Open Redirect Detection
VitalSite probes redirect parameters that forward to arbitrary external URLs — a classic tool for convincing phishing links.
An open redirect is a URL on your domain that will forward visitors to any external site supplied in a parameter — for example yoursite.com/go?url=https://evil.com. Attackers love them because the link genuinely starts on your trusted domain, which makes phishing far more convincing and helps bypass filters. VitalSite probes for this pattern.
What VitalSite checks
We test common redirect parameters — such as redirect, url, next, return, returnUrl, and dest — with an external test destination and watch whether the server issues a 3xx redirect to that arbitrary external URL. If it does, the parameter is an open redirect.
Why it matters
Open redirects are routinely abused in phishing and token-theft campaigns. A victim sees a link to your real, reputable domain and trusts it — then gets silently bounced to an attacker-controlled page or used as a hop in an OAuth/token leak chain. Because the link's visible host is yours, your brand absorbs the reputational damage.
How to fix it
The root cause is redirecting to user-supplied input without validation. Fix it by constraining where redirects can go:
1. Use an allow-list. Only redirect to a known set of internal paths or approved domains.
2. Prefer relative paths. Redirect to a path on your own site (/dashboard) rather than a full URL taken from a parameter.
3. Validate the target. If you must accept a destination, reject anything that isn't on your allow-list, and never trust the scheme or host from the request.
4. Map tokens to URLs. Instead of putting the destination in the URL, pass an opaque key that your server maps to a known-safe location.
These are small code changes in your redirect handler, and they eliminate the issue without removing legitimate redirect functionality.
Verify the fix
Re-scan the domain. The Open Redirect check should report that common redirect parameters no longer forward to external domains. Combine this with error page hardening to close off reconnaissance and abuse vectors.
Run a free full-domain scan to see whether this affects your site — every page, with an exact fix guide. Pro and Agency plans add PDF export and monitoring.
See if this affects your site
Run a free full-domain scan — this check runs on every page, with an exact fix guide.