docs
stormdoor.dev
FINDING

link.hop_cap_exceeded

The redirect chain didn't reach a final response within 10 hops.

SEVERITY
medium
LEADS TO
suspect
GATE
/v1/links
CHECK
link.redirect_chain
Jump to what to do

What it looks at#

The redirect-chain walker follows HTTP redirect status codes (301, 302, 303, 307, 308) up to a fixed cap of 10 hops. If the chain hasn’t reached a final, non-redirect response by then, this fires and the walk stops there (data.chain.truncated: true). Ten is deliberately tighter than common defaults — curl’s own default cap is 50, and most browsers allow around 20.

Why it matters#

An unusually long redirect chain is a common cloaking technique: each additional hop is another opportunity to branch the destination based on referrer, user-agent, or requester IP, so the same link can lead different visitors to different places. It’s also just sometimes a genuine redirect loop or sloppy chain — this check doesn’t distinguish intent, only the fact that the destination couldn’t be confirmed within the cap.

What to do#

Medium severity. The real signal here is “we don’t actually know where this leads” — treat it that way rather than as a confirmed-bad verdict.

OTHER FINDING CODES FROM /V1/LINKS