Links worth checking for open redirect — the fix
This page links to an endpoint that takes a URL parameter pointing somewhere else. If that endpoint sends visitors wherever the parameter says, it can be used to build phishing links that start with your domain. Whether it does cannot be determined from the page alone — this is a prompt to check, not a confirmed finding.
Where this fits: security in SEO
Security issues erode both rankings and trust. HTTPS has been a ranking signal since 2014, and browsers actively warn users away from insecure or mixed-content pages — a warning interstitial is a 100% bounce rate. Missing security headers rarely block indexing, but they widen your attack surface, and a hacked site (injected spam, malicious redirects) can be removed from results entirely. Security is the SEO work you do so you never have to do recovery work.
Why links worth checking for open redirect hurts your rankings
Open redirects allow attackers to create phishing URLs that start with your trusted domain but redirect to malicious sites. Users and email filters trust your domain, so phishing attacks using open redirects are significantly more effective. Google may also classify your site as potentially harmful if open redirects are exploited at scale.
This is a low-severity issue: a polish item. Fix it in batches during scheduled maintenance; the win is cumulative quality, not a step change.
How to fix it
Validate redirect URLs against a whitelist of allowed domains. Reject absolute URLs in redirect parameters and only allow relative paths. If external redirects are needed, show an interstitial warning page before redirecting to external domains.
Security best practices
- Serve everything over HTTPS and redirect HTTP with a single 301.
- Send HSTS, X-Content-Type-Options, and a Content-Security-Policy on every response.
- Eliminate mixed content — one insecure asset breaks the padlock.
- Keep dependencies and CMS plugins patched; most site hacks are known-CVE exploits.
- Monitor Search Console's security section — Google often knows you're hacked before you do.
The full library: SEO best practices, by category.
Frequently asked questions
What does "Links worth checking for open redirect" mean?
This page links to an endpoint that takes a URL parameter pointing somewhere else. If that endpoint sends visitors wherever the parameter says, it can be used to build phishing links that start with your domain. Whether it does cannot be determined from the page alone — this is a prompt to check, not a confirmed finding.
Why does links worth checking for open redirect matter for SEO?
Open redirects allow attackers to create phishing URLs that start with your trusted domain but redirect to malicious sites. Users and email filters trust your domain, so phishing attacks using open redirects are significantly more effective. Google may also classify your site as potentially harmful if open redirects are exploited at scale.
How do I fix links worth checking for open redirect?
Validate redirect URLs against a whitelist of allowed domains. Reject absolute URLs in redirect parameters and only allow relative paths. If external redirects are needed, show an interstitial warning page before redirecting to external domains.
How serious is this issue?
This is a low-severity issue: a polish item. Fix it in batches during scheduled maintenance; the win is cumulative quality, not a step change. It belongs to the security family of checks.
How do I find every page affected by this on my site?
Run a free Dr Urls audit: it crawls your site, detects links worth checking for open redirect on every affected page, shows example URLs, and generates a ready-to-use fix task. Re-scan after fixing to verify the issue is gone.
Does your site have this issue?
A free Dr Urls audit crawls your site, finds every page affected by links worth checking for open redirect, and hands you a ready-made fix task.
Check my site free