Open redirect links: Crawl Audit check 163

Short answer: an open redirect is an address on your site that forwards visitors to any website named in the link, like /go?url=https://elsewhere.example. Scammers use these because the link starts with your trusted domain. Check 163 looks for links on your page that pass a full address in a redirect parameter.

What Crawl Audit checks

• It reads links and form actions on your homepage for parameters named redirect, url, next, return, returnurl, dest, destination, continue, goto or redir.
• Warning: one of those carries a full web address. The report lists up to three.
• Pass: none found, or they only carry paths on your own site.

It only reads your page. It never tries the redirect, so it can't tell whether your site would actually forward to any address. A warning means "test this link".

What the sources say

• OWASP: "By modifying untrusted URL input to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials."
• MITRE CWE-601: "Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance."
• OWASP's simplest advice: "Simply avoid using redirects and forwards."

Fixing it

• If you need a redirect after login, accept only a path on your own site (starting with a single /), not a full address.
• If you must send people elsewhere, keep a list of allowed destinations and refuse anything not on it.
• For tracked outbound links, use an ID (/go/42) that maps to a fixed address on the server.

On devmarde.com

Our homepage had no links or forms with redirect parameters on 6 October, so it passes.

Sources

• OWASP, Unvalidated Redirects and Forwards Cheat Sheet.
• MITRE, CWE-601: URL redirection to untrusted site, checked 6 October 2026.