QR code redirect problems, explained simply
The camera locks on instantly, the link opens... and then a 404, a security warning, or a loading spinner that outlives the customer's patience. Scanning succeeded — the journey after it failed. That journey is a chain of hops, and any hop can be the broken one.
Read the chain
A scanned QR triggers: *decoded URL → (optional shortener) → (optional tracking or dynamic redirect) → final page*. Your job is to find which arrow fails. Scan the code, copy the decoded URL instead of opening it, and paste it into a browser where you can watch what happens.
The errors, translated
- 404 Not Found — the address is valid, the page is gone: deleted, renamed, or a site migration that forgot its redirects. The code is innocent; restore the page at the same address.
- 403 Forbidden — the page exists but refuses visitors: permissions, geo-blocking, or a hosting security rule.
- 500 / 502 / 503 — the destination server is failing; usually temporary, worth monitoring if repeated.
- Certificate warnings — expired or mismatched HTTPS certificate. Browsers make this look alarming, and customers flee. Renew it; and never encode plain `http://` on prints — encode the final `https://` address directly.
- Endless redirect / loop — misconfigured forwarding rules chasing each other. Fix at the destination.
- The shortener died — bit.ly-style links and their kin are companies; links get disabled, flagged by corporate security filters, or the service sunsets. On a screen you'd relink in seconds. On five hundred printed menus, it's a different story.
Dynamic layers count double
If your code went through a dynamic-QR provider, their redirect is one more hop with its own failure modes — subscriptions, scan caps, account access. That specific chain has its own diagnosis page.
The routing rules for printed codes
- Encode the final HTTPS address directly — every hop you remove is a failure mode you delete.
- Use a domain you own and intend to keep — the code lives as long as the print does.
- Keep the URL short by design (clean paths, no tracking soup) rather than short by shortener.
- Test in private browsing before printing — your logged-in browser hides errors a stranger's phone will hit.
- Recheck after site migrations — the print doesn't know your CMS changed.
A static code pointing straight at a stable HTTPS address on your own domain has exactly one thing left to break: the page itself — which you control. That is the whole reliability argument in one sentence.
Frequently asked questions
My QR code scans but shows a 404 — is the code broken?
No. A 404 means the scan and decoding worked perfectly; the destination page no longer exists at that address. Fix the page or its redirect — reprinting the same code changes nothing.
Why does my QR code show a security warning?
The destination's HTTPS certificate is expired, invalid or mismatched, or the code points to plain HTTP and the browser objects. Renew the certificate or update the destination to a proper HTTPS address.
Are link shorteners safe to put in a QR code?
They add a dependency: if the shortener service closes, disables the link or gets flagged by security filters, your printed code dies with it. For anything printed, encode a direct address you control.
Why is my QR code so slow to open?
Count the hops: shortener → tracking redirect → mobile redirect → final page. Each adds latency, and mobile users abandon quickly. Fewer hops, faster arrival, fewer mysterious failures.
Create a QR code that answers to no server.
Static, permanent, yours. €5 once — no subscription, no expiry, print-ready files.
Create my permanent QR