The fix, in one snippet
curl -sIL https://example.com/go | grep -i '^location'Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The checker requests the URL from Scan.now's server with a safe client: no JavaScript, no cookies, a ten-hop limit, a short timeout and a standard browser user agent. It records every 3xx Location, <meta http-equiv="refresh"> and statically visible location= assignment, and reports the chain with status codes and domains. Three or more hops is medium; a hop to a domain unrelated to the first, or through a known redirector (google.com/url?q=, l.facebook.com, safelinks.protection.outlook.com, which are legitimate but abusable), is called out. Limits: cloaking is real. A kit can serve a benign page to scanners and the phishing page to victims based on IP, user agent or referrer, and redirects fired by JavaScript after load are not followed, so the report says "final destination as seen by our probe".
Why it matters
A redirect chain launders a link. The first hop is a trusted domain, an open redirect on a university or vendor site, or a marketing click-tracker, so filters and readers see a good name; the phishing page waits at the end. Chains also let the attacker swap the destination after the message has been delivered, and per-hop tracking records who clicked. Anyone who trusts the visible domain of a link is exposed, which is nearly everyone.
How to fix it
Paste the link into the phishing URL checker and judge the final domain, not the first. If the chain passes through a site you trust, that site has an open redirect and the trust does not transfer. Site owners: only redirect to an allow-list of destinations and validate the parameter server-side; see the open-redirect check. Related: URL shorteners. Guide: how to spot phishing.
Where this fits
Long or cross-domain redirect chain is check 8 of 13 that the phishing url checker runs under url and phishing indicators, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Link uses plain HTTP (medium), where the link uses plain http://, so anything you send to the page, including a password, would travel unencrypted, and the page itself could be altered on the way. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
Long or cross-domain redirect chain closes one route in. Immediately below it: Page asks for credentials, where the page at the link asks for a username and password, so if anything else about the URL is off, this is where the credentials would be harvested; URL uses a raw IP address as host, where the link points to a bare IP address instead of a domain name, which legitimate consumer services almost never do; Excessive subdomain depth, where the host has an unusually deep chain of subdomains, a pattern used to push the real domain out of sight and to mint an unlimited supply of unique hostnames.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Long or cross-domain redirect chain (medium severity)
Scanner check id: url-redirect-chainThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
