A redirect response has no destination
What this check looks for
The server said 'go somewhere else' without saying where. Browsers show a blank page or an error.
Why it matters
The request simply fails. It is usually a rewrite rule that fires without setting a destination, and it fails silently in every log that only records status codes.
When the check passes, your report says: “Every redirect names where it is sending the visitor”.
What it costs your score
When this check fails it removes 20 points from your HTTP score, before the status, confidence and repeat multipliers are applied. HTTP carries a weight of 7 in the overall score.
It shares the http.redirects family ceiling of 45 points: however many findings that family produces, together they cannot remove more than that from HTTP. One underlying problem showing up in several places is still one problem.
- Severity
- medium
- Default confidence
- confirmed
- Status when triggered
- fail
- Deduction
- 20 points
- Family cap
- http.redirects · 45
- Category
- HTTP
- Module
- Http redirects
- Fix owned by
- user
- In the ruleset since
- 2026.09
How to fix it
Give the redirect a destination, or stop returning a 3xx.
A redirect with nowhere to go fails the request outright.
Find the rule producing the status and give it an absolute or root-relative target.
If a proxy sits in front, confirm it is not stripping
Location.
How to confirm it worked
curl -sSI https://‹host›/ — expect a Location header alongside any 3xx
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Remediation by platform
# One hop, straight to the canonical origin. Not http -> https -> www -> path.
server {
listen 80;
listen 443 ssl;
server_name ‹host›;
return 301 https://www.‹host›$request_uri;
}<VirtualHost *:80 *:443>
ServerName ‹host›
RedirectMatch 301 ^/(.*)$ https://www.‹host›/$1
</VirtualHost>‹host› {
redir https://www.‹host›{uri} permanent
}Rules → Overview → Create rule → Redirect Rule (path as at 2026-09) → single rule: When hostname equals ‹host›, Static/Dynamic redirect to https://www.‹host›/${http.request.uri.path}, status 301, preserve query string.Collapse the chain into a single redirect per source host rather than chaining them.
Shown because the response identified Apache. Prefer the virtual host over .htaccess: .htaccess is re-read on every request and its rules run after the virtual host's, which is how these chains get long in the first place.
Cloudflare Redirect Rules run at the edge and apply only to requests that arrive through it. An origin reachable directly — by IP, or through a DNS record that is not proxied — still produces the chain measured here. Fix the origin's own configuration as well.
Technical detail
‹detail›
RFC 9110 §15.4 requires a Location header on 301, 302, 303, 307 and 308. A 3xx without one is undefined, and browsers vary between showing the empty body and showing an error. Check for a rewrite rule with a redirect flag but no target, or a proxy stripping the header.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.