Redirect Checker
Follow a URL through every hop and see where it really ends up.
A redirect chain is one of those things that works until it does not. Each hop is a full round trip — DNS, TCP, TLS, request, response — and on a mobile connection four hops can add most of a second before a single byte of the page arrives. Clients also give up eventually, so a chain that grows one hop at a time as a site is reorganised will one day stop resolving for someone.
The security question is where the chain touches plain HTTP. Starting on HTTP and being redirected to HTTPS is normal and correct. Ending on HTTP means the page and its cookies travel in the clear. The case worth hunting is a chain that goes HTTPS, then HTTP, then HTTPS again: everything at that middle hop is interceptable and modifiable, and neither the starting URL nor the final one shows it.
HSTS is the durable fix for the first hop. Once a browser has seen a Strict-Transport-Security header from your domain, it rewrites http:// to https:// itself and never makes the insecure request at all — which removes the window in which that first redirect can be intercepted.
What this tool does
Every hop, in order
Each URL, its status code and the exact Location it returned — including the hops most browsers hide from you.
Mid-chain downgrades
A chain that drops to HTTP in the middle and climbs back is exposed at that hop. Checking only the first and last URL misses it entirely.
Loop detection
A URL requested twice ends the trace with the loop named, rather than running until a browser gives up with a generic error.
Permanent versus temporary
301 and 308 pass ranking signals on; 302 and 307 do not. Using the wrong one on a permanent move quietly costs search visibility.
Frequently asked questions
What is the difference between a 301 and a 302 redirect?
301 is permanent and 302 is temporary. Search engines pass ranking signals through a 301 and update their index to the new URL; a 302 tells them to keep the original. Browsers cache 301s aggressively, which is why an accidental 301 to the wrong place is painful to undo.
What about 307 and 308?
They are the strict versions. The older 301 and 302 were widely implemented such that a POST would be turned into a GET when followed; 307 and 308 forbid that, preserving the method and body. Use 308 for a permanent move of an endpoint that accepts POST.
How many redirects is too many?
One is normal, two is common, and beyond about four you are paying real latency for little reason. Browsers typically abandon a chain after ten to twenty hops. Chains grow accidentally over the years — http to https, then non-www to www, then an old path to a new one — and are worth collapsing into a single hop.
Why does my HTTP to HTTPS redirect matter if the site ends up secure?
Because the first request was made in the clear, and an attacker on the network can answer it before your server does. That first insecure request is the whole opening for an SSL-stripping attack. HSTS closes it by making the browser rewrite the URL before the request is sent.
What is a redirect loop?
Two or more URLs that redirect to each other, so no final response is ever reached. Browsers show a generic "too many redirects" error. The usual causes are a www and non-www rule fighting each other, or an application-level redirect disagreeing with a web server or CDN rule.
Does this follow JavaScript and meta refresh redirects?
No. It follows HTTP redirects — the Location header on a 3xx status — because that is what the protocol defines and what search engines act on. A meta refresh or a location assignment in JavaScript happens after the page loads and is not part of the HTTP chain.
Monitor it, don't just check it
One-off checks catch what is broken today. CertNotify watches your certificates, domains, DNS and code continuously and tells you before something breaks.