NetDetectHubGet the app

Home / Learn

Module 4: Websites and subnetsLesson 11 of 135 min read

HTTP redirects explained: 301, 302, 307 and 308

When a page moves, the server answers a request for the old address with a status code from the 3xx class and a Location header naming the new one. The browser follows it without the visitor noticing. The choice of code still matters: it tells browsers whether they may change the request, and tells search engines which address to show in results.

How a redirect works

RFC 9110 sorts HTTP status codes by their first digit; 3xx means further action is needed to complete the request. For the redirects in this lesson, the server should send a Location header with the new URI, and the client may use it for automatic redirection.

Each redirect is a full round trip: the browser sends a request, gets the 3xx answer, then sends a new request to the Location. A chain of three redirects means four requests before the first byte of the real page arrives.

The four codes, side by side

The codes differ on two questions: is the move permanent, and may the client change the request method?

  • 301 Moved Permanently: the resource has a new permanent URI and future references ought to use it. MDN notes that GET stays GET, but some clients change other methods, such as POST, to GET.
  • 302 Found: the resource is temporarily at another URI, and the client should keep using the original. Same method caveat as 301.
  • 307 Temporary Redirect: like 302, but RFC 9110 says the client must not change the request method.
  • 308 Permanent Redirect: like 301, with the method and body kept unchanged.

Why 307 and 308 exist

MDN explains that the original specifications did not intend 301 and 302 to allow method changes, but existing user agents changed POST to GET anyway. 307 and 308 were created to remove that ambiguity. A related code, 303 See Other, deliberately turns any method into GET and is meant for redirecting after a form is submitted.

What search engines do with them

Google's Search Central documentation groups redirects by intent. Permanent ones, including 301 and 308, are used as a signal that the redirect target should be canonical, so the new URL is shown in search results. Temporary ones, including 302, 303 and 307, are followed but not used as that signal, so the source URL tends to stay in results.

Google recommends a permanent server-side redirect whenever a page's URL changes for good. A temporary redirect suits short-lived cases, such as sending visitors to a notice page while a service is unavailable. Google also notes that after a domain move, old URLs can keep appearing in results for a while as alternate names; that is expected.

Worked example: cleaning up a chain

A site moved a page from /old to /new, switched to HTTPS and later to the www host. Each change added a redirect on top of the previous ones.

Before and after

Before: http://example.com/old → 301 → https://example.com/old → 301 → https://www.example.com/old → 308 → https://www.example.com/new → 200. That is 3 redirects and 4 requests. After: point every old address straight at the final one: http://example.com/old → 301 → https://www.example.com/new → 200, one redirect and 2 requests. The first hop from http to https is unavoidable for the very first visit unless HSTS is in place.

HTTPS upgrades and HSTS

Most sites redirect http:// to https://. That first plain-HTTP request is the weak point: RFC 6797, which defines HTTP Strict Transport Security, describes this as the bootstrap MITM (man-in-the-middle) vulnerability: the first contact goes over an insecure channel, so an attacker on the network can interfere before the redirect is ever seen.

HSTS fixes it for later visits. When a site sends a Strict-Transport-Security header over HTTPS, with a max-age in seconds, the browser remembers to use HTTPS for that host and skips the plain-HTTP request entirely, along with its redirect.

Two more checks are worth doing on any chain. RFC 9110 says clients should detect and stop redirect loops, so a loop shows up as an error rather than a slow page. And a chain that alternates between hosts, such as example.com and www.example.com, often points to two rules that disagree about which host is canonical.

Follow a link hop by hop. The table lists each step's Status, URL and Time, and Total time adds them up. Look for 302 or 307 where a move is permanent, and for chains longer than one or two hops; the notes on the result point out both.

Redirect checker

Quick check

Three questions. Pick an answer to see why.

  1. A product page has moved to a new URL for good. Which code tells Google to show the new URL in results?

    Show the answer

    Answer: 301 Moved Permanently Google treats 301 (and 308) as permanent, using the target as the canonical URL.

  2. An API endpoint that accepts POST requests has moved permanently. Which code keeps clients sending POST to the new address?

    Show the answer

    Answer: 308 Permanent Redirect 308 is permanent and forbids changing the method or body.

  3. Why does HSTS reduce redirects for returning visitors?

    Show the answer

    Answer: The browser remembers to use HTTPS for the host, so it never sends the plain-HTTP request that triggered the redirect For the max-age period the browser goes straight to https://, skipping the http hop.

Standards, not guesses

These guides explain how the internet's plumbing works, using the published standards (RFCs) and official documentation. Each guide shows the date it was last checked.

Sources

Last checked October 28, 2026

Results come from public DNS, registry and certificate data and from checks run from Cloudflare's network at the moment you ask. They can differ from what another network sees. How our tools work · Terms of use.