About This HTML Issue
A URL can't have [ or ] in its path, so the href of a <link> element needs them percent-encoded as %5B and %5D, or removed.
The URL Standard only allows square brackets around an IPv6 address in the host, as in http://[2001:db8::1]/. In the path they are invalid. The validator reports only the first bad character in each URL, and a ] with no [ before it gets the same error with ] in the message. In the query string, after the ?, the validator reports brackets as "Illegal character in query" instead.
In a <link>, the brackets often come from a template placeholder that never got replaced. Some content management systems, Drupal among them, write tokens in square brackets, such as [site:url], and swap them for real values when the page renders. If the token is misspelled or the module that fills it is turned off, the raw token ends up in the HTML. Browsers and search engines read it as a relative path and resolve it against the page's address, so a rel="canonical" link points to a URL that doesn't exist.
Fix the template so it prints the final URL. If the brackets really are part of a file name, encode them as %5B and %5D, or rename the file so the URL doesn't need them.
Invalid example
<link rel="canonical" href="[page:url]">
<link rel="stylesheet" href="/css/main[1].css">
Valid example
<link rel="canonical" href="https://example.com/about">
<link rel="stylesheet" href="/css/main%5B1%5D.css">
Find issues like this automatically
Rocket Validator scans thousands of pages in seconds, detecting HTML issues across your entire site.