Home/Security Checks
Vulnerabilities

Open Redirect Detection

VitalSite probes redirect parameters that forward to arbitrary external URLs — a classic tool for convincing phishing links.

↪️

An open redirect is a URL on your domain that will forward visitors to any external site supplied in a parameter — for example yoursite.com/go?url=https://evil.com. Attackers love them because the link genuinely starts on your trusted domain, which makes phishing far more convincing and helps bypass filters. VitalSite probes for this pattern.

What VitalSite checks

We test common redirect parameters — such as redirect, url, next, return, returnUrl, and dest — with an external test destination and watch whether the server issues a 3xx redirect to that arbitrary external URL. If it does, the parameter is an open redirect.

Why it matters

Open redirects are routinely abused in phishing and token-theft campaigns. A victim sees a link to your real, reputable domain and trusts it — then gets silently bounced to an attacker-controlled page or used as a hop in an OAuth/token leak chain. Because the link's visible host is yours, your brand absorbs the reputational damage.

How to fix it

The root cause is redirecting to user-supplied input without validation. Fix it by constraining where redirects can go:

1. Use an allow-list. Only redirect to a known set of internal paths or approved domains.

2. Prefer relative paths. Redirect to a path on your own site (/dashboard) rather than a full URL taken from a parameter.

3. Validate the target. If you must accept a destination, reject anything that isn't on your allow-list, and never trust the scheme or host from the request.

4. Map tokens to URLs. Instead of putting the destination in the URL, pass an opaque key that your server maps to a known-safe location.

These are small code changes in your redirect handler, and they eliminate the issue without removing legitimate redirect functionality.

Verify the fix

Re-scan the domain. The Open Redirect check should report that common redirect parameters no longer forward to external domains. Combine this with error page hardening to close off reconnaissance and abuse vectors.

Run a free full-domain scan to see whether this affects your site — every page, with an exact fix guide. Pro and Agency plans add PDF export and monitoring.

See if this affects your site

Run a free full-domain scan — this check runs on every page, with an exact fix guide.

Frequently asked questions

Why is an open redirect dangerous if it’s just a redirect?

+

How do I fix an open redirect without breaking functionality?

+

Was this page helpful?

Rate it — it helps us improve the site.

4.7 out of 5 · 4 ratings