Redirects in Joomla

1. The Basics

1.1 What is the Redirects Component?

The Redirects component (com_redirect) is Joomla's built-in tool for managing HTTP redirects and capturing 404 (Page Not Found) errors. It has shipped with Joomla core since version 1.6.

In short, it does four things:

• It watches for 404 errors through the System - Redirect plugin.
• It logs every missed URL in the database, together with the referrer and a hit counter.
• It lets you map old URLs to new ones with the correct HTTP status code.
• It supports bulk import for migrations, so you can prepare hundreds of redirects at once.

The flow is simple: an old URL returns a 404, Joomla logs it, an administrator fills in a new URL, and the next visitor gets redirected automatically.

1.2 Where Do I Find the Redirects?

In the Joomla 6 backend, three places are relevant:

Components → Redirects                           (manage redirects and 404 log)
Components → Redirects → Options                 (component-wide settings, ACL)
System     → Manage  → Plugins → System - Redirect (collector and handler)

The component lives at administrator/components/com_redirect/. The plugin that hooks into the error system lives at plugins/system/redirect/.

1.3 The Two Pieces

The Redirects feature is built from two parts that work together:

Both must be enabled. The component without the plugin is just a passive list. The plugin without the component has nothing to read from.

1.4 Enable the Plugin

A fresh Joomla install ships the System - Redirect plugin disabled. Until you switch it on, none of the redirects in the component fire and no 404s are logged.

Go to System → Manage → Plugins, search for redirect, and enable the plugin.

1.5 Your First Redirect

To create a redirect manually, open Components → Redirects → New and fill in:

Save the form, then visit /old-article. The browser is forwarded to /new-shiny-article with a 301 status code.

3. HTTP Status Codes

3.1 Why the Status Code Matters

A redirect is not just "go here instead". The HTTP status code tells browsers, crawlers, and link-equity algorithms why the URL has moved.

In daily practice you only pick two: 301 for "the page moved forever" and 302 for "just for now".

3.2 Unlocking Custom Status Codes

By default, the component forces every redirect to 301, no matter what you selected on the row. To honour the per-row code you must enable one switch:

Components → Redirects → Options → Use Custom Redirect Status Codes = Yes

Without this switch the HTTP Status Code dropdown on each row is decorative. Turn it on before you import a CSV that mixes 301 and 302 codes, otherwise every imported row is silently flattened to 301.

3.3 What the Redirect Looks Like

When the plugin sends a redirect, the response looks like this:

HTTP/1.1 301 Moved Permanently
Location: https://site.tld/new-shiny-article

The original query string is preserved if the old URL in your row has no query string of its own. If you stored /search?q=foo, the query is part of the match, not appended to the destination.

5. The Anatomy of a Redirect

5.1 The Single Table

The whole component lives in one database table:

#__redirect_links     one row per redirect or 404 capture

No taxonomy, no metadata sidecar, no per-language variants. The main columns are:

id              auto-increment primary key
old_url         the matched URL (indexed)
new_url         the destination (NULL = unresolved 404)
referer         where the visitor came from
comment         free-text admin note
hits            incremented on each match
published       1=Enabled, 0=Disabled, 2=Archived, -2=Trashed
created_date    first time this URL was seen
modified_date   last admin edit
header          HTTP status code, default 301

The old_url field is the search key. The index on it keeps lookups fast even with thousands of rows.

5.2 URL Normalisation - The Matching Trick

The plugin does not look up the raw URL the visitor requested. Instead, it builds twelve variants and runs a single WHERE old_url IN (...) query:

1.  Full URL                       (scheme + host + path + query + fragment)
2.  Relative URL                   (path + query + fragment)
3.  Root-relative                  (Uri::root() stripped)
4.  Root-relative with leading "/"
5.  Without query                  (scheme + host + path + fragment)
6.  Relative without query         (path + fragment)
7-12. The same six, but lowercased

What this means in practice:

• You can store /old-page or https://site.tld/old-page. Both match.
• Case matters at storage, but the lowercased variants let /Old-Page still find /old-page.
• A redirect for /foo matches both /foo and /foo?utm=x.
• A redirect for /foo?bar=1 matches only /foo?bar=1. Query strings in old_url require exact match.

5.3 The onError Hook

The plugin subscribes to one event:

public static function getSubscribedEvents(): array
{
    return ['onError' => 'handleError'];
}

The handler stops early unless the error code is exactly 404 and the request is not in the administrator. Backend 404s are intentionally ignored - admins never get redirected by their own rules.

5.4 Why Duplicates Are Dangerous

When the IN (...) query returns multiple rows (because the same URL is stored as both a full URL and a relative URL), the plugin picks the first published match in the order of the variant list. The full URL comes first, so it wins over the relative URL.

The practical rule: keep your redirects in one consistent shape, usually root-relative paths. Do not store the same redirect three different ways.

7. Multilingual Redirects

7.1 Per-language URLs

On a multilingual Joomla site, every translation has its own URL, usually prefixed by the language code:

/en/old-article    →    /en/new-article
/nl/oude-pagina    →    /nl/nieuwe-pagina
/de/altes-zeug     →    /de/neuer-artikel

The com_redirect component is language-agnostic. There is no language column in #__redirect_links. The match is purely on the URL string, so you must store the language prefix yourself.

7.2 The Cross-language Trap

Two tempting but wrong patterns are common:

/en/old-article    →    /                  (homepage redirect)
/nl/oude-pagina    →    /en/new-article    (cross-language jump)

Both confuse visitors and Google. A Dutch visitor suddenly lands on English content, or an English visitor loses context entirely.

The rule is simple: redirect within the same language. If a translation does not exist yet, point the URL at the closest in-language equivalent (a category page or the in-language homepage), not the site root.

7.3 Menu Associations vs Redirects

Joomla's multilingual menu associations already handle "give me this page in language X" through the language switcher. That is not a redirect, it is a route.

Use com_redirect only when:

• An article truly moved in one language.
• An entire URL pattern changed after a SEF tweak in one language.
• A translation was removed and needs to point somewhere sensible.

7.4 The Language Filter Trap

The System - Language Filter plugin can itself redirect requests to add or remove a language code. If both plugins fight, you get a redirect loop:

/article    →  /en/article   (Language Filter)
/en/article →  /article      (your redirect rule)
/article    →  /en/article   (loop again)

The fix is to store the URL after Language Filter has processed it, which means always include the language prefix in both old_url and new_url.

9. Common Pitfalls

9.1 My Redirect Does Not Fire

Run through this checklist, in order:

1. Is plg_system_redirect enabled?
2. Is the redirect row Enabled?
3. Is the New URL filled in (not NULL)?
4. Does the old URL really return a 404? If the page still exists, no redirect fires - com_redirect only acts on 404 errors.
5. Is the old URL stored in a shape the matcher recognises? Root-relative is the safest choice.

9.2 My Status Code is Always 301

The component option Use Custom Redirect Status Codes is No by default. Until you flip it to Yes, every redirect is sent as a 301, regardless of the row setting.

9.3 Redirects Do Not Run in the Backend

This is by design. The plugin returns early when $app->isClient('administrator') is true. The component is a frontend tool only.

9.4 The Database Keeps Growing

That is collection, not redirection. Set Collect URLs = No to stop logging new entries. Existing published redirects keep working. This is useful on sites under constant scanner traffic.

9.5 Redirect Loops

The component does no loop detection. If you map /a → /b and /b → /a, the browser cycles until it gives up. Run the loop-audit SQL from section 8.3 after every bulk import.

9.6 Chained Redirects

A chain like /a → /b → /c → /d works because each hop is a separate request, but every hop costs a round trip and erodes SEO weight. Flatten chains with the SQL in section 8.3.

9.7 Query Strings and Fragments

• Query string in old_url: exact match required.
• No query string in old_url: matches with or without query.
• Fragments (#section): the browser strips them before sending the request, so you cannot redirect on a fragment. Do not store them.

9.8 SEF vs Raw URLs

With SEF enabled, the user-facing URL is /old-article. With SEF disabled, the same content lives at /index.php?option=com_content&view=article&id=42. These are two different keys in the redirect table. Audit your redirects after you turn SEF on or off.

9.9 Open-redirect Security

The component lets you point an old URL at any destination, including external domains. That is sometimes useful, but it is also a phishing vector:

• A compromised admin account can create a redirect to a fake-brand phishing site.
• A 404 captured from a search-engine-indexed URL gets pointed at a malicious destination.
• A stale redirect points to a domain that was sold and now hosts malware.

The defence is simple: restrict Create and Edit on com_redirect to a small, trusted group, and audit external destinations quarterly:

SELECT id, old_url, new_url
FROM jos_redirect_links
WHERE published = 1
  AND new_url LIKE 'http%'
  AND new_url NOT LIKE 'https://site.tld/%';

9.10 Verifying a Redirect with curl

Browsers cache aggressively and follow redirects silently. For debugging, use curl instead:

curl -I https://site.tld/old-article

You want to see exactly:

HTTP/2 301
location: https://site.tld/new-article
content-type: text/html; charset=utf-8

A 200 response means the page did not 404, so no redirect ran. A 301 when you expected a 302 means the custom-codes switch is off (see section 3.2).

To trace a full chain, add -L and -v:

curl -I -L https://site.tld/old-article

Each hop appears in order - perfect for confirming you flattened a chain.

9.11 Redirect vs Canonical

A redirect and a canonical look similar but solve different problems:

Setting both - a redirect plus a canonical on the destination - is fine. Setting a canonical that points at a redirected-away URL confuses crawlers.

11. Component vs Web Server Redirects

You can also configure redirects in Apache's .htaccess or in an NGINX config. Each layer has its place:

Use com_redirect for editorial redirects (renamed articles, migrations). Use the web server for infrastructure rules (force HTTPS, www to bare domain, scanner blocks). Mixing layers is fine; mixing layers at random is what makes both fragile.

13. Summary

The Redirects component is the smallest part of Joomla that pays for itself the most often. One plugin, one component, one switch - and every renamed article keeps its inbound links and search-engine ranking.

In return for very little setup, you get:

• 404 capture: every broken link logged with hits and referrer.
• Editor-friendly management: no .htaccess edits, no devops tickets.
• SEO-correct status codes: 301s preserve the link equity you have built.
• Bulk-ready imports: pipe-separated lists for migrations.
• Single-table simplicity: easy to back up, easy to audit, easy to extend.

A clean redirect table is a sign of a well-cared-for Joomla site. If you are planning a migration, restructuring URLs, or you suspect that broken links are costing you search traffic, it pays to look at com_redirect first. It is already in your Joomla install, waiting to be switched on.