How SlaySlop checks Redirect Chain

Process that survives launch week needs the hop list. Clients paste an HTTP apex from an old business card. Ads still point at a shortener. Someone on the call says the site loads fine on www. All three can be true while the chain between them is a mess.

SlaySlop's Redirect chain check "Maps public redirects between the entered URL and final page." I treat that as the product contract. No invented hop thresholds in this article. Read the map the report gives you.

Outcome the check is for

You get a clear public hop map for the URL submitted to the scan. Findings and evidence help you see intermediate Locations and the final page. The outcome is actionable cleanup of unnecessary hops, leftover HTTP upgrades, and conflicting apex/www policies—not a vibe score about redirect health.

Agencies that keep this boring tend to keep clients. Uptime can stay green the whole time. Green uptime does not flatten a five-hop path from an old http bookmark.

Boundaries

Read-only public scan with permission. Not a pentest. Not permission to flood third-party shorteners. This is not Open redirects: that check "Checks whether redirects can be steered to untrusted destinations." Chain mapping can be clean while destination control is unsafe, and the reverse can also happen. Keep the labels straight on the call.

Happy path: how the signal is observed

1. Take the entered public URL from the scan.
2. Follow public redirects the scanner can observe.
3. Record intermediate and final responses.
4. Present the map with evidence.
5. Rank among other verified findings so a wild chain on a money URL does not hide under trivia.

Agency spot-check on hosts you own:

for URL in \
  "http://example.com" \
  "https://example.com" \
  "https://www.example.com"
do
  echo "==== $URL"
  curl -sI -L --max-redirs 20 "$URL" \
    | awk 'BEGIN{IGNORECASE=1} /^HTTP|^location:/{print}'
  echo
done

I want the entry URLs that real humans and ads still use. Checking only the canonical www HTTPS URL hides the chain you inflict on everyone else. Bring the business-card URL to the test, not only the URL in your head.

Pitfalls when reading the row

CDN regional differences. Preview hosts that skip production force-HTTPS rules. App deep links that never hit HTTP redirects. Trailing-slash policies that only appear on directory URLs. Shortener partners that add hops outside your repo.

Another pitfall: fixing the chain in staging DNS while production still points at an old load balancer with extra 301s. Scan the host clients hit. Soft launches with split DNS make this worse.

What I put in the portal

Entry URL samples, hop counts, final URL, owners, target steady state (usually canonical HTTPS www or apex—pick one and stop oscillating). Soft CTA: if SlaySlop already monitors the site, paste the Redirect chain evidence into the same note after you collapse hops so the client sees before and after without another slide deck.