Redirect checker
See where a link really ends up, and whether every redirect on the way is the right kind.
Results for http://google.com/
301 Moved Permanently
Ends on a redirect
http://google.com/ answered with 301 Moved Permanently in 182 ms.
One request, one answer
- 1301 Moved Permanentlyhttp://google.com/→ Redirects to http://www.google.com/182 ms
1 hop: 301.
The last response is a redirect: its headers belong to the page it points to
Cacheable for 30 days, by browsers and shared caches (public).
- The first response is a 301 redirect to http://www.google.com/. Redirects were not followed.
- The policy sent is report-only: it is not enforced.
Response headers11
| Header | Value |
|---|---|
location | http://www.google.com/ |
content-type | text/html; charset=UTF-8 |
content-security-policy-report-only | object-src 'none';base-uri 'self';script-src 'nonce-IXxLmPYgsvw1GnOo3UXW0A' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp |
date | Sat, 14 Nov 2026 17:57:33 GMT |
expires | Mon, 14 Dec 2026 17:57:33 GMT |
cache-control | public, max-age=2592000 |
server | gws |
content-length | 219 |
x-xss-protection | 0 |
x-frame-options | SAMEORIGIN |
connection | close |
Security6
These six headers tell browsers how to treat the page. A missing one is a chance to tighten things up, not a fault in itself. Score: 23 out of 100.
| Header | Rating | Value | What it means |
|---|---|---|---|
Strict-Transport-Security | Missing | – | No HSTS header: a first visit over plain HTTP can be intercepted before the redirect to HTTPS. |
Content-Security-Policy | Weak | object-src 'none';base-uri 'self';script-src 'nonce-IXxLmPYgsvw1GnOo3UXW0A' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp | Only Content-Security-Policy-Report-Only is sent: violations are reported but nothing is blocked. |
X-Frame-Options | Good | SAMEORIGIN | Framing is limited (SAMEORIGIN), which blocks clickjacking. |
X-Content-Type-Options | Missing | – | Without "nosniff" browsers may guess a different content type than the one sent. |
Referrer-Policy | Missing | – | No Referrer-Policy: browsers apply their own default (strict-origin-when-cross-origin in current ones). State it explicitly. |
Permissions-Policy | Missing | – | No Permissions-Policy: powerful browser features stay available to any embedded content. |
Caching
Cacheable for 30 days, by browsers and shared caches (public).
- Cache-Control
public, max-age=2592000- Browsers keep it for
- 30 days
- Expires
- Mon, 14 Dec 2026 17:57:33 GMT
Server
- Software
- gws
- Content type
text/html; charset=UTF-8- Size
- 219 B
Structured result (JSON) · 4.2 KB
{
"url": "http://google.com/",
"method": "GET",
"finalUrl": "http://google.com/",
"status": 301,
"ok": false,
"hops": [
{
"url": "http://google.com/",
"status": 301,
"headers": {
"location": "http://www.google.com/",
"content-type": "text/html; charset=UTF-8",
"content-security-policy-report-only": "object-src 'none';base-uri 'self';script-src 'nonce-IXxLmPYgsvw1GnOo3UXW0A' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp",
"date": "Sat, 14 Nov 2026 17:57:33 GMT",
"expires": "Mon, 14 Dec 2026 17:57:33 GMT",
"cache-control": "public, max-age=2592000",
"server": "gws",
"content-length": "219",
"x-xss-protection": "0",
"x-frame-options": "SAMEORIGIN",
"connection": "close"
},
"ms": 182,
"statusText": "Moved Permanently",
"location": "http://www.google.com/",
"ip": "2a00:1450:4001:c15::65",
"httpVersion": "1.1"
}
],
"totalMs": 183,
"redirects": {
"count": 0,
"loop": false,
"tooMany": false,
"notFollowed": true,
"httpsUpgrade": false,
"downgrade": false,
"crossDomain": false,
"chain": [
{
"from": "http://google.com/",
"to": "http://www.google.com/",
"status": 301
}
]
},
"security": {
"score": 23,
"grade": "n/a",
"checks": [
{
"id": "hsts",
"header": "Strict-Transport-Security",
"weight": 25,
"present": false,
"rating": "missing",
"message": "No HSTS header: a first visit over plain HTTP can be intercepted before the redirect to HTTPS."
},
{
"id": "csp",
"header": "Content-Security-Policy",
"weight": 30,
"present": false,
"value": "object-src 'none';base-uri 'self';script-src 'nonce-IXxLmPYgsvw1GnOo3UXW0A' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp",
"rating": "weak",
"message": "Only Content-Security-Policy-Report-Only is sent: violations are reported but nothing is blocked."
},
{
"id": "frame-options",
"header": "X-Frame-Options",
"weight": 15,
"present": true,
"value": "SAMEORIGIN",
"rating": "good",
"message": "Framing is limited (SAMEORIGIN), which blocks clickjacking."
},
{
"id": "content-type-options",
"header": "X-Content-Type-Options",
"weight": 15,
"present": false,
"rating": "missing",
"message": "Without \"nosniff\" browsers may guess a different content type than the one sent."
},
{
"id": "referrer-policy",
"header": "Referrer-Policy",
"weight": 10,
"present": false,
"rating": "missing",
"message": "No Referrer-Policy: browsers apply their own default (strict-origin-when-cross-origin in current ones). State it explicitly."
},
{
"id": "permissions-policy",
"header": "Permissions-Policy",
"weight": 5,
"present": false,
"rating": "missing",
"message": "No Permissions-Policy: powerful browser features stay available to any embedded content."
}
]
},
"caching": {
"noStore": false,
"noCache": false,
"private": false,
"public": true,
"immutable": false,
"mustRevalidate": false,
"cacheability": "cacheable",
"summary": "Cacheable for 30 days, by browsers and shared caches (public).",
"cacheControl": "public, max-age=2592000",
"maxAge": 2592000,
"expires": "Mon, 14 Dec 2026 17:57:33 GMT"
},
"cookies": [],
"server": {
"versionDisclosed": false,
"software": "gws"
},
"content": {
"type": "text/html; charset=UTF-8",
"length": 219
},
"issues": [
{
"severity": "info",
"code": "REDIRECT_NOT_FOLLOWED",
"message": "The first response is a 301 redirect to http://www.google.com/. Redirects were not followed."
}
],
"notes": [
"The policy sent is report-only: it is not enforced."
],
"statusText": "Moved Permanently"
}What a redirect checker shows
A redirect is a server telling the browser to go to a different address. Changing http to https, www to the bare domain, or an old page to a new one are all redirects, and each one adds a round trip before the page can load. This page follows the whole chain and lists every hop with its status code, the Location it points to and how long it took. You see where a link really ends up and whether the route is clean.
The status code tells you whether a move is permanent or temporary, and whether the request method (GET or POST) survives it.
| Status | Meaning | Typical use |
|---|---|---|
301 | Moved permanently | Domain or URL moves, and HTTP to HTTPS. Browsers and search engines remember it. |
308 | Moved permanently, method kept | Like 301, but a POST stays a POST. |
302 | Found (temporary) | Short-term moves, A/B tests and login flows. |
303 | See other | After a form POST, go and GET another page. |
307 | Temporary, method kept | Like 302, but the method can't change. |
How to use it
- Enter the starting URLUse the exact address you want to test. Include
http://if you are checking the step from HTTP to HTTPS, because a bare hostname is tried over HTTPS first. - Read the journeyThe hops run from top to bottom, each with a status code. The last one should be a 2xx, which is the final page. A 4xx or 5xx there means the chain ends in an error. The headline sums it up, for example “Lands safely after 2 redirects” or “Caught in a redirect loop”. To see only the first response, switch off redirect following under More options.
- Fix what you findAim for one redirect at most. Update links, canonical tags (the tags that name a page's preferred address) and sitemaps to point straight at the final URL.
What a good chain looks like
- One redirect at most.
http://example.com/should go straight tohttps://example.com/(or your preferred host), not through three other URLs. - Permanent moves use 301 or 308. A 302 on a move that will never be undone can leave search engines holding on to the old URL.
- One main host. Pick
example.comorwww.example.comand redirect the other to it, over both HTTP and HTTPS. - The same path. A redirect should keep the path and query string, and not drop everyone on the home page.
- HSTS note. HSTS is a header that tells browsers to use HTTPS only. If a site sends it and your browser has seen it, the browser upgrades
httptohttpsitself with an internal 307, so you won't see that hop in browser tools. The checker shows what a fresh visitor gets.
Redirect problems and fixes
- Redirect loop (ERR_TOO_MANY_REDIRECTS). URL A sends you to B and B sends you back. Common causes are HTTPS forced at both a CDN and the origin, conflicting
wwwrules, or a CMS address setting that disagrees with the web server. - Long chains.
http://example.comtohttps://example.comtohttps://www.example.comtohttps://www.example.com/en/is three redirects. Combine them into one rule. - HTTPS downgrade. A redirect from
httpstohttpis a security problem, because the visitor's traffic can be read or changed in transit. - The wrong status. Temporary redirects (302 or 307) on permanent moves slow down the search engine's switch to the new URL.
- Redirects to the home page. Sending every old URL to
/can be treated as a soft 404, a page that looks missing to search engines. Map each page to its closest match. - Lost parameters. A rule may drop tracking or filter parameters. Compare the start URL with the final one.
- A different result for crawlers. Some sites redirect by user agent or country. This tool uses a neutral client from a datacentre.
How it works and the standards
LookupOwl requests the URL, reads the status and Location header, works out the next URL relative to the current one, and repeats, for at most 10 hops. Each new host is checked again, so a redirect can't lead the tool to a private or internal address. The result flags loops, a chain still redirecting after 10 hops, more than 3 redirects, an upgrade from HTTP to HTTPS, a downgrade from HTTPS to HTTP and hops that leave the original domain. The status codes are defined in RFC 9110 section 15.4. For the headers on each hop, use the HTTP headers checker.
curl -sIL -o /dev/null -w "%{url_effective} %{num_redirects} redirects\n" http://example.com
curl -sI http://example.com | head -n 5Questions people ask
What is the difference between a 301 and a 302 redirect?
A 301 says the move is permanent, so browsers and search engines should swap the old URL for the new one. A 302 says it is temporary, so they keep the original address and come back to it. Use 301 or 308 for moves you won't undo, such as a new domain or HTTP to HTTPS, and 302 or 307 for short-term detours.
How many redirects are too many?
Aim for one redirect at most, and treat more than three as too many. Browsers and search crawlers follow longer chains, but each redirect adds delay and a chance to fail, and Google gives up after about ten. This checker flags any chain of more than three redirects, which is a clear sign to merge the rules.
Do redirects hurt SEO?
Not when they are clean. A single 301 passes a page's signals to the new URL, and search engines treat it as the page's new home. Trouble starts with long chains, loops and temporary redirects used for permanent moves, because those slow down or confuse the switch. Keep redirects short, point them at the closest matching page and update your internal links.
Why does my redirect work in the browser but not here?
Because your browser isn't a fresh visitor. It caches 301s, applies HSTS and carries cookies, and sites may redirect by language or country. This checker starts clean from a datacentre address, so it sees what a first-time visitor gets. Also check whether the redirect is done in JavaScript or with a meta refresh tag, which this tool doesn't follow.
How do I stop a redirect loop?
Find the two rules that disagree and make one layer responsible. Common culprits are forced HTTPS at both a CDN (a network of caching servers in front of your site) and the origin server, www rules set in two places, and a CMS address setting that conflicts with the web server. Fix one rule, clear any cache, then run the check again.
Does it follow shortened links?
Yes, as long as they use HTTP redirects, which most link shorteners do. You can see where a short link ends up without opening it in your browser. It can't tell you whether the destination is safe, so treat unknown links with care and look at the final domain before you click.
Can it check a redirect that needs a login or a cookie?
No. The request is anonymous and doesn't send your cookies, so a redirect that depends on being signed in, or on a cookie, won't appear. Use curl with your cookie, or your browser's developer tools, for those. Anything the site does for an ordinary first-time visitor shows up here.
Use it from AI, the API or the command line
Every LookupOwl tool is also a free API and an MCP tool, with no key and no account. This one is http_headers. Please be kind to the rate limits.
curl "https://lookupowl.com/api/v1/tools/http-headers?q=https%3A%2F%2Fexample.com%2F"claude mcp add --transport http lookupowl https://lookupowl.com/mcp