A Redirect Can Work Perfectly and Still Be Wrong. The Whole Difference Is One Digit.

Recently I changed a single character in how my own domain behaves. Not the content, not the design, not a line of copy. One digit in an HTTP status code. To anyone visiting the site, nothing changed. To every machine that reads the site, the meaning flipped from "this might be temporary" to "this is permanent." That gap, between what a human sees and what a machine is told, is where a surprising amount of quiet damage lives.

Here is the setup. My personal site has two front doors: the bare domain, and the same domain with www in front. You only want one of those to be the real home, and you want the other to forward to it. That is canonicalisation, and almost everyone gets the easy half right. You set up the redirect, you type the bare domain, the browser lands you on the www version, the page loads. It works. Most people stop there, because from the only seat they ever sit in, the user's seat, there is nothing left to check.

I stopped there too, for a while. Then I looked at the actual status code the redirect was sending, and it was a 307.

What the user never sees

A 307 is a temporary redirect. A 308 is a permanent one. Both send the visitor to exactly the same place, and the visitor cannot tell them apart. The browser bar ends up on the www address either way. If your only test is "does it land on the right page," 307 and 308 are identical and you will never catch the difference.

But search engines and AI crawlers do not read the page the way you do. They read the status code first, and they treat it as a statement of intent. A temporary redirect says: keep the old address around, it might come back, do not consolidate anything yet. So the crawler keeps the bare domain eligible for indexing, and your ranking signal stays split across two addresses that you wanted to be one. A permanent redirect says the opposite: this move is final, fold everything into the destination. The signal consolidates onto the canonical address, which is what you wanted the entire time.

So the redirect was working and wrong at the same time. It moved the human correctly and told the machine the wrong story. The fix was not a redesign or a migration. It was changing 307 to 308, one digit, and confirming the direction was already right so nothing downstream had to move.

"Works for me" is not the test that matters

This is the part worth generalizing, because it is not really about redirects.

Almost every system you run has two audiences. There is the human in front of it, and there is the machine that reads it on the human's behalf. A website has visitors and it has crawlers. An API has a frontend and it has other services. A document has readers and it has the search index that decides whether anyone finds it. You naturally test for the audience you can see. You almost never test for the one you cannot, because everything looks fine from where you are sitting.

The failures that come from this are the worst kind, because they are invisible from the only vantage point you habitually use. The site works. The page loads. Nothing errors. And meanwhile the machine layer is quietly acting on a signal you never meant to send, and you will not find out until you go and look at the layer the machine reads, on purpose, as a separate act.

That separate act is the whole discipline. Do not check that the redirect fires. Check the status code it fires. Do not check that the page renders. Check what the crawler is told about it. The visible test and the machine test are different tests, and passing the first one tells you nothing about the second.

Why this is getting more expensive, not less

It used to be that the machine reading your site was a search engine, and the cost of a confused signal was a few rankings. That cost is rising fast, because the machine reading your site is increasingly an AI assistant answering a question about you.

When someone asks an assistant who you are or where to find your work, that assistant resolves your canonical identity from exactly these signals: which address is authoritative, what redirects to what, how consistently your site states the same facts about itself. Ambiguous canonicalization produces an ambiguous answer. Two addresses that both look half-live give the model two candidates and no clear winner, and a model with no clear winner either guesses or hedges. Neither is the answer you want it giving on your behalf.

So the boring infrastructure layer, the part nobody posts about, is now directly upstream of how you show up in the systems that increasingly mediate first impressions. The status code is no longer a webmaster footnote. It is part of how a machine decides what is true about you.

The operator move

The reframe I keep coming back to is this. A solo operator gets none of an institution's defaults for free, and one of those defaults is the habit of testing the layer your customers never see. Big companies have people whose entire job is the machine-readable surface. Run a company of one and you either build that habit deliberately or you ship things that work for you and fail silently for everyone reading you through a machine.

The redirect was a small instance of a large rule. The afternoon it took to find and fix one digit was cheap. The version where I never look, and the signal stays split for months while I wonder why the canonical address is not consolidating, is the expensive one. The lesson, learned the other way, costs far more than the check.

If you run anything online, go look at the status code your domain sends, not just where it lands you. The two are not the same, and the difference is the part you cannot see.

---

Anjani Pandey builds autonomous AI systems for operators and small teams.