What Each Redirect Hop Costs You

This guide is for web developers and site owners who manage redirects. You will learn what each redirect hop costs in performance, how to choose the right HTTP status code, how HSTS can eliminate redundant HTTPS redirects, and how to verify your redirect chains.

Performance Cost of Each Hop

When a browser receives a redirect response, it immediately loads the new URL from the Location header. This means an additional HTTP round-trip before the final content begins. Besides this small performance hit, users rarely notice the redirection. However, every redirect impacts performance, so you should keep their use to a minimum.

Internal redirects are especially costly because they add an extra HTTP request. If you can avoid them by correcting internal links, you should fix those links instead. For example, if your own pages link to an old URL that then redirects to a new URL, update the link to point directly to the new URL. This eliminates one full request-response cycle for every click.

HTTP Redirect Status Codes and Their Meaning

Redirect responses have status codes that start with 3 and include a Location header holding the URL to redirect to. Google treats the two kinds differently: permanent redirects show the new target in search results, while temporary redirects show the source page.

Permanent redirects (301 Moved Permanently, 308 Permanent Redirect) indicate that the original URL should no longer be used. Search engine robots, RSS readers, and other crawlers update the original URL for the resource. Use these when you are sure the redirect will not be reverted.

Temporary redirects (302 Found, 303 See Other, 307 Temporary Redirect) are used when the page is temporarily unavailable at its usual address. Search engine robots and other crawlers do not memorize the new, temporary URL. Use these when the original URL should remain in search results.

The table below summarizes common status codes, method handling, and typical use cases:

The key difference between 301/302 and 308/307 is method handling. 301 and 302 may change non-GET methods to GET, while 308 and 307 preserve the method and body. Use 308 or 307 when the redirect involves non-GET operations.

Alternative Redirect Mechanisms and Precedence

HTTP redirects are not the only way to define redirections. You can also use HTML <meta> redirects and JavaScript redirects. However, they have different execution orders.

HTTP redirects always execute first because they exist before the page is even transmitted. JavaScript redirects execute next, before HTML redirects. This is because the <meta> redirect happens after the page is completely loaded, which is after all scripts have executed. HTML redirects execute only if there were no HTTP or JavaScript redirects that executed before the page was loaded.

Here is an example of an HTML meta refresh redirect:

<meta http-equiv="Refresh" content="0; url=https://example.com/" />

And a JavaScript redirect:

window.location = "https://example.com/";

When possible, use HTTP redirects and avoid adding <meta> element redirects. If someone changes the HTTP redirects but forgets to change the HTML redirects, the redirects will no longer be identical, which can cause an infinite loop or other problems.

HTTPS Redirects and HSTS Optimization

If your host accepts insecure HTTP requests, it should respond with a permanent redirect (301) to an https URL. The browser then makes a new request using HTTPS. That HTTPS response should include the Strict-Transport-Security header.

Example response header:

Strict-Transport-Security: max-age=31536000; includeSubDomains

The max-age directive specifies how many seconds the browser should remember that the host must be accessed only via HTTPS. The optional includeSubDomains directive applies the policy to all subdomains as well.

After the browser receives this header, it adds the host’s domain name to its persistent list of HSTS hosts. On future attempts to load http:// URLs, the browser automatically upgrades the scheme to https without requiring a redirect. This eliminates the extra round-trip of the 301 redirect for subsequent visits.

Note that the Strict-Transport-Security header must be sent over HTTPS only. Browsers ignore the header if sent over HTTP to prevent a man-in-the-middle attacker from altering or adding it.

Common Mistakes

• Creating redirection loops that never terminate. These completely break the user experience, and browsers display an error message. Most of the time this is a server problem, and if the server can detect it, it will send back a 500 Internal Server Error. If not, browsers detect the loop and show an error.
• Using unnecessary internal redirects instead of fixing internal links. Each internal redirect adds a significant performance cost because it triggers an extra HTTP request. Fix the internal links directly.
• Sending the Strict-Transport-Security header over insecure HTTP. Browsers ignore this header over HTTP to prevent MITM attacks. Always send it over HTTPS only.
• Setting a meta refresh delay greater than zero. Google interprets instant meta refresh (0 seconds) as a permanent redirect, but a delayed meta refresh (>0 seconds) as a temporary redirect. If you intend a permanent redirect, use 0 seconds.
• Relying only on JavaScript redirects. Google attempts to render JavaScript, but rendering may fail. If rendering fails, Google might never see the redirect. Use server-side or meta refresh redirects whenever possible.

How to Verify the Result

Check each redirect response’s status code and Location header to confirm it matches the intended permanent or temporary redirect type. For example, a permanent redirect should have a 301 or 308 status code, and the Location header should point to the new URL. A temporary redirect should use 302, 303, or 307.

If a redirect loop occurs, the server may respond with a 500 Internal Server Error, and browsers show an error message. Sometimes the server cannot detect the loop because it spans several servers each without the full picture. In that case, browsers will detect it and display an error such as “This Webpage has a redirect loop.” Monitoring for these signals can reveal loops.

For HTTPS redirects, verify that the first HTTP request returns a 301 and that after loading once, subsequent HTTP URLs are upgraded by the browser without a redirect. You can test this by clearing the browser’s HSTS cache, loading the http:// URL once, and then loading it again to see if the browser directly uses https.

Sources

• https://developers.google.com/search/docs/crawling-indexing/301-redirects
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Redirections
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Strict-Transport-Security

Check your own site with the Headers, Robots.txt & Sitemap Checker.