The Five-Second Summary

  • 301 (Moved Permanently): use for permanent moves. Transfers SEO signal to the new URL. The default for HTTPβ†’HTTPS, wwwβ†’non-www, and domain migrations.
  • 302 (Found / Moved Temporarily): use for genuinely temporary redirects. Does not transfer SEO signal in the same way. Default for A/B tests, geo-redirects, login flows.
  • 307 (Temporary Redirect, strict): like 302 but preserves the HTTP method. Modern equivalent.
  • 308 (Permanent Redirect, strict): like 301 but preserves the HTTP method. Modern equivalent.

For most static-content cases, 301 is what you want. For form submissions and APIs, 308 is technically correct. The distinction matters more for APIs than for SEO; search engines treat 308 like 301.

Why HTTP→HTTPS Is the Most Common Case

You set up SSL on your domain. Now you have two versions of every URL: http://example.com/page and https://example.com/page. Without a redirect, search engines may index both, your pages get split signal, and users on direct HTTP links see a "Not Secure" warning.

The fix is a 301 redirect from every HTTP URL to the equivalent HTTPS URL. Configure it at the web server, the CDN, or the application layer β€” any of those works.

The Four Variations You Must Handle

For most domains there are four URL variants that need to converge on one canonical form:

  1. http://example.com/page
  2. http://www.example.com/page
  3. https://example.com/page
  4. https://www.example.com/page

Pick one canonical (most commonly https://example.com or https://www.example.com β€” both are valid choices). Redirect the other three to it via 301.

Critically: the redirect should go directly to the canonical, not through intermediate hops. Avoid the "HTTP non-www β†’ HTTP www β†’ HTTPS www β†’ HTTPS non-www" chain β€” each hop loses signal and adds latency.

The Anatomy of a Correct Redirect Chain

For a canonical of https://example.com:

  • http://example.com/page β†’ 301 β†’ https://example.com/page
  • http://www.example.com/page β†’ 301 β†’ https://example.com/page
  • https://www.example.com/page β†’ 301 β†’ https://example.com/page

One hop, always. Verify with curl -I -L or a redirect-checker tool β€” if you see two or more 301s in a row, fix the chain.

301 Mistakes That Kill SEO

1. Using 302 by Default

Many web frameworks default to 302 for redirects. In Express.js, Django, Rails, you have to explicitly request a 301. Many developers do not. The result: years of "temporary" redirects that Google treats with reduced signal transfer.

Always explicitly set the status. In Express: res.redirect(301, '/new'). In Django: HttpResponsePermanentRedirect(). In Rails: redirect_to '/new', status: :moved_permanently.

2. Redirect Chains

"http://yoursite.com/old β†’ https://www.yoursite.com/old β†’ https://yoursite.com/old β†’ https://yoursite.com/new" is a four-hop chain. Each hop:

  • Adds 50–200ms latency.
  • Reduces the signal transfer Google performs.
  • Increases the chance one hop breaks and the whole chain fails.

Collapse to one hop. Always.

3. Redirecting Everything to the Homepage

"We restructured the site, so we redirected all old URLs to the homepage." This is the worst common pattern. You lose every page-level signal. Google treats it as if the old content disappeared.

Map every removed URL to the closest equivalent on the new structure. If genuinely no equivalent exists, return 410 Gone (which Google de-indexes more cleanly than a 404 or a misleading 301-to-homepage).

4. Not Redirecting Trailing Slash Variants

example.com/page and example.com/page/ are different URLs. If your CMS allows both, search engines may index both and split signal. Pick one (with or without trailing slash) and 301-redirect the other.

5. Removing Old Redirects Too Soon

You did the migration two years ago. Why keep the redirects? Because external sites still link to old URLs, and those links still get clicked. The cost of the redirect rule is zero. Removing it loses you the residual traffic forever.

6. Loops

If your "force HTTPS" rule incorrectly matches both HTTP and HTTPS, you get an infinite redirect loop. Browsers detect this and show ERR_TOO_MANY_REDIRECTS. Common causes: misconfigured load balancer headers (X-Forwarded-Proto missing), HSTS plus a misbehaving CDN.

Test your redirects with curl -L -I --max-redirects 5 as part of any change. If max-redirects fires, you have a loop.

302 / 307 Use Cases

Genuine temporary redirects exist:

  • Maintenance pages. While the site is down, redirect to a status page. When maintenance ends, undo the redirect. 302 here is correct.
  • A/B testing. Redirecting half of users to variant B during a test. Should be 302; the redirect is genuinely not permanent.
  • Geo-routing. Sending users in Europe to /eu/ during a region launch. 302, because the canonical URL the user typed is still meaningful.
  • Login / authentication flows. Returning a user to the page they were trying to reach after authentication. 302/307 is conventional.

The test: if the redirect is meant to last forever, use 301. If it is a momentary detour, use 302.

HSTS: The Layer Above Redirects

Even with a perfect 301 from HTTP to HTTPS, the user's first request still goes over HTTP and could be intercepted. HSTS (HTTP Strict Transport Security) fixes this:

  • You return a header Strict-Transport-Security: max-age=31536000; includeSubDomains.
  • The user's browser remembers this for 1 year.
  • Future requests, even typed as HTTP, go directly to HTTPS β€” never even attempting HTTP.

Combined with HSTS preload (where browsers ship a built-in list of HSTS-only domains), this eliminates the HTTP→HTTPS redirect for repeat visitors entirely.

Caution: HSTS is hard to undo within its max-age. Test thoroughly. Start with a short max-age (300 seconds) and ramp up only when confident.

The Verification Process

For any redirect change:

  1. Test with curl: curl -I -L -A "Googlebot" http://example.com/somepage. Confirm status codes, intermediate URLs, and final destination.
  2. Test as a search engine sees it. Use Google Search Console's URL Inspection on the old URL β€” it shows what Google sees.
  3. Test for chains. If you see more than one 301/302 in the curl output, fix it.
  4. Test edge cases. URLs with trailing slashes, with query strings, with fragments. Each should redirect cleanly.

The Rules in One Sentence

Use 301 for permanent moves, 302 for temporary detours, single-hop redirects always, keep them in place forever, verify with curl after every change. Almost every "we lost rankings after the migration" story traces back to violating one of those rules.