Temporary Redirect (302/307) Used for a Permanent Move

A 302/307 tells search engines the move is temporary, so they keep indexing the old URL and may not pass full ranking signals to the new one.

Why it matters

A 302/307 tells search engines the move is temporary, so they keep indexing the old URL and may not pass full ranking signals to the new one. Permanent moves should use a 301.

Schedule a fix in your next sprint. Warnings won't block your site but they consistently leave performance on the table. Estimated SEO impact: medium — measurable effect on click-through or relevance.

How to fix

• Change the redirect to 301 (Moved Permanently) when the move is permanent
• Keep 302/307 only for genuinely temporary redirects (A/B tests, maintenance)
• Verify the new URL is the intended final destination

Common causes

If the rule is firing across many pages, the root cause is almost always one of these:

• Mixed-content sub-resources from before HTTPS migration that escaped the rewrite.
• CDN or upstream proxy strips a security header that was set at the origin.
• Legacy redirects send HTTPS traffic through HTTP first.
• Test/staging hostnames leak into production HTML via hard-coded URLs.

Anti-patterns to avoid

Even with the best intentions, these "fixes" make the issue worse — recognise them so you don't ship them:

• Mixed HTTP/HTTPS resources after migration.
• Self-signed or expired certificates on production.
• Long-lived secrets in client-rendered HTML or JS bundles.

How atlookup detects this

Our crawler renders each page with a real headless browser, then inspects HTTPS state, response headers, mixed content, and certificate validity. Pages where the rule fires for temporary redirect (302/307) used for a permanent move are flagged on the report.

If you'd like to see this rule fire on your own site, run a free 60-second audit — every page is reported with the exact lines that triggered it.

Tools to verify the fix

Once you've applied the fix, double-check with these external validators:

• SSL Labs — Grades certificate + protocol configuration.
• securityheaders.com — Audits response headers against best practice.

Frequently asked questions

Related issues