Redirect risk explained
A redirect tells a browser to continue to another URL. Redirects are normal on the web, but they can also hide or change the final destination. Risk increases when a link passes through several redirects, unexpectedly changes to a different domain, or ends on a destination that does not match the sender's claim.
- A redirect is a mechanism, not a malicious verdict.
- The final destination matters more than the first visible URL.
- Cross-domain changes deserve context and verification.
- Open redirect weaknesses can make a trusted-looking starting URL lead somewhere untrusted.
Why websites redirect
Websites redirect for many legitimate reasons: moving a page, enforcing HTTPS, shortening marketing links, measuring campaigns, switching language or geography, and completing authentication flows.
More detail
Common HTTP redirect status codes include 301, 302, 303, 307 and 308. The important security question is not merely whether a redirect happened, but where the chain ended and whether that destination was expected.
Why redirects can create risk
A sender can present a URL whose first hostname looks familiar while relying on an intermediate service to send the browser elsewhere. Shorteners are a common example, but any redirecting endpoint can obscure the destination until the request is made.
More detail
OWASP documents unvalidated redirects as a phishing risk because an attacker may be able to craft a trusted-looking URL that forwards users to an untrusted site.
Cross-domain redirects
Moving from one hostname to another is common in large platforms, payment processors and identity systems. It is therefore a weak signal by itself.
More detail
The change becomes more meaningful when the final domain is unrelated to what the message promised, the redirect chain is unexpected, or the destination asks for sensitive information. Can I Share This? shows the final hostname and records destination changes so users can evaluate that context.
Multiple redirects
Longer redirect chains make manual inspection harder and create more opportunities for the destination to change. They can also result from completely legitimate ad-tech or tracking infrastructure.
More detail
The scanner treats several redirects as a cautionary signal rather than proof of abuse. The purpose is to draw attention to the final host and reduce the chance that the user judges the link only by its starting address.
Open redirects
An open redirect occurs when a site accepts a destination supplied by the user without sufficiently restricting where it may send visitors. This can let attackers wrap an untrusted destination inside a URL hosted on a legitimate domain.
More detail
A scanner that follows redirects can expose the final host, but the safest response to an unexpected login or payment request is still to open the official service independently.
How to interpret redirect results
A same-site redirect from HTTP to HTTPS is usually routine. A known shortener resolving to an expected official domain can also be routine. A chain that unexpectedly leaves the claimed organization and ends on an unfamiliar login or download host deserves caution.
More detail
The destination should make sense before any password, payment, download or account-recovery action is taken.
Primary references
These references define or document the web and security concepts discussed above.
Related reference pages
Check a suspicious link
Use the scanner to inspect the URL, redirects and final destination before you open it.