# Ensure static site redirects only point to approved domains

- Source: https://support.icompaas.com/support/solutions/articles/a_1793876665567915-ensure-static-site-redirects-only-point-to-approved-domains
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Render Cloud](https://support.icompaas.com/support/solutions/c_1793875953948152) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1793875960840493)
- Last updated: 2026-11-05
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure redirect rules configured on static sites only send visitors to URLs on domains the organization owns. Redirect rules should not point to unknown external domains or use patterns that let an attacker control the destination.

**Rationale**

A redirect to a domain you do not control can be abused for phishing, because the link starts on your trusted domain. Redirects to domains that have expired or changed owner are also risky. Limiting redirects to approved domains keeps visitors on sites you control.

**Impact**

-   Visitors are only redirected to domains you control
    
-   Prevents your site being used for phishing redirects
    
-   Some external redirects may need to be replaced with links
    

**Default Value**

By default, a static site has no redirect rules.

**Pre-Requisites**

-   Admin or Developer role on the static site
    
-   A list of approved domains
    

**Remediation**

**Test Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home (or project), click the static site to open it.
    
3.  Open the static site's Redirects/Rewrites page from the left pane and review the destination of each rule.
    
4.  If any rule redirects to a domain that is not approved, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home (or project), click the static site to open it.
    
3.  Open the Redirects/Rewrites page.
    
4.  Edit each rule that points to an unapproved domain so it uses an approved destination, or delete it.
    
5.  Save the changes and test the redirects.
    

**Backout Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home (or project), click the static site to open it.
    
3.  Open the Redirects/Rewrites page and restore the previous rule.
    

**Reference**

-   [https://render.com/docs/redirects-rewrites](https://render.com/docs/redirects-rewrites)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.