Redirect and link preview check — what a customer sees when you send your link
When you paste a link into a WhatsApp chat, the app fetches the page and draws a card: an image, a title, a short description. If those tags are missing the customer sees a bare grey URL, which looks like a scam. This check follows the same redirects a visitor's browser follows, then draws the card WhatsApp would draw.
What the check reads
- Every hop in the redirect chain, with its status code — including the common fault where http:// redirects to https:// and then straight back to http://.
- Whether the final page answers at all: a 404 or a 500 after two redirects is a broken link that passes a quick glance.
- The Open Graph tags that build the WhatsApp, Facebook and Telegram preview card: title, description, image, and whether the image URL is absolute and reachable.
- Security headers — HSTS, CSP, frame protection, referrer policy — with the honest label that a missing CSP is optional hardening, not a hole.
What it cannot tell you
How Google ranks the page, whether the site is fast for a customer on Maxis in Ipoh, and what the page looks like once JavaScript runs — the check stops at the head of the HTML. A site that hides behind a bot wall is reported as skipped, because a 403 challenge page is not your website and we will not audit it as if it were.
Frequently asked
Why does my preview card look different from the one in this check?
WhatsApp caches previews it has already fetched. After fixing the tags, share the URL with ?v=2 appended to force a fresh fetch — a trick worth knowing before you conclude the fix did nothing.
Is a missing Content-Security-Policy a security problem?
It is missing hardening, not a break-in. Almost every small business site runs without one. We list it as information, not as a failure, because a red badge on something harmless teaches people to ignore red badges.
My site blocks bots on purpose. Will this always say skipped?
Yes, and that is the correct answer. We do not disguise the checker as a browser to get around a protection you deliberately turned on.
Want this fixed rather than explained?
Hoelee Enterprise is a one-person studio in Perak that looks after Malaysian business websites and business email. If a check above is red and you would rather someone just did it, have a look at what we do or write to me@hoelee.com.