Open Redirect Detection
Open redirects allow attackers to craft URLs on your domain that redirect users to malicious external sites.
Why It Matters
Attackers abuse open redirects for phishing by crafting convincing URLs on your trusted domain that redirect to fake login pages. This bypasses URL reputation filters and user vigilance.
How We Check
We test common redirect parameters (url, redirect, next, goto, etc.) with an external canary URL to detect if the server follows the redirect without validation.
How to Fix
Validate all redirect URLs server-side against an allowlist of permitted domains. Use relative paths for internal redirects. Never use user input directly in redirect targets without validation.
Related Security Checks
Check Your Website Now
Run a free security scan to check for Open Redirect Detection issues and 58+ other security vulnerabilities.
Scan Your Website Free