Redirect & HSTS Tracer
Follow every redirect hop with status, timing, HSTS, and cookies, and see what is wrong with the chain.
About the Redirect & HSTS Tracer
Redirect & HSTS Tracer follows a URL one hop at a time and shows what each step really does: the status code, where it points, how long it took, whether the response carries a Strict-Transport-Security header, and which cookies it tries to set. Most redirect problems are invisible in a browser, which hides the chain and only shows the end result.
Enter a bare domain and the trace starts on plain HTTP, because that is where the move to HTTPS should happen. The report then reads the chain for you. It flags a temporary 302 used for the HTTPS upgrade where a permanent 301 or 308 belongs, an upgrade that never happens, a step that drops back from HTTPS to HTTP, long chains that add a round trip at every hop, loops, and cookies sent over an unencrypted connection. For HSTS it checks the final response and reports whether the lifetime is long enough and whether the site qualifies for browser preload lists.
The trace stops at ten hops, and it does not follow JavaScript redirects. It does notice an HTML meta refresh on the final page and tells you about it. To read every response header on a single URL, use the HTTP Header Checker, and to grade the security headers, use the Security Headers Scanner.
Reach the developers and engineers who use these tools every day.
Frequently asked questions
What is the difference between 301, 302, 307, and 308?
301 and 308 are permanent: browsers and search engines remember the new address. 302 and 307 are temporary: the original URL stays the canonical one. For moving HTTP to HTTPS, or one domain to another, use 301 or 308.
Why does the trace start on http even though I typed a bare domain?
A visitor who types a domain without a scheme usually lands on plain HTTP first. Starting there shows whether your site upgrades them to HTTPS and how many steps that takes. Enter a full https URL to start somewhere else.
Does a redirect chain hurt search ranking?
A short chain is harmless, but every extra hop adds latency and a little uncertainty about which URL should rank. Point the first URL straight at the final destination wherever you can.
What does HSTS preload ready mean?
HSTS tells browsers to use HTTPS only. A site is eligible for the browser preload list when it serves a max-age of at least a year with includeSubDomains and preload. Preloading is hard to undo, so enable it only when every subdomain supports HTTPS.
Are cookie values shown?
No. Only the names of cookies are listed, so the trace can point out that a cookie is set over plain HTTP without exposing its contents.