The Complete URL Redirect Audit: Find Chains, Loops, Broken Links, and SEO Issues

Overview

A redirect audit is more than a search for pages returning errors. It examines how old, moved, shortened, campaign, and alternate-version URLs lead visitors and crawlers to their final destinations. The objective is to make each important URL resolve efficiently, safely, and intentionally.

Start with a complete inventory of URLs from your sitemap, analytics, server logs, content system, backlink tools, campaign records, and redirect configuration. Include URLs that are no longer linked internally but may still receive visits or backlinks. For each URL, record the requested address, response status, redirect destination, final status, canonical URL, source of the URL, and recommended action.

A useful audit distinguishes between a redirect that works and a redirect that is appropriate. A permanent move will generally need a permanent redirect, while a temporary test or campaign destination may require a temporary redirect. The correct choice depends on the reason for the redirect, how long it is expected to remain, and whether the original URL should continue to be treated as the primary address.

Use a bulk redirect testing workflow when checking a migration or a large ruleset. For smaller sites, a redirect checker and a spreadsheet can be enough if every finding is tested from the original URL through to the final page.

Checklist by scenario

For a routine website redirect audit

• Export URLs from the XML sitemap, internal link crawl, analytics, and known backlink sources.
• Test both secure and insecure protocol variants where applicable, including HTTP to HTTPS behavior.
• Test both www and non-www hostnames if the site has used both versions.
• Check trailing-slash, uppercase, default-file, parameter, and duplicate-path variants that may create multiple versions of one page.
• Record every hop, not only the final result. A page that eventually loads may still pass through unnecessary redirects.
• Confirm that the final destination returns a successful response and contains the expected content.
• Review internal links so they point directly to the final canonical URL rather than to an old or redirected address.

For a site migration or domain change

• Export the old site’s important URLs before launch, including pages with organic visits, backlinks, conversions, or strong internal link equity.
• Create a one-to-one URL map wherever a relevant replacement exists. Avoid sending unrelated pages to the homepage simply because it is available.
• Check that each old URL has one direct redirect to its intended new URL.
• Test path, query-string, language, and directory rules separately. A broad rule can accidentally capture URLs that need different destinations.
• Verify that the new destination is indexable, uses the intended canonical URL, and does not redirect back to the old domain.
• Keep the old domain and redirect rules available for as long as they are needed to serve users and important links; document ownership and renewal responsibilities.
• Review the detailed guidance on redirecting an old domain without losing SEO signals.

For broken backlinks and deleted content

• Separate genuinely valuable external links from low-value, irrelevant, or suspicious sources.
• Match a broken URL to the closest useful replacement, not merely the nearest category or homepage.
• Use a permanent redirect when the old resource has been replaced or permanently moved.
• Leave a URL unavailable when no relevant replacement exists rather than creating a misleading redirect.
• Update important referring sites, partner links, profiles, and documentation when practical.
• Use the broken backlink recovery workflow to prioritize links by relevance and likely business value.

For short links, QR codes, and campaign URLs

• Confirm that every short link and QR code reaches the intended landing page without an expired campaign rule.
• Check UTM parameters for consistent source, medium, campaign, and content naming.
• Test the destination on mobile, since QR code traffic commonly begins on a phone.
• Review access controls and ownership for links used by multiple teams.
• Document expiration dates, fallback destinations, and the person responsible for maintenance.
• For governance practices, see the guides to short link management and QR code redirect management.

What to double-check

Redirect chains: A chain occurs when URL A redirects to URL B, which redirects to URL C. Chains make troubleshooting harder and add avoidable requests. Replace the sequence with a direct rule from the original URL to the final intended destination whenever possible. A redirect chain checker should show the complete sequence, status codes, and final URL.

Redirect loops: A loop occurs when rules send a request back to a previous URL, such as HTTP to HTTPS combined with conflicting host or application rules. To fix a redirect loop, inspect rules at every layer: DNS or proxy, CDN, web server, application, CMS, and browser-facing scripts. Test with a clean browser session and a command-line request so cached behavior does not hide the cause.

Status codes: Confirm that the code reflects the business purpose. Do not use a temporary redirect as a permanent replacement merely because it is convenient, and do not rely on a meta refresh or JavaScript redirect when a server-side rule can perform the job more reliably. Treat status-code changes as implementation decisions that should be documented.

Canonicalization: A canonical tag and a redirect solve different problems. A redirect sends the user away from a URL; a canonical declaration suggests which URL should be preferred when multiple accessible versions remain. Check that redirects, canonicals, internal links, sitemap entries, and hreflang references do not contradict one another.

Security: Test whether user-controlled parameters can redirect visitors to arbitrary external domains. An open redirect vulnerability can make a trusted domain appear in a deceptive link. Restrict redirect destinations to approved paths or domains, validate inputs, and review unusual redirect behavior in logs.

Common mistakes

• Redirecting everything to the homepage: This removes context and can create a poor experience for visitors following specific links.
• Testing only the final page: A successful final response does not reveal a chain, loop risk, incorrect intermediate code, or lost query parameters.
• Changing rules without a backup: Export the existing configuration and keep a dated change log before editing .htaccess, Nginx, Cloudflare, WordPress, or application rules.
• Ignoring parameters: Campaign tags, tracking parameters, filters, and session identifiers can create unexpected destinations or duplicate crawl paths. Decide which parameters should pass through and test them explicitly.
• Forgetting non-HTML assets: PDFs, images, feeds, JavaScript files, and downloadable documents may have external links and should be included when they are being moved.
• Leaving temporary rules indefinitely: Review test, launch, and campaign redirects so obsolete rules do not accumulate and conflict with newer rules.
• Failing to test permissions and environments: A rule that works in staging may behave differently behind production caching, a CDN, or a different server configuration.

When to revisit

Run a focused redirect audit before a site migration, domain change, redesign, URL restructuring, seasonal campaign, or major tracking update. Repeat testing immediately after deployment, then review the results after search engines, analytics systems, and users have had time to encounter the changed URLs.

For ongoing maintenance, schedule a lighter audit before major seasonal planning cycles and whenever redirect workflows, CMS settings, hosting, CDN rules, or analytics tools change. Revisit short links and QR code destinations before each campaign goes live, and review high-traffic or high-value redirects when reporting shows an unexpected drop in visits or conversions.

Finish each audit with an action list sorted by impact: first fix loops, unsafe destinations, and important URLs that fail; next remove chains and correct wrong mappings; then clean internal links, sitemap entries, canonicals, and obsolete rules. Assign an owner and due date to every change. After implementation, rerun the same URL set and compare the recorded status, hop count, final destination, and tracking behavior. That final verification turns a one-time redirect check into a dependable redirect audit process.