scan.now
Premium Scan a site

Scan a Web Page for Open Redirect Vulnerabilities

Enter a public page. Scan.now discovers redirect, return, next, destination and callback parameters in same-origin links and GET forms, then checks the Location response without following an external target.

A normal page URL is enough. Scan.now discovers redirect-like public GET inputs on that page; paste an exact parameterized URL only when the forwarding feature is not linked there.

A registered account is required to run this test. Finding status, evidence, affected locations and remediation are Premium-only. How active scanning works · Acceptable use

Why an open redirect is more than a harmless forwarding page

Login, payment and campaign flows often accept a destination so the visitor can return to the page they originally wanted. An open redirect exists when an attacker can replace that destination with an arbitrary external site while the trusted domain still supplies the first link.

You can enter a normal page URL. Scan.now discovers same-origin parameterised links and public GET forms, selects only redirect-like input names, substitutes a controlled HTTPS destination and inspects the response's Location header without following the external redirect. This keeps the check bounded while distinguishing a real server redirect from a parameter that is merely displayed or ignored.

Put this result in context

This scanner answers one part of the review. Continue with SSRF Scanner for correlate server-side url fetching with a unique callback, then Session URL Scanner for detect session ids and access tokens in query strings. These are separate checks because a strong result here does not prove that the adjacent surface is healthy.

For the background behind these signals, read Website Security: What a Vulnerability Scan Looks For and How to Fix It and What Is a Vulnerability Scan? Types, Limits and What the Results Mean. The Open redirect check reference explains the exact test, evidence and remediation used in the report. The Scan.now methodology explains request limits, scan boundaries and what the scanner deliberately does not attempt.

Destination inputs and Location headers

The check is deliberately bounded to the signals below.

Coverage areaWhat the scanner examines
Automatic redirect-input discoverySame-origin links and public GET forms are inspected for names such as next, return, destination, continue and callback; unrelated search and content fields are not probed.
HTTP redirect evidenceThe result is based on a returned Location header that resolves to the controlled external hostname.
No external navigationRedirect following is disabled for the probe, so Scan.now records the decision without requesting the destination.

External, rejected and undiscovered destinations

A scan result is evidence with a boundary, not a guarantee about every route.

External redirect accepted

The application turned the controlled external value into a redirect. Review phishing, OAuth and login-return flows that trust this endpoint.

No redirect accepted

The tested redirect-like parameters stayed internal, were rejected or were ignored. Client-side JavaScript redirects may still require browser testing.

No redirect input discovered

The entered page exposed no redirect-like public GET input. Paste a known forwarding endpoint if it is not linked there, or scan the page where that input is visible.

Relative paths, destination maps and strict allow-lists

Use the recommendations below to address confirmed findings and strengthen the surrounding control.

  1. Prefer relative destinations

    Accept an application path such as /account rather than a complete URL whenever the flow never needs to leave the site.

  2. Map identifiers to destinations

    Use a server-side key such as destination=billing and resolve it to a fixed route instead of trusting a supplied URL.

  3. Canonicalise before allow-listing

    Parse once, require HTTPS, compare the exact hostname and port, and reject user-info, encoded separators and ambiguous host suffixes.

  4. Bind OAuth return locations

    Register exact redirect URIs and tie the state value to the initiating browser session rather than accepting a loose domain match.

  5. Make unavoidable exits explicit

    For genuinely external links, show the destination hostname and require a deliberate click instead of redirecting automatically.

How it works

  1. Enter the relevant public page

    A normal page URL works. Paste an exact forwarding endpoint only when it is not linked or exposed by a public GET form on that page.

  2. We discover redirect-like values

    Same-origin links and public GET forms are inventoried, then a controlled HTTPS destination replaces only redirect-shaped values.

  3. The Location decision is checked

    The report distinguishes a confirmed external redirect from a rejected, ignored or internal destination.

What this tool checks

1 checks across 1 areas. Each links to its reference page with the test, the risk and the fix.

Full reference

Page content and JavaScript

1 check

The ones that most often decide the grade:

Medium Open redirectA redirect-like GET parameter accepted an external Scan.now URL.

Related tools

Continue the review with four checks that cover adjacent parts of the same attack surface.

All tools
Active Security SSRF Vulnerability Scanner

Correlate server-side URL fetching with a unique callback
Active Security Session Token URL Scanner

Detect session IDs and access tokens in query strings
Active Security CSRF Protection Scanner

Inventory POST forms and recognisable anti-CSRF fields
Active Security XSS Vulnerability Scanner

Confirm reflected script injection in a URL parameter

Guides for this tool

Background reading written to go with these results.

13 min read · Updated Sep 13, 2026 Website Security: What a Vulnerability Scan Looks For and How to Fix It

A website vulnerability scan checks the parts of a site an attacker can reach without logging in: Transport security, HTTP headers,...

Read the guide
8 min read · Updated Sep 12, 2026 What Is a Vulnerability Scan? Types, Limits and What the Results Mean

A vulnerability scan checks a system against a list of known weaknesses and reports what matches. The types of scan, the difference...

Read the guide
8 min read · Updated Sep 14, 2026 Passive vs Active Scanning: What Each Can Find and When Each Is Appropriate

Passive scanning observes normal responses; active scanning sends crafted requests to trigger flaws. The boundary, why it matters...

Read the guide
9 min read · Updated Sep 18, 2026 How to Read a Security Scan Report: Severity, False Positives and What to Fix First

A scan report is a list of findings with severities, and the hard part is deciding what matters. How severities are assigned, how to...

Read the guide

Frequently asked questions

Why are open redirects used in phishing?

The link begins on a familiar trusted hostname, so a person or filter may approve it before the browser is forwarded to the attacker's site.

Is redirecting to another subdomain safe?

Only if that subdomain is intentionally trusted and equally controlled. A suffix check such as endswith(example.com) is not enough unless hostname boundaries and canonicalisation are handled correctly.

Does the scanner visit the external destination?

No. It inspects the redirect response with following disabled, so the controlled destination is never loaded.

Are all external redirects vulnerabilities?

No. Some products intentionally leave the site. The security issue is an attacker-controlled automatic redirect presented under a trusted origin without a strict allow-list or clear interstitial.