [listed, reason] of Object.entries(manualHosts)) {
+    if (host === listed || host.endsWith(`.${listed}`)) return reason;
+  }
+  return null;
+}
+
+/**
+ * The http(s) URLs quoted in an entry's `## Evidence` section, once each and
+ * in order, without trailing punctuation: the licence pages the entry rests
+ * on, which the weekly check fetches too (#89).
+ */
+export function evidenceUrls(evidence) {
+  const out = [];
+  for (const m of String(evidence || "").matchAll(/https?:\/\/[^\s<>"'`)\]]+/g)) {
+    const url = m[0].replace(/[.,;:!?]+$/, "");
+    if (!out.includes(url)) out.push(url);
+  }
+  return out;
+}
+
 /** owner/repo of a github.com URL, lowercased. A transferred repository redirects within github.com. */
 export const repoOf = (url) => new URL(url).pathname.split("/").slice(1, 3).join("/").toLowerCase();