The redirect chain is longer than it needs to be
Updated
1% of the 785 domains we could check get a warning for this. Sample: the first 1,000 domains by rank in the Majestic Million, checked on 2026-10-12. How we measured
What this check looks for
Visitors are bounced through several addresses before reaching the page. Each bounce is a full round trip they wait for.
Why it matters
Every hop is a DNS lookup, a connection and a round trip — most noticeable on mobile. Search engines also pass less signal through each hop and stop following after a handful.
When the check passes, your report says: “The redirect chain is as short as it needs to be”.
What it costs your score
When this check fails it removes 6 points from your HTTP score, before the status, confidence and repeat multipliers are applied. HTTP carries a weight of 7 in the overall score.
It shares the http.redirects family ceiling of 45 points: however many findings that family produces, together they cannot remove more than that from HTTP. One underlying problem showing up in several places is still one problem.
- Severity
- low
- Default confidence
- confirmed
- Status when triggered
- warn
- Deduction
- 6 points
- Family cap
- http.redirects · 45
- Category
- HTTP
- Module
- Http redirects
- Fix owned by
- user
- In the ruleset since
- 2026.09
How to fix it
Shorten the chain to two hops at most: HTTPS on the same host, then the canonical URL.
Each extra hop is a round trip for every visitor who starts there; the same-host upgrade is the one hop worth keeping, because it lets the bare host send its own HSTS header.
Decide the canonical form once: scheme, host and trailing-slash convention.
On plain HTTP, redirect every name to HTTPS on the same name.
On HTTPS, send
Strict-Transport-Security, and redirect each non-canonical name straight to the final URL: host, trailing slash and path in one step.Keep the path and query string through every redirect.
If you will not submit the domain to the HSTS preload list, one redirect from plain HTTP straight to the final URL is also fine.
How to confirm it worked
curl -sIL https://‹host›/ | grep -c '^HTTP/' — expect no more than ‹recommended› plus the final response
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Remediation by platform
# Two hops at most: HTTPS on the same host first, then the canonical host.
# Each name is written out rather than taken from $host, so no request is redirected
# to a Host value the client made up.
server {
listen 80;
server_name ‹host›;
return 301 https://‹host›$request_uri;
}
server {
listen 80;
server_name www.‹host›;
return 301 https://www.‹host›$request_uri;
}
server {
listen 443 ssl;
server_name ‹host›;
# The site's ssl_certificate lines belong here too.
add_header Strict-Transport-Security "max-age=31536000" always;
return 301 https://www.‹host›$request_uri;
}# Two hops at most: HTTPS on the same host first, then the canonical host.
<VirtualHost *:80>
ServerName ‹host›
RedirectMatch 301 ^/(.*)$ https://‹host›/$1
</VirtualHost>
<VirtualHost *:80>
ServerName www.‹host›
RedirectMatch 301 ^/(.*)$ https://www.‹host›/$1
</VirtualHost>
<VirtualHost *:443>
ServerName ‹host›
# The site's SSLEngine and certificate lines belong here too.
Header always set Strict-Transport-Security "max-age=31536000"
RedirectMatch 301 ^/(.*)$ https://www.‹host›/$1
</VirtualHost>‹host› {
header Strict-Transport-Security "max-age=31536000"
redir https://www.‹host›{uri} permanent
}SSL/TLS → Edge Certificates → Always Use HTTPS: on (hop one, the upgrade on the same name).
SSL/TLS → Edge Certificates → HTTP Strict Transport Security (HSTS): enable, Max Age 12 months; turn on includeSubDomains only once every subdomain serves HTTPS. Hop one exists so that ‹host› sends this header; without it the extra hop buys nothing.
Rules → Overview → Create rule → Redirect Rule: when Hostname equals ‹host› and SSL/HTTPS is on, Dynamic redirect to concat("https://www.‹host›", http.request.uri.path), status 301, preserve query string (hop two).
Then confirm with curl -sSI https://‹host›/ that the 301 carries a Strict-Transport-Security header.
(Dashboard paths and option names as at 2026-10, a dated snapshot; Cloudflare reorganises these pages and may again.)Each starting URL reaches the canonical one in at most two hops, and the bare name sends its own HSTS header on the way, which is the shape the HSTS preload list requires. Add includeSubDomains once every subdomain serves HTTPS. If HSTS preload is not a goal, sending plain HTTP for ‹host› straight to https://www.‹host› is also fine and saves a round trip; the bare name then never sends an HSTS header a browser accepts.
Shown because the response identified Apache. Prefer the virtual host over .htaccess: .htaccess is re-read on every request and its rules run after the virtual host's, which is how these chains get long in the first place. If HSTS preload is not a goal, sending plain HTTP for ‹host› straight to https://www.‹host› is also fine and saves a round trip; the bare name then never sends an HSTS header a browser accepts.
Caddy's automatic HTTPS already answers plain HTTP for ‹host› with a redirect to HTTPS on the same name, so this block is the second hop of the two the preload list expects.
Cloudflare Redirect Rules run at the edge and apply only to requests that arrive through it. An origin reachable directly — by IP, or through a DNS record that is not proxied — still produces the chain measured here. Fix the origin's own configuration as well.
Technical detail
The chain took ‹redirects› redirects; ‹recommended› or fewer is the target. Long chains usually come from separate rules applied one after another — http → https, then www, then a trailing slash or a path rewrite — each adding a hop.
The recommended shape from a non-canonical starting URL is two hops at most: upgrade to HTTPS on the same host first, then move to the canonical host with the full path — http://example.com/path → https://example.com/path → https://www.example.com/path. The first hop is the one worth keeping: it lets the bare host send its own Strict-Transport-Security header on an HTTPS response, and it is what the HSTS preload list requires of a bare domain. Everything else — the trailing slash, a path rewrite — belongs in the last hop, not in hops of its own.
If HSTS preload is not a goal, collapsing to one hop — http://example.com/path straight to https://www.example.com/path — is also fine and saves a round trip; the cost is that the bare name never sends an HSTS header a browser accepts, so a visit typed without www starts over plain HTTP every time. Both shapes pass this check.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.