A shortener is a redirect service, and the three-digit code it returns changes behaviour in ways most dashboards never surface.
| Code | Cached? | Use it when |
|---|---|---|
| 301 Moved Permanently | Aggressively, sometimes forever | The destination will never change. Search engines pass ranking signals through it. |
| 302 Found | No | You may re-point the link later, or you need every hit to reach your server for counting. |
| 307 Temporary Redirect | No | The request might be a POST. 301 and 302 let clients rewrite POST to GET and drop the body; 307 and 308 forbid it. |
Most commercial shorteners emit 301 because it is fastest for the visitor. The cost is that a browser holding a cached 301 never calls your service again, so click counts under-report repeat visitors and re-pointing a link leaves stale clients on the old destination indefinitely. If you might ever edit a target, insist on 302 or 307.
Two behaviours ship under the same feature name. Some services store the destination exactly as given, so ?utm_source=newsletter only arrives if you baked it in before shortening. Others merge anything trailing the short code into the destination. Test it with curl instead of assuming:
curl -sI 'https://short.link/abc?utm_medium=email' | grep -i '^location'
# Location: https://example.com/page?utm_source=news&utm_medium=emailIf parameters are dropped, every click lands in your analytics as direct traffic and the campaign is unattributable after the fact.
A branded short domain costs the registration plus a paid tier on most services, and buys three things. Click-through improves because the destination is legible before the click. Deliverability improves: filtering vendors treat generic shortener domains as a spam signal precisely because they hide the target, and a shared domain inherits everyone else's reputation. And you keep control — if the vendor shuts down, you re-point DNS and every printed link survives.
Short links printed on packaging, badges or a book have to outlive the vendor, and several well-known shorteners have been retired with a few months' notice. Self-hosting removes that dependency:
Whichever you pick, export the mapping table to version control on a schedule. The database is the asset, not the software.
A shortener that will forward to any URL supplied at request time — /go?url=https://attacker.example — is a phishing amplifier flying your domain's reputation. Only ever redirect to a target that was written into your store through an authenticated path, validate the scheme is https at creation time, and reject javascript: and data: outright. If you must allow user-submitted destinations, keep an allow-list of hostnames.
Chat apps and social platforms fetch Open Graph tags from the URL you paste. Many crawlers follow the redirect and read the destination's tags, but some stop at the first response, leaving your link as a bare blue string with no title or image. If the preview matters, post the canonical URL and keep the short link for print and voice.
QR codes are the strongest argument for short links: fewer characters means a lower version symbol with larger modules, which scans faster in poor light and survives being printed small. Encode the short link, not a 180-character URL with campaign parameters bolted on. See the QR code field notes for symbol sizing.
Finally, be honest about the click log. A redirect service records IP, user agent, referrer and timestamp for every visitor, which is personal data in most jurisdictions. Set a retention window measured in weeks, truncate the last octet of IPv4 addresses if you only need geography, and say so in your privacy policy.