Why redirects matter for security

Redirects are everywhere on the web. HTTP to HTTPS, www to non-www, old URLs to new ones. Most are harmless, but misconfigured redirects create real security vulnerabilities.

The three biggest risks are open redirects, redirect chains that bypass HTTPS, and loops that break availability.

Open redirects

An open redirect is a URL on your site that accepts a destination parameter and redirects the user to any URL, including external malicious sites.

https://yoursite.com/redirect?url=https://evil.com

Attackers use open redirects in phishing campaigns. The link starts with your trusted domain, so users and email filters are less likely to flag it.

How to fix open redirects

Redirect chains

A redirect chain is when one redirect leads to another, which leads to another. Each hop adds latency and creates a window where the connection might not be encrypted.

A dangerous pattern:

http://example.com > http://www.example.com > https://www.example.com

The first two hops are over plain HTTP. An attacker can intercept traffic at either point. The safe pattern redirects to HTTPS in the first hop:

http://example.com > https://www.example.com

How to fix redirect chains

HTTP-to-HTTPS redirect issues

The HTTP-to-HTTPS redirect is the most important redirect on your site. Getting it wrong creates a permanent vulnerability.

Common mistakes:

Redirect loops

A redirect loop occurs when page A redirects to page B, which redirects back to page A. Browsers detect this after a few hops and show an error page.

Common causes:

How to audit your redirects

Use cqwerty's Redirect Checker to trace the full redirect chain for any URL. It shows every hop, the status code, and whether each connection uses HTTPS.

Key takeaways

Check your redirects now