Cyber Security SpaceCYBERSECURITYSPACE.NET
Website security

Redirect chain

A redirect chain is a sequence of two or more redirects between the URL a visitor requested and the page finally served.

Updated 2 Sept 2026

In more detail

Chains occur legitimately — HTTP to HTTPS, then non-www to www, then a renamed path — and maliciously, when injected code hops a visitor through several intermediaries before landing on an affiliate or malware page. Each hop costs latency, and long chains complicate diagnosis because the harmful destination is several steps away from the URL that appeared in search results.

Why Redirect chain matters

For legitimate sites, chains waste crawl budget and can weaken signal consolidation between the requested URL and the final one. For compromised sites, chains are an evasion tactic: the intermediate hops rotate frequently, so blocklists and manual checks trail behind the current destination.

How it works

Redirects are issued by HTTP status codes (301, 302, 307, 308), by a meta refresh tag, or by JavaScript such as location.replace(). Malicious injections often use JavaScript so the redirect never appears in server-side response headers, and gate the behaviour on referrer or user agent so it fires only for search visitors.

Examples

  • http://example.com → https://example.com → https://www.example.com → https://www.example.com/home (three unnecessary hops).
  • A search visitor sent through two ad-network domains before reaching a counterfeit storefront.
  • A JavaScript redirect that fires only when document.referrer contains a search engine hostname.

How it is detected or measured

Follow the full hop list with curl -IL or a browser's network panel, then repeat with a search-engine referrer and a mobile user agent. Compare against your intended redirect map; any hop you cannot account for needs investigation.

Where this matters

  • Malicious Redirects

    Conditional redirects send your mobile or search visitors to scam pages while the site looks normal to you. How they are implemented and how to trace them.

  • How to Check if a Website Is Hacked

    Eight checks that reliably separate a compromised site from a slow or misconfigured one, in the order that finds problems fastest.

Sources

Related terms