Your browser hides redirects. You type a URL, a page appears, and the three hops in between are invisible. Most of the time that is fine. When a page is not ranking, a link is being flagged, or a login loop will not resolve, those hidden hops are usually where the answer is.

The HTTP Status / Redirect Checker fetches a URL without following redirects, so you see each step rather than the destination.

The codes worth knowing

200 OK — here is the content.

301 Moved Permanently — this has moved for good. Search engines transfer ranking signals to the target and update their index. Browsers cache it aggressively, which is the part that bites: publish a wrong 301 and returning visitors keep following it even after you fix the server.

302 Found — temporary. The original URL stays canonical. Fine for genuinely temporary moves, wrong for permanent ones — using 302 for a real migration means the ranking never moves across.

304 Not Modified — your cached copy is current. Normal and good.

401 Unauthorized — you have not authenticated. Poorly named; it means unauthenticated.

403 Forbidden — authenticated, but not allowed. Also what a server returns when a security rule blocks a path.

404 Not Found — nothing here. Correct for genuinely missing pages, and nothing to be ashamed of.

410 Gone — deliberately removed and not coming back. Search engines drop these faster than 404s, which is useful after pruning content.

429 Too Many Requests — rate limited.

500 / 502 / 503 — server fault, upstream fault, temporarily unavailable. A 503 with a Retry-After header is the correct way to signal planned maintenance; search engines will come back rather than deindex you.

Soft 404s: the expensive mistake

A soft 404 is a page that says "not found" in the text but returns 200 OK in the header.

Humans see the message and leave. Search engines see a successful response and index the page. Do this across a site and you accumulate hundreds of near-identical "page not found" pages in the index, competing with your real content and diluting quality signals.

This is worth checking specifically, because it is invisible in a browser. Request a URL you know does not exist and read the status line. If it is 200, that is a bug in your error handling, and it is quietly costing you.

Redirect chains

Each hop costs a round trip. A chain like this is common and entirely avoidable:

http://example.com/page       301 -> http://www.example.com/page
http://www.example.com/page   301 -> https://www.example.com/page
https://www.example.com/page  301 -> https://example.com/page/
https://example.com/page/     200

Four requests to serve one page. Every visitor pays that, on every cold visit, and it is worst on mobile where each round trip is slowest.

The fix is to redirect straight to the final destination in one hop. Decide your canonical form once — HTTPS or not, www or not, trailing slash or not — and send everything there directly rather than through a sequence of individually reasonable rules that nobody has looked at together.

Watch for loops too. A redirect that eventually points back at itself produces ERR_TOO_MANY_REDIRECTS, and the cause is usually two rules that are each correct in isolation — a CDN forcing HTTPS while the origin forces HTTP, for instance.

Reading the Location header

When you get a 3xx, the Location header tells you where it points. That is the single most useful thing to look at, and the browser never shows it to you.

Two things to check: whether it is absolute or relative, and whether it goes where you expect. A redirect that takes a URL from a query parameter and sends users to it is an open redirect — attackers use those in phishing because the link genuinely starts on your trusted domain before bouncing somewhere else.

If you accept a redirect target from user input, validate it against an allowlist of your own hosts. Never redirect to an arbitrary supplied URL.

A practical check

  1. Run the URL through the Redirect Checker and note every hop.
  2. Count them. More than one to reach the canonical URL is worth collapsing.
  3. Confirm permanent moves use 301, not 302.
  4. Request a deliberately nonexistent path and confirm it returns 404, not 200.
  5. Check the Location targets are what you expect and are not attacker-controllable.

From a terminal, curl -sI https://example.com shows the headers for a single hop, and curl -sIL follows the whole chain.

Common questions

301 or 302 for a site move?
301. A 302 tells search engines the original URL is still canonical, so rankings never transfer.

What is a soft 404?
A page that says "not found" but returns 200. Search engines index it as real content.

How many redirects are too many?
One is fine. Two is tolerable. Three or more is worth fixing — every hop is a round trip.

Why do I get ERR_TOO_MANY_REDIRECTS?
Two rules are fighting, commonly a CDN and an origin server disagreeing about HTTPS or www.

Where to go next

  • Trace a URL with the HTTP Status / Redirect Checker.
  • While you are reading response headers, check the security headers on the same URL.
  • If the chain crosses HTTP, your cookie flags matter more than you think.
  • Redirect loops are a good thing to bring to the BitCops community — they are usually two systems disagreeing.
  • Redirect chains break in production more than anywhere else. The forum is the place to post a chain you cannot untangle.