Skip to content
IPGet

Developer Tools

Redirect Checker

Every hop, every status code, and the point where a chain stops being secure.

Redirect check

Public http:// and https:// URLs on ports 80, 443, 8080 and 8443.

Try:

What a redirect chain costs

A redirect is not free. Each hop is a complete round trip: a DNS lookup if the host changes, a TCP handshake, a TLS handshake on HTTPS, and then the request itself. On a connection with 150 ms of latency, a four-hop chain spends most of a second before the first byte of real content is sent.

The classic accumulation is http://example.com → https://example.com → https://www.example.com → https://www.example.com/. Each rule was added by someone solving a real problem, and nobody ever looked at the total. Collapsing that to a single hop is usually a small change to one rule and is the cheapest performance win available on most sites.

The findings, and what each means

A loop is a chain that returns to a URL it has already visited. It can never finish, and browsers abandon it with an error. The usual cause is two rules disagreeing — one adding a trailing slash and one removing it, or a CDN and an origin each redirecting to the other.

A downgrade is a hop from HTTPS to plain HTTP. Everything on that hop travels unencrypted and can be read or modified in transit. It is nearly always accidental, caused by a rule with http:// hardcoded in its target, and it is the one finding here that is simply a defect rather than a trade-off.

A permanent redirect followed by a temporary one is worth knowing about because of how browsers cache. A 301 is treated as licence to stop asking, sometimes for the lifetime of the profile — so once a visitor has followed it, the temporary redirect behind it never runs for them again, whatever you change on the server.

Choosing the right status code

Use 301 or 308 only when the move is genuinely permanent and you would be content for browsers to remember it indefinitely. Use 302 or 307 for anything provisional: maintenance, experiments, regional routing.

If the request is anything other than a GET, prefer 307 and 308. Historically, browsers receiving a 301 or 302 after a POST would re-issue it as a GET and silently drop the body; the newer codes exist specifically to guarantee the method and body survive.

Frequently asked questions

Why check redirects from a server rather than in my browser?

Because your browser follows redirects silently and shows you only the destination. It also carries your cookies, your session and your address, so what it sees is what *you* see rather than what an anonymous first-time visitor sees. The check here is made from IPGet's server with a fixed User-Agent and nothing else, so the chain reported is the one the public internet gets.

What counts as a redirect loop?

A chain that returns to a URL it has already visited. Once that happens it can never terminate, and browsers give up with an error after their own limit. The usual causes are a rule that adds a trailing slash fighting one that removes it, an HTTP-to-HTTPS rule fighting a canonical-host rule, or a CDN and an origin each redirecting to the other.

Why does a long chain matter if it still ends at the right page?

Every hop is a full round trip — DNS if the host changes, a TCP handshake, a TLS handshake, and the request itself. Four hops on a connection with 150 ms of latency is most of a second before a single byte of content is served. Search engines also dilute ranking signals across long chains, and some stop following after a handful of hops.

What is wrong with a hop that goes from HTTPS to HTTP?

Anything sent on that hop travels unencrypted and can be read or altered in transit. It also breaks the guarantee HSTS is supposed to provide, and browsers may refuse the downgrade outright. It is almost always accidental — a rule that hardcodes http:// in its target — and it is the one finding here that is unambiguously a defect rather than a trade-off.

Can I check a URL on my own network?

No, and that is deliberate. The checker refuses private, loopback, link-local and cloud-metadata addresses, and it resolves the host and connects to the resolved address so a redirect cannot be used to reach an internal service. That restriction is what makes it safe to offer publicly.

Why is a 301 followed by a 302 flagged?

Because browsers cache a 301 aggressively, sometimes for the lifetime of the profile. Once a visitor has seen the permanent hop, they stop asking — so the temporary redirect behind it never runs for them again, even after you change it. The combination usually means a permanent redirect was issued for something that turned out not to be permanent.

Related tools