Redirect trace

One site, four addresses

To a person, these all look like the same place:

http://example.com/
http://www.example.com/
https://example.com/
https://www.example.com/

A browser or a search crawler sees four distinct origins. The scheme can differ, the hostname can differ, and nothing in the web’s design says they have to return the same content. Meanwhile a printed flyer, an old bookmark and a link in a five-year-old forum post will each use a different one.

A redirect ties them together. The server skips the page and answers with a three-digit status in the 300 range plus a Location header naming another address, and the browser goes there. A tidy site picks one of the four as its real address and has the other three answer with a single redirect to it.

The status codes that move visitors

The trace prints the code of every hop in the Path column, in the order the server returned them.

How the trace is judged

Our server requests each of the four addresses and follows up to eight redirects. Whichever destination most of them reach is taken as the site’s main address, and each starting point is compared with it.

Final address / 1 hop

The variant is the main address, or gets there with one redirect. This is what you’re aiming for.

2 hops or more

A chain, for example http://www to https://www to https://. It works, but each extra hop costs a full round trip, often 100 to 300 ms on a phone.

Temporary redirect

A 302, 303 or 307 on the way. When the rule is meant to be permanent, this leaves search engines unsure which address to keep.

Different address

The variant ends up somewhere else, so the site exists in two versions. Rated as an error.

Failed

No response. Rated as an error for the bare domain and as a warning for www.

A destination that isn’t HTTPS is always an error. On the final page, the trace also scans the HTML for mixed content, meaning scripts, style sheets, frames, form targets, images and media still addressed with http://. Browsers block the first four kinds, so those are errors, while images and media are warnings. Last, it reads the rel="canonical" link and warns you if it names a different hostname from the one the redirects lead to.

Writing the rule once

Chains show up when two layers each do half the job, like a hosting panel that forces HTTPS and a plugin that then removes www. Send every variant straight to the final address in one rule.

nginx

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;
}
server {
    listen 443 ssl;
    server_name www.example.com;
    return 301 https://example.com$request_uri;
}

Apache (.htaccess)

RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\. [NC]
RewriteRule ^ https://example.com%{REQUEST_URI} [L,R=301]

On Cloudflare, turn on “Always Use HTTPS” and add one redirect rule for the hostname. The www name needs its own DNS record and has to be covered by the certificate, or visitors never get as far as the redirect. The TLS certificate inspector checks that.