Common Redirect Chain mistakes that still ship

Teams still ship "we redirected to HTTPS" as if one Location line were a chain map. It is not. SlaySlop's Redirect chain check "Maps public redirects between the entered URL and final page." The mistakes below show up when people trust a single hop glance more than the public path crawlers actually walk.

I care what the public surface does with the URL you type. Apex to www to HTTPS to a locale prefix is four stories, not one slogan.

Outcome if you catch these early

Entered URLs that matter commercially resolve through a short, intentional hop map. Campaign leftovers stop accumulating. Open redirects stay on their own ticket. Portal notes name the starting URL and the final page instead of "redirects are fine."

Boundaries

Read-only. Permissioned scans. Not a pentest. Not a CDN rewrite service. Mapping chains is not the same as Open redirects ("Checks whether redirects can be steered to untrusted destinations."). Do not invent severity math the glossary does not publish.

Mistake 1: counting only the last hop

You curl once, see HTTPS, and stop. The entered URL may still be http://example.com hopping through www and a trailing-slash fix. Map the whole path.

# Permissioned — follow hops without guessing
curl -sI -L --max-redirs 10 "http://example.com/" | rg -i '^HTTP|^location:'

Mistake 2: http + www + https stacked

Classic stack: HTTP apex → HTTPS apex → HTTPS www → HTTPS www with slash. Each hop may be "correct" alone and still waste crawler and user time together. Collapse what you can at the edge.

Mistake 3: campaign short links forever

Old vanity hosts keep redirecting through three brands and a tracking domain. Marketing forgot them. The chain map did not. Inventory entered URLs that still appear in ads and email.

mistake: campaign_leftover
symptom: short link → brand A → brand B → final
fix: shorten the public map or retire the vanity host

Mistake 4: treating open redirects as chain mapping

Steerability to untrusted destinations is a different check. A clean allowlisted chain can still be long. A short chain can still be steerable. Split the tickets.

Mistake 5: apex and www telling different stories

example.com lands on a temporary splash while www lands on the app after two hops. Uptime on www stays green. Chain mapping on the apex still looks wrong. Sample both entered URLs.

Mistake 6: CDN vs origin ping-pong

Edge sends you to origin hostname; origin sends you back to the pretty hostname. The map shows the ping-pong even when the final HTML looks fine. Fix ownership of the canonical host in one place.

Mistake 7: no rescan after edge edits

Someone "fixed redirects" in a panel. Portal still shows last week's map. Rescan the same entered URL after propagation.

How I verify

I pick the entered URLs from the go-live list, read the Redirect chain map in the scan, and reproduce hop headers only on hosts I am allowed to assess. Then I compare to the intended canonical host. Skeptical of any deck that shows only the final page screenshot.

Related next step

Keep Redirect chain beside related public-path checks, and keep Open redirects separate when the issue is destination control. Soft links: Redirect chain and Open redirects. Soft close: a permissioned SlaySlop scan maps the hops clients actually experience.