HTTP Redirect Chain Analyzer

How it works

Redirect chains affect security and UX. We follow redirects on a public URL with SSRF checks on every hop, then flag long chains, HTTPS→HTTP downgrades, and open-redirect-ish query parameters (url, redirect, next, return, and similar) that hold absolute URLs.\n\nOpen redirects rarely look dramatic in demos, but they power phishing that rides your brand. Downgrades undo HTTPS. Long chains confuse users and caching. Fix at the edge: collapse hops, keep HTTPS, and never bounce users through unvalidated absolute URLs.\n\nThis teaser does not fuzz parameter values or crawl every link on the page. It analyzes the chain from the URL you paste. After cleanup, re-check and run a full AtRisk scan for broader findings.\n\nNot a penetration test - a redirect hygiene pass for launch-ready sites. Prefer one or two hops from apex to www or marketing to app. Document intentional redirects so future deploys do not accumulate zombie hops from old campaigns. If you use OAuth or magic links, double-check that callback URLs never accept an open redirect parameter without an allowlist. After you collapse the chain, re-run this tool and the SSL checker together - a clean redirect story plus HTTPS continuity is a strong launch baseline before ads spend.

This is a free teaser check - not a penetration test, vulnerability assessment, or compliance audit. AtRisk full scans go deeper across more detectors and unlock fix prompts on Starter.