Sneaky redirects send users, search engines, or both to content they did not expect, or show users and search engines different content. Google lists them as a spam practice.
What does Google say?
Google describes the problem as using redirects maliciously to show users and search engines different content, or to show users unexpected content. Its examples are showing search engines one type of content while redirecting users to something significantly different, and showing desktop users a normal page while redirecting mobile users to a spam domain.
Redirects themselves are fine. Google names moving a site, consolidating pages, and redirecting logged-in users to an internal page as legitimate uses. What matters is intent. A sneaky redirect can run through server rules, a meta refresh, or JavaScript.
Hacked websites are a common source, because attackers add redirects that the owner never sees.
| Type | Permanent or temporary? | Request method | Effect in Google | How reliably Google detects it |
|---|---|---|---|---|
| 301 Moved Permanently | permanent | POST may become GET when followed | Signal that the target should become canonical | most reliable (server-side) |
| 308 Permanent Redirect | permanent | preserved | same as 301 | most reliable (server-side) |
| 302 Found | temporary | POST may become GET when followed | not used as a canonical signal for the target; other signals can still get it indexed | most reliable (server-side) |
| 307 Temporary Redirect | temporary | preserved | same as 302 | most reliable (server-side) |
| Meta refresh, instant (0 s) | permanent | – (redirect inside the HTML, no 3xx status code) | same as 301 | after server-side redirects |
| Meta refresh, delayed (> 0 s) | temporary | – (redirect inside the HTML, no 3xx status code) | same as 302 | after server-side redirects |
| JavaScript (location) | permanent | – (redirect in the browser) | same as 301, but only if Google renders the page | least reliable: if rendering fails, Google may never see it |
Google orders redirect types by how likely it is to interpret them correctly: server-side redirects first, JavaScript last. Request-method behaviour is defined in RFC 9110 (section 15.4). Sources: Google Search Central: Redirects and Google Search (last updated 2026-04-14); Google Search Central: How to specify a canonical URL (redirects as canonical signal); RFC 9110: HTTP Semantics, 15.4 Redirection 3xx. Last checked: .
Example
An injected script redirects only visitors who arrive from Google. The owner opens the page directly and notices nothing:
<script>
if (document.referrer.includes("google.")) {
location.href = "https://spam.example/";
}
</script>
Sources
- Spam policies: sneaky redirects – Google Search Centraldevelopers.google.com
- Redirects and Google Search – Google Search Centraldevelopers.google.com
Last updated: