A site gets “pushed” through a redirect pipe: a few thousand forum and web 2.0 links aimed at a layer of throwaway domains, each of those 301’d into the money site. Three months later nothing has happened. No drop, no manual action in Search Console, no warning of any kind. And no growth. The owner reads the silence as safety. It’s closer to a verdict.
So do 301 redirects hurt SEO, and is there a 301 redirect SEO penalty? Almost never. Google almost never penalizes a redirect — it reads what the redirect claims, this page has moved there, checks whether the claim holds, and when it doesn’t, passes nothing through. That’s the answer the pages ranking for this term skip. Five things make the check fail, one thing still ends in a manual action, and the difference between the two is diagnosable from the outside if you know which report to open. The story above is the first of the five.
How Google evaluates a 301 redirect: canonicalization, recrawl, status codes
A 301 is an HTTP status: the resource at A is now permanently at B. Google’s documentation treats a permanent redirect as a strong canonicalization signal, meaning B should replace A in the index and the signals attached to A — links, ranking history — should be consolidated onto B. Since 2016, when Gary Illyes and then John Mueller said on record that 3xx redirects lose no PageRank, the industry has read that as “a 301 transfers everything.” It doesn’t. It transfers everything when the claim is true, and Google has spent the decade since building checks on the claim.
The condition is a one-to-one replacement. Mueller’s 2017 line on redirecting 404s was that it makes sense when there’s a genuine replacement URL, and otherwise Google will likely treat the redirect as a soft 404. That single sentence is the whole model: the redirect is evaluated against whether B answers what A answered, and the evaluation can come back negative. Everything below is a way it comes back negative.
None of it happens the day the redirect ships. Google reads a redirect by recrawling the source, on the source’s own schedule: a URL Googlebot fetched daily gets its redirect read within days. A parked domain it last visited in the spring gets read when it comes back, which can be months. Consolidation follows that recrawl. Until then the old URL is still the one in the index, and every check below reads as “nothing yet” rather than “nothing.” The three-to-six-week window in the check at the end assumes a normally crawled source. One Googlebot wasn’t visiting before the redirect gets longer, and its logs say how much longer. Google’s site-move guidance gives the other end of the window: keep the redirects in place for at least a year, because consolidation isn’t a one-time event, and a source domain that lapses at month six takes what it had passed with it. For a whole-domain move there’s a second signal on top of the 301s, Search Console’s Change of Address tool, which Google says it holds for 180 days; after that the two hosts are read as separate sites again, whatever the redirects say.
The status code matters less than the volume of “301 vs 302” writing suggests. Google reads the redirect types on a spectrum of trust:
- 301 and 308 — strong signals that the target is canonical.
- 302, 303 and 307 — weak signals, though a temporary redirect left in place long enough gets treated as permanent.
- Meta refresh — a zero delay is read like a permanent redirect, a delay like a temporary one.
- JavaScript redirect — read only after rendering, which is why Google’s own advice is to use it only where a server-side redirect is impossible.
After that, every one of them is evaluated the same way: does B replace A. The 302-first trick, testing a bought donor on a temporary redirect and switching to 301 if rankings move, guards against a risk this article has already taken off the table: the target isn’t punished for a bad donor under either code, and it isn’t credited for a good one until the recrawl either.
ZERO VERSUS PENALTY
Google’s spam systems, SpamBrain among them, mostly don’t punish link and redirect manipulation. They neutralize it: the links or the redirected signals are treated as if they weren’t there. Google said as much in December 2022, when it announced SpamBrain could detect both sites buying links and sites that exist to pass outgoing links, and that such links would be neutralized. A neutralized signal produces no notification, no manual action, no drop. The lift you paid for doesn’t arrive. The reassessment is also more frequent than it was: three spam updates in 2026 so far (March 24–25, June 24–26, August 18–21), refreshes between them, and since May 2026 the definition of spam also covers attempts to manipulate Google’s generative AI answers. The one redirect practice that still draws a manual action is at the end of this article, and it’s about deceiving users.
Failure 1: soft 404 — the target doesn’t replace the source
The most common zero, and it hits ordinary migrations as often as schemes. Redirect a product page to the homepage, a category to a loosely related category, a hundred retired blog posts to the blog index, and Google’s own site-move documentation tells you what happens: redirects to pages that don’t replace the original get treated as soft 404s. A soft 404 is a page Google has decided is empty regardless of the status code, so the old URL drops out of the index the way a 404 would, and the links pointing at it pass nothing to the new destination.
This is the mechanism people mean when they say “redirecting an expired domain to an unrelated site doesn’t work anymore.” A former veterinary clinic’s domain 301’d at a crypto exchange fails the same test a retired product page fails when it lands on the homepage: the target doesn’t answer the source. Different scale, same check.
What passes the test is the unglamorous version of the same move: a redirect map, old URL to the one page that answers it, built before the migration and checked after it. The matching is done on what the source ranked for, not on what its URL looks like: for each old URL the top queries from Search Console’s 16-month window, then the new page that would satisfy them. A discontinued product goes to its nearest replacement, a category to the category that inherits its products, and only a page with no successor gets a 410. Google’s site-move documentation describes that and nothing else. The mass rule, everything to the homepage or everything to the parent category, is a shortcut the check reads as a soft 404 a thousand times over, and it’s where most of the “301 penalties” I get asked about turn out to live.
How it surfaces: in Search Console, the source URLs (if the property covers them) show as Soft 404 rather than Page with redirect, and the destination’s Links report never picks up the referring domains that pointed at the source. In the SERP, nothing — the destination ranks as it did.
Failure 2: source blocked by robots.txt, IP or geo
A redirect is read by fetching the source. If Googlebot can’t fetch it, there is no redirect as far as Google is concerned — there’s a URL it was told not to request. The usual cause is a robots.txt Disallow on the source domain, and the usual reason it’s there is that someone wanted to hide a private network or a bought domain from Ahrefs and Semrush. The block that hides the source from the tools hides it from Googlebot too, and a 301 behind a Disallow passes exactly as much as a 301 on a switched-off server. Two checks resolve it in minutes: the source’s robots.txt fetched directly, and the source URL fetched with a Googlebot user agent from a US address, which reproduces what Google sees. For IP blocks, Google publishes its crawler ranges as JSON (googlebot.json on developers.google.com), and a firewall allowlist is matched against that list, not against a reverse-DNS guess.
IP blocking does the same when the ranges cover Google’s crawler along with the SEO tools’. So does geo-blocking on the source, where the old domain only answers from one country. Google’s documentation says Googlebot crawls primarily from US addresses, so a source that refuses US requests is a source Google never reads — the same trap that takes whole locales out of the index in an international SEO audit.
How it surfaces: Blocked by robots.txt on the source in Search Console, or in the logs, no Googlebot request to the source URL at all.
Failure 3: redirect chains and loops
Google’s documentation says Google Search follows up to ten redirect hops, and past that the URL shows as Redirect error in Search Console and the destination is never reached. Ten is more generous than the three-to-five you’ll read in older guides, and it’s also beside the point, because the cost of a chain was never a fixed loss per hop. The 2016 statement holds: 3xx doesn’t leak PageRank.
Most chains aren’t deliberate. The one I find on nearly every migration is four hops before the redirect anyone actually wrote:
http → https → www → trailing slash → the intended target
Each rule was added at a different time and none of them knows about the others; on a domain move the source’s own protocol and host rules stack on top of the destination’s, and a redirect map that looked like one hop on paper runs six in production. Screaming Frog’s Reports → Redirects → Redirect Chains lists every chain with its hop count and final status, and that export is the first thing I open on a migration. The cost is that every hop is a fetch, that a chain of five means five requests before Google sees content, that the crawl allowance spent on hops isn’t spent on pages, and that a chain long enough to be deliberate — through link shorteners, technical subdomains, a cascade of parked domains — usually has a loop or a dead hop somewhere in the middle that nobody has walked end to end.
How it surfaces: Redirect error for the source when the chain exceeds the limit or loops. Otherwise Page with redirect, with the final destination listed. If the final destination in Search Console isn’t the one you intended, the chain broke and you’ve been redirecting into the break.
Failure 4: expired domain abuse and topical mismatch
Since March 2024, Google’s spam policies name expired domain abuse as its own violation: buying a lapsed domain and repurposing it primarily to manipulate rankings on the strength of its old reputation. The documentation’s examples are deliberately blunt — casino content on a former elementary school’s domain, affiliate pages on a domain that used to belong to a government agency, commercial medical products on a former charity’s site. Those are the obvious end of the spectrum, and few people try them anymore. The “topical” version still gets tried: a construction domain bought to 301 into a construction site.
A matching category isn’t enough. A domain that spent eight years selling ready-mix concrete and pouring foundations in one city carries a link profile and a content history built around that — anchors about M300 grade, delivery by mixer, foundation depth, the local suppliers who linked to it. Redirect it at a site that sells PVC windows and glazes balconies in another city, and at the level of a category tree both are “construction and renovation.” At the level of what the pages, the anchors and the linking neighbors are about, they’re different nodes with almost no overlap. The inbound links say concrete; the destination says windows. That is the same mismatch as the veterinary clinic and the crypto exchange, one floor down the taxonomy.
Before the embedding run there’s a cheaper read of a donor’s history: the Wayback Machine’s per-year snapshot listing for the domain. It shows what the site was about in each year it existed, how many pages it had, and, more useful than either, the gaps: a domain with snapshots through 2019, nothing until 2024, and then a fresh site is a domain that was dropped and re-registered, and the links pointing at it were earned by whatever was there before the gap. Snapshot counts drop to a handful in the parked years, and a domain that was parked for two years has spent two years teaching Google its links point at a parking page.
The version built to pass the check is the rebuilt drop: the old domain comes back up with its archived content or a fresh site in the same niche, sits until it’s indexed again, and only then redirects, page by page. The rebuild doesn’t change what the check reads. A concrete site restored from the Wayback Machine is still about concrete, so if the target sells windows the redirect fails the same way, months later and with a hosting bill attached. If the target sells concrete it would have passed without the theatre. What the rebuild does add is a domain given a reason to exist so that it can be redirected away, which is the sentence the expired-domain-abuse policy is written around.
How Google measures that is where I have to be careful about what’s known. The 2024 leak of Google’s Content Warehouse schema included a versioned record with several relevant field names, each carrying the leak’s own one-line description:
siteEmbedding,pageEmbedding— a topical vector for the site, and one per page.siteFocusScore— how tightly a site sticks to one subject.siteRadius— described in the schema as the measure of how far page embeddings deviate from the site embedding.hostAge— described as used to sandbox fresh spam at serving time.
Those are field names with descriptions attached, and nothing more. Nothing in the leak says how they’re used in ranking. Nobody outside Google knows the thresholds, the weights, or whether a redirect evaluation reads them at all. What the fields do confirm is that Google keeps a topical identity per site and measures pages against it, which is enough to say that “same category” is not the unit Google works in. A domain that had a brand carries a second identity on top of the topical one — a Business Profile, a Wikidata item, news mentions, branded search — and a redirect doesn’t merge two brands into one. Whether that identity survives a redirect at all is something Google hasn’t described. That part is a hypothesis. I have no way to check it from outside.
Before a client buys anything, I measure the gap myself. Embed the donor’s indexed pages and its inbound anchor context; embed the destination’s; compare. That’s a model of relevance, not a description of Google: the bi-encoder and late-interaction models I use are how I reason about similarity. But it answers the question the buyer needs answered: is this donor about what my site is about, or about something that shares a shelf label with it. Concrete against windows comes back far apart. Concrete against a site that sells concrete comes back close. When it comes back close, a 301 from a clean-profile donor still passes signals in 2026, and Mueller has said so on record more than once. When it comes back far, you’re buying a soft 404 with a domain rating attached.
Failure 5: tiered links and the 301 redirect cascade
The scheme has a shape, and it hasn’t changed since GSA Search Engine Ranker and Xrumer were the tools. Tier 3 and 4: thousands of links from forum profiles, blog comments, guestbooks, wiki sandboxes, generated in bulk. Tier 2: web 2.0 properties, free-hosted blogs, a few cheap domains, which receive the tier-3 links. Tier 1: the money site. Between tier 2 and tier 1 sits the pipe — a cascade of 301s, sometimes a whole chain of them — chosen because a redirect was supposed to forward the accumulated weight while hiding the spam profile from anyone who looked at the money site’s backlinks. It stops at two layers.
The first is that most of the bottom tiers never enter the index. A link that isn’t in Google’s index isn’t in Google’s link graph, and a link that isn’t in the graph carries nothing to forward, no matter how many hops it’s forwarded through. Forum profile pages, comment sections on abandoned blogs, guestbooks — Google doesn’t spend crawl on them, and when it does, it doesn’t keep them.
The seller’s report won’t tell you this. It arrives as a spreadsheet — URL, anchor, a DA or DR column, sometimes a “dofollow” flag and a column headed indexed with a yes in every row — and that last column is the one to distrust: it was filled by the seller’s own checker, usually a site: query on the day the link was placed, or an info: query on checkers old enough to predate Google retiring that operator in 2019, and it says nothing about whether the page survived Google’s next pass. Take the URL column, run it through a bulk index check against Google and Bing yourself, and count. I don’t have a benchmark share to give you, because every run I’ve done was on one client’s report and I’d rather not launder a handful of runs into a statistic. The pattern across them is that the indexed fraction is small enough that the rest of the pipe is arithmetic on zero.
The second is that the pipe is legible as a structure. A destination that suddenly inherits several dozen referring domains, all thin, all new, all pointing at it through 301s from domains with no history of their own, is the pattern Google described in December 2022 when it said SpamBrain detects sites used for the purpose of passing outgoing links. Whether the classifier reads the redirect topology directly or reads the donors and neutralizes them one by one is not something Google has said, and from the outside the result is the same. The forwarded signal is treated as if it weren’t there. The money site isn’t demoted for it. It doesn’t move, and the budget spent on the run bought a spreadsheet. A pipe that “worked” for a few weeks in 2019 was working in the gap between reassessments, and with three spam updates and the refreshes between them this year, that gap is measured in weeks.
Five redirect failures: what Google does and how it shows in Search Console
| What was done | What Google does | How it shows | Basis |
|---|---|---|---|
| 301 to an unrelated page or the homepage | Treats the source as soft 404; passes nothing | Soft 404 on the source; no new referring domains on the target | Google site-move docs; Mueller 2017 |
| Source blocked in robots.txt, by IP or by geo | Never reads the redirect | Blocked by robots.txt; no Googlebot hit in logs | Crawl mechanics; Googlebot US-origin docs |
| Chain past the hop limit, or a loop | Stops following; destination never reached | Redirect error; wrong final URL in Page with redirect | Google redirect docs (up to 10 hops) |
| Expired domain redirected at a site it isn’t about | Soft 404 at best; expired-domain-abuse enforcement at worst | Same as row one; occasionally a manual action | Spam policies, March 2024; leak field names as model only |
| Tiered links forwarded through a redirect cascade | Bottom tiers never indexed; forwarded signals neutralized | Flat rankings; Links report unchanged; donors absent from index | SpamBrain Dec 2022; practitioner observation |
Sneaky redirects: the one redirect penalty that is a manual action
Sneaky redirects have been a named spam policy for as long as the policies have existed, and they’re the redirect practice that still ends in a manual action and, often, removal from the index. The definition says nothing about status codes. It’s about deception: showing Googlebot one page while sending users somewhere else, redirecting mobile users to an unrelated offer while desktop sees the original, JavaScript that lets the crawler read the content and then bounces the human to a different domain. Hacked sites are the largest source — the injected redirect to a pharmacy or a casino that only fires for certain user agents or referrers — and the manual action lands on the hacked site’s owner, who often finds out from Search Console before they find the injection. The Manual actions report names this class directly, with Sneaky mobile redirects as its own line item, and a hacked-site notice can arrive alongside it. A server that answers Googlebot with a 301 and everyone else with the page is the same policy from the other side: the crawler is the one being lied to, and the manual action is the same.
The line between this and everything above is whether a user was misled. A 301 that passes nothing because the target doesn’t match is a bad decision Google ignores. A redirect that shows the crawler one thing and the visitor another is a lie Google punishes. The redirect pipe, for all its ugliness, mostly falls on the first side, which is why it produces a flat line and no notice.
How to check for a 301 redirect penalty: Manual actions, Pages report, Links report
The question that gets asked after a redirect project is “did we get penalized?” and it’s usually the wrong one. The sequence I run — the same one a redirect project triggers inside our b2b seo audit services — answers the useful question, did anything pass, and the penalty question falls out of it.
A rise in a third-party authority score after a redirect looks like evidence and isn’t: it measures the tool’s crawler, which happily follows a 301 into a soft 404 and credits the links. A traffic drop after a migration isn’t evidence of a penalty either. Before reading it as one, exclude the boring causes — internal links still pointing at the old URLs, the redirect map missing the templates that carried the traffic, a canonical on the destination pointing back at the source. Most “301 penalties” I’ve been asked to diagnose were one of those three.
Frequently asked questions
Do 301 redirects hurt SEO?
Not in the sense the question usually means. A 301 doesn’t cost you rankings as a punishment — Google’s spam systems mostly neutralize manipulation rather than penalize it, so a bad redirect passes nothing and leaves the destination where it was, no drop, no notice. The exception is the sneaky redirect, which shows the crawler one page and the user another; that one draws a manual action. So a redirect either passes what it should, passes nothing, or — only if it deceives users — gets the site penalized.
Do 301 redirects lose PageRank?
Not per hop. Google said on record in 2016 that 3xx redirects lose no PageRank, and that still holds. What costs you isn’t the redirect leaking authority at each step — it’s the redirect failing the replacement check, so Google reads the source as a soft 404 and consolidates nothing at all. The loss is binary, not gradual: the claim either holds and everything passes, or it doesn’t and nothing does.
How long does a 301 redirect take to consolidate?
It follows the recrawl of the source, not a fixed clock. A URL Googlebot fetches daily gets read within days; a parked or rarely crawled domain can take months. On a normally crawled source, the referring domains start appearing against the destination in Search Console’s Links report about three to six weeks in. Keep the redirects live for at least a year — consolidation isn’t a one-time event, and a source that lapses early takes back what it had passed.
Does redirecting an expired domain still work?
Only when the domain is about what your site is about. Since March 2024, expired domain abuse is its own named spam violation, and even the “topical” version — a construction domain redirected at a construction site — fails when the link profiles don’t actually overlap: concrete anchors pointing at a windows business read as a mismatch, not a match. Measure the gap between donor and destination before buying, not after. When they’re genuinely close, a 301 from a clean-profile donor still passes signals; when they’re far, you’ve bought a soft 404 with a domain rating attached.
Is 301 or 302 better for SEO?
For a permanent move, 301. Google reads 301 and 308 as strong signals that the target is canonical, and 302, 303 and 307 as weak ones — though a 302 left in place long enough gets treated as permanent anyway. The status code matters less than the “301 vs 302” debate suggests: whichever you use, the redirect is judged on the same question, whether the target replaces the source.
What I don’t have
Two numbers I’d like and can’t give you. How many hops Google follows in practice as against the documented ten. Practitioners say fewer, and I haven’t run a controlled test. And a population figure for what share of tier-3 link inventory ever enters the index. I have per-client runs and they agree with each other, which isn’t the same as a benchmark. Both are measurable. The first needs a test site and patience; the second needs someone with access to a lot of link sellers’ reports and a bulk index checker, which describes most people who buy those reports.
The zero is getting quieter. Google has said less with each spam update this year and neutralized more, and the site-reputation and expired-domain enforcement since 2024 shows the direction — classify the structure, discount it, don’t notify. By 2028 I’d expect the redirect pipe to drop off link sellers’ price lists, once enough buyers have run their own index check on the spreadsheet and done the arithmetic. If a redirect project of yours went flat and you want to know which of the five it was, that’s what our SEO audit reads.