How Location works
Relative URLs are allowed and resolved against the request URL. 301 and 308 are permanent, 302, 303 and 307 temporary; 307 and 308 keep the method and body, while browsers turn POST into GET for 301, 302 and 303.
Examples
HTTP/1.1 301 Moved Permanently
Location: https://www.example.com/new-pathHTTP/1.1 201 Created
Location: /api/orders/1042Common mistakes
- Build redirect targets from a list of allowed URLs; redirecting to a URL taken from a query parameter is an open redirect that phishers abuse.
Check it
curl -sI https://example.com | grep -i '^location:'Paste a full set of response headers into the HTTP header checker to get every header explained and common mistakes flagged.
Related headers
- Retry-After: tells the client how long to wait before trying again, after 429, 503 or a redirect.
- Strict-Transport-Security: tells browsers to use only HTTPS for this site, for a given time (HSTS).
- Link: expresses links in a header: preload hints, preconnects, pagination and canonical URLs.
More requests, redirects and more headers
User-Agent , Host , Sec-Fetch-Site , Clear-Site-Data , Server-Timing .
Sources
Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.
Frequently asked questions
What does the Location header do?
The Location response header gives the URL to redirect to (with 3xx) or of a newly created resource (with 201). Relative URLs are allowed and resolved against the request URL. 301 and 308 are permanent, 302, 303 and 307 temporary; 307 and 308 keep the method and body, while browsers turn POST into GET for 301, 302 and 303.
How do I see the Location header?
Run "curl -sI https://example.com" to print a response’s headers, or open the Network tab in your browser’s dev tools and select the request. Paste the headers into the HTTP header checker on this site to get each one explained.