{ "title": "Redirection", "seo_title": "Redirection plugin: review, recommended settings and limits", "h1": "Redirection", "description": "Redirection plugin: 301 redirects, 404 tracking, strengths, limitations, recommended log and IP settings, and its security track record.", "lead": "Redirection, one of the most installed redirect plugins for WordPress, manages 301 redirects and 404 tracking without touching your server config. Our take on its strengths and limitations, the log and IP settings to choose, and its security track record.", "language": "en", "locale": "en-US", "type": "plugin-sheet", "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/redirection/", "canonical": "https://www.wp-masquerade.com/features/camouflaged-plugins/redirection/", "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/redirection/index.md", "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/redirection/index.json", "published": "2026-11-04T08:00:00+00:00", "modified": "2026-11-05T21:21:37+00:00", "site": { "name": "WP Masquerade", "url": "https://www.wp-masquerade.com/" }, "translations": [ { "language": "en", "hreflang": "en-US", "title": "Redirection", "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/redirection/", "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/redirection/index.md", "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/redirection/index.json" }, { "language": "fr", "hreflang": "fr-FR", "title": "Redirection", "url": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/redirection/", "markdown": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/redirection/index.md", "json": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/redirection/index.json" }, { "language": "es", "hreflang": "es-ES", "title": "Redirection", "url": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/redirection/", "markdown": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/redirection/index.md", "json": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/redirection/index.json" }, { "language": "de", "hreflang": "de-DE", "title": "Redirection", "url": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/redirection/", "markdown": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/redirection/index.md", "json": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/redirection/index.json" }, { "language": "it", "hreflang": "it-IT", "title": "Redirection", "url": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/redirection/", "markdown": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/redirection/index.md", "json": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/redirection/index.json" }, { "language": "pt", "hreflang": "pt-BR", "title": "Redirection", "url": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/redirection/", "markdown": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/redirection/index.md", "json": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/redirection/index.json" }, { "language": "nl", "hreflang": "nl-NL", "title": "Redirection", "url": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/redirection/", "markdown": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/redirection/index.md", "json": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/redirection/index.json" } ], "headings": [ { "level": 1, "text": "Redirection" }, { "level": 2, "text": "What Redirection does on your site" }, { "level": 2, "text": "Which sites Redirection is a good fit for" }, { "level": 2, "text": "Redirection strengths and limitations" }, { "level": 3, "text": "Strengths" }, { "level": 3, "text": "Limitations" }, { "level": 2, "text": "The settings we recommend for Redirection" }, { "level": 2, "text": "Redirection security: a short, old track record" }, { "level": 2, "text": "Redirection FAQ", "id": "faq" } ], "body": "## The essentials\n\n- Best for redesigns, permalink changes and sites that want to track and fix their 404 errors.\n- Main caveat: one developer, no paid support, and an admin screen that relies on the REST API.\n- Free with no paid version: conditions, logs, imports and WP-CLI are all included.\n\n## What Redirection does on your site\n\nRedirection manages [301 redirects](https://www.wp-masquerade.com/glossary/301-redirect/) and the other redirect codes (302, 303, 307, 308) from the WordPress dashboard, with no need to edit .htaccess or your Nginx config. You enter a source URL and a target URL under Tools > Redirection, and the plugin catches the request before WordPress renders a page. A redirect can also depend on a condition: login status, role or capability, browser, referrer, cookie, HTTP header, IP address, server, language or WordPress page type. Regular expressions are supported, so one rule can cover a whole family of URLs.\n\nThe plugin logs the redirects it serves and every [404 error](https://www.wp-masquerade.com/glossary/404-error/), groups them by URL, IP or user agent, and lets you turn a 404 into a redirect in one click. It can watch post and page permalinks and create the redirect on its own when a slug changes. Redirects can be imported and exported as CSV, JSON, Apache .htaccess, Nginx rewrite rules and `_redirects` files, and built-in importers pull them in from Rank Math, Yoast SEO Premium, Simple 301 Redirects or Safe Redirect Manager. A `wp redirection` WP-CLI command automates imports and exports.\n\nRedirection has been developed since 2007 by John Godley, the only contributor listed on wordpress.org. It is completely free and open source, with no Premium version or paid add-on; the official documentation lives on redirection.me and development happens on GitHub.\n\n![Diagram: Redirection works on visitors and bots, wordpress, database and files. Public traces: branded HTTP header (removed, free version).](https://www.wp-masquerade.com/media/wpm-sheets/redirection/diagram-en.svg?v=4fadcbbd)\n\n## Which sites Redirection is a good fit for\n\nRedirection makes sense when redirects are a real job on your site, not a checkbox:\n\n- **Redesigns and permalink structure changes**: CSV import, regular expressions and permalink migration keep the traffic from your old URLs.\n- **Publishers who rename content often**: permalink monitoring creates the redirect the moment a slug changes.\n- **Sites that want to track their 404s**: the grouped log shows the most requested broken links and, along the way, the bots probing `/.env` or `/wp-config.php.bak`.\n- **Agencies and developers**: WP-CLI, JSON export between sites and advanced conditions cover cases an all-in-one SEO plugin does not.\n\nIt is not the right pick if you already run [Rank Math](https://www.wp-masquerade.com/features/camouflaged-plugins/rank-math-seo/), whose free version includes a redirection manager and a 404 monitor: two active redirect tools make troubleshooting harder. And if your server or CDN already handles all your redirects, a second layer inside WordPress adds nothing.\n\n## Redirection strengths and limitations\n\n### Strengths\n\n- **Everything is free.** Conditions, regular expressions, logs, imports and WP-CLI are all included, with no paid tier.\n- **Fine-grained conditions.** The same URL can redirect differently by login status, role, referrer, cookie or HTTP header.\n- **Real 404 tracking.** Errors are grouped, filterable and can be redirected in bulk.\n- **Complete import and export.** CSV, JSON, .htaccess, Nginx and importers for Rank Math or Yoast SEO Premium make switching tools easy.\n- **Few known vulnerabilities.** The Patchstack database lists no vulnerability published since 2018.\n\n### Limitations\n\n- **A single developer.** There is no paid support: help comes through the wordpress.org forum and GitHub.\n- **Relies on the REST API.** The admin screen stops working if a security plugin or firewall blocks the REST API.\n- **Nginx is export only.** The plugin writes to Apache’s .htaccess itself, but for Nginx you copy the exported rules by hand.\n- **Logs take up space.** Redirect and 404 logs live in the database; with long retention or HTTP header capture, the tables grow fast.\n\n## The settings we recommend for Redirection\n\nThe first-run setup wizard already offers permalink monitoring and logging. Then fine-tune these settings under Tools > Redirection, on the Options and Site tabs:\n\n| Setting | Recommended value | Why |\n| --- | --- | --- |\n| **Redirect Logs** Tools > Redirection > Options | A week (default) or A month | Long enough to confirm a redirect is used, without filling up the database. |\n| **404 Logs** Same screen | A week, A month during a redesign | The 404 log grows fast on a site probed by bots; extend it only for the length of a migration. |\n| **IP Logging** Same screen | Anonymize IP (mask last part) or No IP logging | A full IP address is personal data; an anonymized IP is enough to spot a persistent bot. |\n| **Capture HTTP header information** Same screen | Off (default) | This data may include user information and makes logs much larger; turn it on only while troubleshooting. |\n| **URL Monitor Changes** Same screen, URL section | Posts and pages checked, “Modified Posts” group | Every changed slug gets its own 301, filed in a separate group that is easy to review. |\n| **HTTP Cache Header** Same screen | An hour (default) | Browsers remember a 301; a short duration lets you fix a mistake without waiting. |\n| **Force a redirect from HTTP to HTTPS** Tools > Redirection > Site > Canonical Settings | On only if your host or CDN does not already do it | The plugin asks you to confirm HTTPS works first; one HTTPS redirect, in one place, avoids redirect chains. |\n| **REST API** Tools > Redirection > Options | Default REST API | The plugin advises changing it only when something is blocked; better to allow the REST API in your security plugin. |\n\nThe Site tab can also add HTTP headers to the whole site (HSTS, X-Frame-Options, Referrer-Policy...). If you already manage them elsewhere, at the server or with WP Masquerade’s [security headers](https://www.wp-masquerade.com/features/security-headers/), set them in one place only to avoid duplicates.\n\n- Create a test redirect, then open the source URL in a private window: you should land on the target with the right code (301 or 302).\n- Change the slug of a published test post: a redirect should appear in the “Modified Posts” group.\n- After a week, open the 404 tab grouped by URL: redirect the real broken links and ignore the bot probes.\n- Export your redirects as JSON before any major update or site migration.\n\n## Redirection security: a short, old track record\n\nPatchstack lists five vulnerabilities for Redirection, all patched and all from before 2019. The two most recent:\n\n- **CVE-2018-1000504, fixed in 2.8**: in “Pass-through” mode, an administrator account could make the server run any PHP file through file inclusion.\n- **Cross-site request forgery (CSRF), fixed in 3.6.3** (November 2018): a booby-trapped page could trigger plugin actions behind a logged-in administrator’s back.\n\nToday the main risk is the data: logs can store IP addresses, referrers and user agents, which is personal data to limit and purge (see our article on GDPR and WordPress logs). The 404 log, on the other hand, is a good place to watch the [scanner bots](https://www.wp-masquerade.com/scanner-bots-in-your-logs/) targeting your site. Keep the plugin updated, ideally with automatic updates. Redirection also tags every redirect it serves with an `X-Redirect-By: redirection` HTTP header: the free version of WP Masquerade strips that branded header, which makes the plugin less visible to bots without replacing updates.\n\n## Redirection FAQ\n\n**Does Redirection slow down my site?**\n\nAccording to the official FAQ, looking up a redirect works much like WordPress permalinks and should not noticeably slow the site. With many regular expressions, redirect caching (in beta) relies on an object cache such as Redis.\n\n**What happens to my redirects if I deactivate the plugin?**\n\nRedirects handled by WordPress stop working, but they stay in the database and come back when you reactivate it. Deleting the plugin from the Plugins screen, however, removes its tables: export your redirects as JSON or CSV first.\n\n**Can I bring over redirects from Yoast SEO Premium or Rank Math?**\n\nYes, Redirection’s import includes importers for Yoast SEO Premium, Rank Math, Simple 301 Redirects and other plugins. Then turn off the old plugin’s redirect manager to avoid duplicate rules.\n\n**Should I keep 404 logs forever?**\n\nNo. A week or a month is enough to spot broken links; beyond that, the table mostly fills up with bot requests and personal data of no use.\n\n## Key facts\n\n- Category: SEO\n- Vendor: John Godley\n- Price: Free, with no paid version\n- Active installations (wordpress.org): 2 000 000+\n- Version: 5.10.1\n- Official page: https://wordpress.org/plugins/redirection/\n\n## What WP Masquerade hides\n\n- Handled by the free version of WP Masquerade\n- Removed by the free version: branded HTTP header", "catalog": "redirection", "essentials": [ "Best for redesigns, permalink changes and sites that want to track and fix their 404 errors.", "Main caveat: one developer, no paid support, and an admin screen that relies on the REST API.", "Free with no paid version: conditions, logs, imports and WP-CLI are all included." ], "format": "application/json" }