The fix, in one snippet
next=/account # accept
next=https://attacker.example # rejectIllustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
Scan.now replaces redirect-like parameters with a harmless Scan.now destination and inspects the Location response without following it.
Why it matters
Open redirects make phishing links appear to start on a trusted domain and can leak authorization codes in poorly configured login flows.
How to fix it
Accept relative local paths or map opaque destination identifiers to an exact server-side allow-list. Do not use suffix or substring hostname checks.
Where this fits
Open redirect is check 8 of 19 that the open redirect scanner runs under page content and javascript, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits DOM XSS source and sink review (medium), where inline client code contains both attacker-controlled DOM sources and dangerous rendering or execution sinks. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
Open redirect closes one route in. Immediately below it: POST form without recognisable CSRF protection, where a POST form has no recognisable anti-CSRF field; Structural accessibility basics, where structural HTML checks found missing accessible names, image alternatives, document language or skipped heading levels; Web performance baseline, where the initial response is slow, oversized or contains many parser-blocking scripts.
Found in the same scan
The open redirect scanner reports this alongside checks from other categories that are at least as serious, including Path traversal / local file inclusion, where a path-like parameter returned a known local operating-system file signature, and Session token exposed in URL, where a session-like token name appears in a discovered URL. A single run of open redirect scanner answers all of them at once.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Open redirect (medium severity)
Scanner check id: open-redirect-activeThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
