> ## Documentation Index
> Fetch the complete documentation index at: https://pentest-tools.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Follow redirects

> Control how scanning tools handle HTTP redirects before scanning begins

When you scan a URL that redirects to another location, the scanner has to decide which URL to actually test. The "Follow redirects" setting controls this: whether the scanner follows the redirect and tests the destination, or stays on the original URL you entered.

This is a target validation step. It runs before scanning starts, not during the scan itself. The platform checks whether the target URL redirects, validates whether the destination is within the configured scope, and updates the scan target accordingly.

The default is **Same-domain only**, which covers the most common redirect patterns: HTTP to HTTPS upgrades and bare domain to `www` redirects.

## Supported tools

The follow redirects option is available for any tool that accepts a URL as a target.

| Tool                                          | Notes                                                    |
| --------------------------------------------- | -------------------------------------------------------- |
| [Website Scanner](/docs/tools/website-scanner)     | Disabled automatically when authentication is configured |
| [API Scanner](/docs/tools/api-scanner)             | Disabled automatically when authentication is configured |
| [URL Fuzzer](/docs/tools/url-fuzzer)               | Always active                                            |
| [WordPress Scanner](/docs/tools/wordpress-scanner) | Disabled automatically when authentication is configured |
| [SQLi Exploiter](/docs/tools/sqli-exploiter)       | Disabled automatically when authentication is configured |
| [XSS Exploiter](/docs/tools/xss-exploiter)         | Disabled automatically when authentication is configured |

<Note>
  When you configure authentication for a tool, redirect following is disabled automatically. The scanner tests the original URL to avoid redirect loops with login pages.
</Note>

## Options

The default is **Same-domain only** (`same_domain`).

| Option               | API value     | Description                                                                                                                       |
| -------------------- | ------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| **Never**            | `none`        | Scan the original URL. Ignore all redirects.                                                                                      |
| **Same-host only**   | `same_host`   | Follow redirects within the same hostname. Allows protocol (HTTP to HTTPS) and path changes, but not subdomain or domain changes. |
| **Same-domain only** | `same_domain` | Follow redirects within the same registrable domain. Allows subdomain changes in addition to protocol and path changes.           |
| **Always**           | `allow_all`   | Follow redirects to any destination, including a different domain.                                                                |

## How it works

Before a scan starts, the platform checks whether the target URL redirects. Based on the result:

* **Redirect within scope**: the scan target is updated to the redirected URL and the scan proceeds normally
* **Redirect out of scope**: the scan is rejected with an error
* **No redirect**: the scan runs against the original URL

### Redirect types

The levels are cumulative. Same-domain only covers everything Same-host only covers, and adds subdomain changes. Always follows any redirect.

| Redirect type                                                   | Minimum level needed |
| --------------------------------------------------------------- | -------------------- |
| Protocol change (`http://example.com` to `https://example.com`) | Same-host only       |
| Path change (`example.com` to `example.com/login`)              | Same-host only       |
| Subdomain change (`example.com` to `www.example.com`)           | Same-domain only     |
| Different domain (`example.com` to `other.com`)                 | Always               |

## When to use each option

**Never.** Use when you want to test the exact URL you entered, regardless of where it redirects. Good for testing redirect behavior itself, or when the redirect destination is outside your engagement scope.

**Same-host only.** Use when the target may redirect between HTTP and HTTPS or to a different path on the same server, but you want to stay strictly on the same hostname.

**Same-domain only** is the right choice for most scans. It handles HTTP to HTTPS upgrades and www-prefixed redirects without risking unintended scope expansion.

**Always.** Use when you have explicit authorization to test the redirect destination and know it may be on a different domain.

<Warning>
  **Always** follows redirects to any domain. Only use this when your scope explicitly covers the redirect destination.
</Warning>

## API

Use the `redirect_level` parameter when starting scans via the API. The default is `same_domain`.

Valid values: `none`, `same_host`, `same_domain`, `allow_all`.

```bash theme={null}
curl -X POST https://api.pentest-tools.com/api/v2/scans \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "tool_id": 170,
    "target_name": "https://example.com",
    "redirect_level": "same_domain"
  }'
```

## Troubleshooting

<AccordionGroup>
  <Accordion title="Scan rejected because redirect is out of scope">
    If a scan fails because the target URL redirects to an out-of-scope destination, the Follow redirects setting is too restrictive for the redirect the target performs.

    Increase the Follow redirects level to cover the redirect type:

    | Redirect type                  | Minimum setting needed |
    | ------------------------------ | ---------------------- |
    | HTTP → HTTPS, or path change   | Same-host only         |
    | Bare domain → `www` subdomain  | Same-domain only       |
    | Redirect to a different domain | Always                 |

    Only use **Always** if your engagement scope explicitly covers the redirect destination.
  </Accordion>
</AccordionGroup>

## Related topics

* [Authenticated scanning](/docs/core/scans/authenticated-scanning): when authentication is configured, redirect following is disabled automatically
* [Website Scanner](/docs/tools/website-scanner)
* [API Scanner](/docs/tools/api-scanner)