Finding: Redirect Without Location
The server sends a redirect status code (3xx) but no Location header, so the browser has nothing to redirect to and the visitor gets an error instead of the site.
Last updated August 11, 2026.
What it means
A redirect response (301, 302, 303, 307, or 308) is only meaningful if it carries a Location header telling the browser where to go next. This finding fires when the server returns one of those status codes but omits the header — a malformed redirect. Browsers vary in how they handle it, but none of them can follow a redirect to nowhere.
Why it matters
This is usually a broken-configuration problem rather than an encryption one: the connection may or may not become encrypted, because the browser never learns where it's supposed to go. In practice, visitors who hit this either see a browser error or get stuck on a blank response, which is as much an availability problem as a security one — and it usually means the HTTP-to-HTTPS redirect rule intended for this domain isn't actually doing its job.
What Nivaronix checks
Nivaronix makes a live HTTP request to the domain. If the response status code is a redirect (301/302/303/307/308) but the response has no Location header, this finding fires. This is a configuration check against the live response — not a vulnerability scan.
Example evidence (illustrative — not live scan data)
GET http://example.com/ HTTP/1.1 HTTP/1.1 301 Moved Permanently (no Location header present)
How to fix it
Add a Location header pointing at the intended https:// destination to every redirect response. This is most often a symptom of a hand-written redirect rule or reverse-proxy config that sets the status code but forgets the header.
Nginx
# return sets both the status and the Location header together —
# prefer this over add_header, which is easy to omit by mistake
server {
listen 80;
server_name example.com;
return 301 https://example.com$request_uri;
}Apache
Redirect 301 / https://example.com/ # or, with mod_rewrite, ensure the [R=301,L] flags are present — # a rewrite rule without [R] rewrites internally and sends no redirect at all
Cloudflare
If using a Redirect Rule or Page Rule, confirm the rule actually specifies a target URL — an empty or misconfigured destination field is the most common cause of this at the edge.
How to verify the fix
Re-run the website security scanner and confirm the redirect response now includes a Location header pointing at your https:// site.