Potential open redirect vulnerability: what it is, why it matters, and how to fix it

This page accepts a URL parameter that controls where users are redirected, potentially allowing attackers to redirect users to malicious sites using your trusted domain.

Open redirects allow attackers to create phishing URLs that start with your trusted domain but redirect to malicious sites. Users and email filters trust your domain, so phishing attacks using open redirects are significantly more effective. Google may also classify your site as potentially harmful if open redirects are exploited at scale.

Validate redirect URLs against a whitelist of allowed domains. Reject absolute URLs in redirect parameters and only allow relative paths. If external redirects are needed, show an interstitial warning page before redirecting to external domains.

This is a high-severity issue: it directly suppresses rankings or click-through on the pages it affects. It belongs in your current sprint, prioritised by how many pages carry it. It belongs to the security family of checks.

Run a free Dr Urls audit: it crawls your site, detects potential open redirect vulnerability on every affected page, shows example URLs, and generates a ready-to-use fix task. Re-scan after fixing to verify the issue is gone.