@@ -65,7 +65,7 @@ Community plugins are listed in [plugins.json](plugins.json), which UnderScript
 - `downloadURL` is only needed when the install link can't be derived from `updateURL`.
 - A plugin needs at least one of `updateURL` and `downloadURL`. With only `downloadURL`, UnderScript reads the version from it and installs from it, the same as `plugin.updater('https://...')`.
 
-Pull requests that change `plugins.json` are checked automatically. The file must be valid JSON, every entry needs a valid `name` and `author` and at least one of `updateURL` and `downloadURL` (https links only), and UnderScript must be able to read a version and an install link from them. Run `npm run plugins` to see the same errors locally, or `npm run plugins -- --offline` to skip the network part.
+Pull requests that change `plugins.json` are checked automatically. The file must be valid JSON, every entry needs a valid `name` and `author` and at least one of `updateURL` and `downloadURL` (https links only), and UnderScript must be able to read a version and an install link from them, and that link has to answer and not be a web page. Run `npm run plugins` to see the same errors locally, or `npm run plugins -- --offline` to skip the network part.
 
 To try entries out before pushing them, declare the file as a `plugins.json` resource in your development userscript header:
 
 
@@ -96,6 +96,30 @@ export async function resolve(entry) {
   return { version, url };
 }
 
+const HEAD_UNSUPPORTED = [403, 405];
+const PROBE = { maxRedirects: 5, validateStatus: () => true };
+
+async function reach(url) {
+  const response = await axios.head(url, PROBE);
+  if (!HEAD_UNSUPPORTED.includes(response.status)) return response;
+  const ranged = await axios.get(url, { ...PROBE, headers: { Range: 'bytes=0-0' }, responseType: 'stream' });
+  ranged.data?.destroy?.();
+  return ranged;
+}
+
+/**
+ * Makes sure an install link answers, and is not a web page.
+ * @param {string} url
+ * @returns {Promise<void>}
+ */
+export async function verify(url) {
+  const { status, headers } = await reach(url);
+  if (status >= 400) throw new Error(`${url} answered ${status}`);
+  if (/text\/html/i.test(headers?.['content-type'] ?? '')) {
+    throw new Error(`${url} is a web page, not a script`);
+  }
+}
+
 const HINTS = {
   'Version not found': 'the file has no // @version line',
   'URL not found': 'the file has no // @downloadURL line, and the entry has no downloadURL',
@@ -127,12 +151,19 @@ export async function check(text, { network = true } = {}) {
   const invalid = new Set(problems.map(({ index }) => index));
   const failures = await Promise.all(data.map(async (entry, index) => {
     if (invalid.has(index)) return undefined;
+    const fail = (message) => ({ index, name: entry.name, message });
+    let link;
+    try {
+      link = await resolve(entry);
+    } catch (e) {
+      return fail(`Could not resolve an install link: ${describe(e)}`);
+    }
     try {
-      await resolve(entry);
-      return undefined;
+      await verify(link.url);
     } catch (e) {
-      return { index, name: entry.name, message: `Could not resolve an install link: ${describe(e)}` };
+      return fail(`The install link does not work: ${describe(e)}`);
     }
+    return undefined;
   }));
   return [...problems, ...failures.filter(Boolean)];
 }
 
@@ -123,10 +123,18 @@ describe('plugins.json', () => {
 
   describe('network', () => {
     const original = axios.get;
+    const originalHead = axios.head;
     let responses;
+    let heads;
 
     beforeEach(() => {
       responses = new Map();
+      heads = new Map();
+      axios.head = async (url) => {
+        const answer = heads.get(url) ?? { status: 200, headers: { 'content-type': 'text/plain' } };
+        if (answer instanceof Error) throw answer;
+        return answer;
+      };
       axios.get = async (url) => {
         if (!responses.has(url)) {
           const error = new Error('Request failed with status code 404');
@@ -140,6 +148,7 @@ describe('plugins.json', () => {
 
     afterEach(() => {
       axios.get = original;
+      axios.head = originalHead;
     });
 
     describe('resolve', () => {
@@ -242,6 +251,58 @@ describe('plugins.json', () => {
         }]);
       });
 
+      describe('install link', () => {
+        const install = 'https://example.com/install.user.js';
+        const serve = () => responses.set('https://example.com/example.user.js', script([
+          '// @version 1.0.0',
+          `// @downloadURL ${install}`,
+        ]));
+        const run = async () => (await check(JSON.stringify([entry()])))
+          .map(({ message }) => message);
+
+        it('accepts a link that answers', async () => {
+          serve();
+          expect(await run()).to.deep.equal([]);
+        });
+
+        it('reports a link that answers 404', async () => {
+          serve();
+          heads.set(install, { status: 404, headers: {} });
+          expect(await run()).to.deep.equal([
+            `The install link does not work: ${install} answered 404`,
+          ]);
+        });
+
+        it('falls back to a ranged request when HEAD is refused', async () => {
+          serve();
+          heads.set(install, { status: 405, headers: {} });
+          responses.set(install, 'script');
+          expect(await run()).to.deep.equal([]);
+        });
+
+        it('reports a link that is a web page', async () => {
+          serve();
+          heads.set(install, { status: 200, headers: { 'content-type': 'text/html; charset=utf-8' } });
+          expect(await run()).to.deep.equal([
+            `The install link does not work: ${install} is a web page, not a script`,
+          ]);
+        });
+
+        it('reports a link that cannot be reached', async () => {
+          serve();
+          heads.set(install, new Error('getaddrinfo ENOTFOUND example.com'));
+          expect(await run()).to.deep.equal([
+            'The install link does not work: getaddrinfo ENOTFOUND example.com',
+          ]);
+        });
+
+        it('is skipped when offline', async () => {
+          serve();
+          heads.set(install, { status: 404, headers: {} });
+          expect(await check(JSON.stringify([entry()]), { network: false })).to.deep.equal([]);
+        });
+      });
+
       it('does not use the network when offline', async () => {
         const text = JSON.stringify([entry({ updateURL: 'https://example.com/missing.user.js' })]);
         expect(await check(text, { network: false })).to.deep.equal([]);