Title: wp_safe_redirect
Published: April 25, 2014
Last modified: August 20, 2026

---

# wp_safe_redirect( string $location, int $status = 302, string|false $x_redirect_by = 'WordPress' ): bool

## In this article

 * [Description](https://developer.wordpress.org/reference/functions/wp_safe_redirect/?output_format=md#description)
 * [Parameters](https://developer.wordpress.org/reference/functions/wp_safe_redirect/?output_format=md#parameters)
 * [Return](https://developer.wordpress.org/reference/functions/wp_safe_redirect/?output_format=md#return)
 * [Source](https://developer.wordpress.org/reference/functions/wp_safe_redirect/?output_format=md#source)
 * [Hooks](https://developer.wordpress.org/reference/functions/wp_safe_redirect/?output_format=md#hooks)
 * [Related](https://developer.wordpress.org/reference/functions/wp_safe_redirect/?output_format=md#related)
 * [Changelog](https://developer.wordpress.org/reference/functions/wp_safe_redirect/?output_format=md#changelog)
 * [User Contributed Notes](https://developer.wordpress.org/reference/functions/wp_safe_redirect/?output_format=md#user-contributed-notes)

[ Back to top](https://developer.wordpress.org/reference/functions/wp_safe_redirect/?output_format=md#wp--skip-link--target)

Performs a safe (local) redirect, using [wp_redirect()](https://developer.wordpress.org/reference/functions/wp_redirect/).

## 󠀁[Description](https://developer.wordpress.org/reference/functions/wp_safe_redirect/?output_format=md#description)󠁿

Checks whether the $location is using an allowed host, if it has an absolute path.
A plugin can therefore set or remove allowed host(s) to or from the list.

If the host is not allowed, then the redirect defaults to wp-admin on the siteurl
instead. This prevents malicious redirects which redirect to another host, but only
used in a few places.

Note: [wp_safe_redirect()](https://developer.wordpress.org/reference/functions/wp_safe_redirect/)
does not exit automatically, and should almost always be followed by a call to `
exit;`:

    ```php
    wp_safe_redirect( $url );
    exit;
    ```

Exiting can also be selectively manipulated by using [wp_safe_redirect()](https://developer.wordpress.org/reference/functions/wp_safe_redirect/)
as a conditional in conjunction with the [‘wp_redirect’](https://developer.wordpress.org/reference/hooks/wp_redirect/)
and [‘wp_redirect_status’](https://developer.wordpress.org/reference/hooks/wp_redirect_status/)
filters:

    ```php
    if ( wp_safe_redirect( $url ) ) {
        exit;
    }
    ```

## 󠀁[Parameters](https://developer.wordpress.org/reference/functions/wp_safe_redirect/?output_format=md#parameters)󠁿

 `$location`stringrequired

The path or URL to redirect to.

`$status`intoptional

HTTP response status code to use. Default `'302'` (Moved Temporarily).

Default:`302`

`$x_redirect_by`string|falseoptional

The application doing the redirect or false to omit. Default `'WordPress'`.

Default:`'WordPress'`

## 󠀁[Return](https://developer.wordpress.org/reference/functions/wp_safe_redirect/?output_format=md#return)󠁿

 bool False if the redirect was canceled, true otherwise.

## 󠀁[Source](https://developer.wordpress.org/reference/functions/wp_safe_redirect/?output_format=md#source)󠁿

    ```php
    function wp_safe_redirect( $location, $status = 302, $x_redirect_by = 'WordPress' ) {

    	// Need to look at the URL the way it will end up in wp_redirect().
    	$location = wp_sanitize_redirect( $location );

    	/**
    	 * Filters the redirect fallback URL for when the provided redirect is not safe (local).
    	 *
    	 * @since 4.3.0
    	 *
    	 * @param string $fallback_url The fallback URL to use by default.
    	 * @param int    $status       The HTTP response status code to use.
    	 */
    	$fallback_url = apply_filters( 'wp_safe_redirect_fallback', admin_url(), $status );

    	$location = wp_validate_redirect( $location, $fallback_url );

    	return wp_redirect( $location, $status, $x_redirect_by );
    }
    ```

[View all references](https://developer.wordpress.org/reference/files/wp-includes/pluggable.php/)
[View on Trac](https://core.trac.wordpress.org/browser/tags/7.1/src/wp-includes/pluggable.php#L1632)
[View on GitHub](https://github.com/WordPress/wordpress-develop/blob/7.1/src/wp-includes/pluggable.php#L1632-L1650)

## 󠀁[Hooks](https://developer.wordpress.org/reference/functions/wp_safe_redirect/?output_format=md#hooks)󠁿

 [apply_filters( ‘wp_safe_redirect_fallback’, string $fallback_url, int $status )](https://developer.wordpress.org/reference/hooks/wp_safe_redirect_fallback/)

Filters the redirect fallback URL for when the provided redirect is not safe (local).

## 󠀁[Related](https://developer.wordpress.org/reference/functions/wp_safe_redirect/?output_format=md#related)󠁿

| Uses | Description | 
| [wp_sanitize_redirect()](https://developer.wordpress.org/reference/functions/wp_sanitize_redirect/)`wp-includes/pluggable.php` |

Sanitizes a URL for use in a redirect.

  | 
| [wp_validate_redirect()](https://developer.wordpress.org/reference/functions/wp_validate_redirect/)`wp-includes/pluggable.php` |

Validates a URL for use in a redirect.

  | 
| [wp_redirect()](https://developer.wordpress.org/reference/functions/wp_redirect/)`wp-includes/pluggable.php` |

Redirects to another page.

  | 
| [admin_url()](https://developer.wordpress.org/reference/functions/admin_url/)`wp-includes/link-template.php` |

Retrieves the URL to the admin area for the current site.

  | 
| [apply_filters()](https://developer.wordpress.org/reference/functions/apply_filters/)`wp-includes/plugin.php` |

Calls the callback functions that have been added to a filter hook.

  |

[Show 2 more](https://developer.wordpress.org/reference/functions/wp_safe_redirect/?output_format=md#)
[Show less](https://developer.wordpress.org/reference/functions/wp_safe_redirect/?output_format=md#)

| Used by | Description | 
| [WP_Sitemaps::redirect_sitemapxml()](https://developer.wordpress.org/reference/classes/wp_sitemaps/redirect_sitemapxml/)`wp-includes/sitemaps/class-wp-sitemaps.php` |

Redirects a URL to the wp-sitemap.xml

  | 
| [WP_Recovery_Mode::redirect_protected()](https://developer.wordpress.org/reference/classes/wp_recovery_mode/redirect_protected/)`wp-includes/class-wp-recovery-mode.php` |

Redirects the current request to allow recovering multiple errors in one go.

  | 
| [WP_Recovery_Mode::handle_exit_recovery_mode()](https://developer.wordpress.org/reference/classes/wp_recovery_mode/handle_exit_recovery_mode/)`wp-includes/class-wp-recovery-mode.php` |

Handles a request to exit Recovery Mode.

  | 
| [set_screen_options()](https://developer.wordpress.org/reference/functions/set_screen_options/)`wp-admin/includes/misc.php` |

Saves option for number of rows when listing posts, pages, comments, etc.

  | 
| [Custom_Background::take_action()](https://developer.wordpress.org/reference/classes/custom_background/take_action/)`wp-admin/includes/class-custom-background.php` |

Executes custom background modification.

  |

## 󠀁[Changelog](https://developer.wordpress.org/reference/functions/wp_safe_redirect/?output_format=md#changelog)󠁿

| Version | Description | 
| [5.1.0](https://developer.wordpress.org/reference/since/5.1.0/) | The return value from [wp_redirect()](https://developer.wordpress.org/reference/functions/wp_redirect/) is now passed on, and the `$x_redirect_by` parameter was added. | 
| [2.3.0](https://developer.wordpress.org/reference/since/2.3.0/) | Introduced. |

## 󠀁[User Contributed Notes](https://developer.wordpress.org/reference/functions/wp_safe_redirect/?output_format=md#user-contributed-notes)󠁿

 1.   [Skip to note 5 content](https://developer.wordpress.org/reference/functions/wp_safe_redirect/?output_format=md#comment-content-3974)
 2.    [KZeni](https://profiles.wordpress.org/kzeni/)  [  6 years ago  ](https://developer.wordpress.org/reference/functions/wp_safe_redirect/#comment-3974)
 3.  [You must log in to vote on the helpfulness of this note](https://login.wordpress.org?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Ffunctions%2Fwp_safe_redirect%2F%23comment-3974)
     Vote results for this note: 5[You must log in to vote on the helpfulness of this note](https://login.wordpress.org?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Ffunctions%2Fwp_safe_redirect%2F%23comment-3974)
 4.  As with `wp_redirect`, unless this is patched to perform this natively in the 
     future, be sure to include `nocache_headers();` before the `wp_safe_redirect` 
     if you want to make sure the visitor’s browser doesn’t cache the redirect page
     result (can even happen when this is set to use a 302 redirect) which may cause
     the redirect to happen for longer than desired.
 5.  For example, this can be problematic when used to redirect to a login page when
     trying to access protected content since the visitor can then log in to find that
     they’re still taken back to the login page when trying to go back to that page
     they were trying to go to due to the redirect having been potentially cached by
     their web browser (again, even with it being a 302 redirect.) Having `nocache_headers();`
     before the redirect prevents this potential issue.
 6.   * [Ticket #50422](https://core.trac.wordpress.org/ticket/50422) is looking to
        address this natively for future versions of WordPress so this may not be required
        in the future, but this is advisable/required for now and shouldn’t be problematic
        if/when WordPress chooses to adopt the proposed update.
      * [KZeni](https://profiles.wordpress.org/kzeni/) [6 years ago](https://developer.wordpress.org/reference/functions/wp_safe_redirect/#comment-3975)
 7.   [Log in to add feedback](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Ffunctions%2Fwp_safe_redirect%2F%3Freplytocom%3D3974%23feedback-editor-3974)
 8.   [Skip to note 6 content](https://developer.wordpress.org/reference/functions/wp_safe_redirect/?output_format=md#comment-content-5191)
 9.    [Sarah Lewis](https://profiles.wordpress.org/bookchiq/)  [  5 years ago  ](https://developer.wordpress.org/reference/functions/wp_safe_redirect/#comment-5191)
 10. [You must log in to vote on the helpfulness of this note](https://login.wordpress.org?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Ffunctions%2Fwp_safe_redirect%2F%23comment-5191)
     Vote results for this note: 1[You must log in to vote on the helpfulness of this note](https://login.wordpress.org?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Ffunctions%2Fwp_safe_redirect%2F%23comment-5191)
 11. To add additional domains to the list of allowed hosts, use the [allowed_redirect_hosts](https://developer.wordpress.org/reference/hooks/allowed_redirect_hosts/)
     filter.
 12.  [Log in to add feedback](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Ffunctions%2Fwp_safe_redirect%2F%3Freplytocom%3D5191%23feedback-editor-5191)
 13.  [Skip to note 7 content](https://developer.wordpress.org/reference/functions/wp_safe_redirect/?output_format=md#comment-content-5832)
 14.   [capbussat](https://profiles.wordpress.org/capbussat/)  [  4 years ago  ](https://developer.wordpress.org/reference/functions/wp_safe_redirect/#comment-5832)
 15. [You must log in to vote on the helpfulness of this note](https://login.wordpress.org?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Ffunctions%2Fwp_safe_redirect%2F%23comment-5832)
     Vote results for this note: 0[You must log in to vote on the helpfulness of this note](https://login.wordpress.org?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Ffunctions%2Fwp_safe_redirect%2F%23comment-5832)
 16. Just for imformation wp_safe_redirect or wp_redirect does not work from an ajax
     call. I think this answer can help others:
 17. I have used a function to redirect from a JS AJAX call. First, it sets some values
     to database and then tries to redirect in this way:
 18.     ```php
         if (wp_safe_redirect( $url))
     
         exit();
         ```
     
 19. But it just returns same page followed by ‘undefined’.
 20. I finally solved directly the redirection part in JS:
 21.     ```javascript
          window.location.href = url; // keeps page history
         ```
     
 22. Works also :
 23.     ```javascript
           window.location.replace( url ); // cleans page history
         ```
     
 24.  [Log in to add feedback](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Ffunctions%2Fwp_safe_redirect%2F%3Freplytocom%3D5832%23feedback-editor-5832)
 25.  [Skip to note 8 content](https://developer.wordpress.org/reference/functions/wp_safe_redirect/?output_format=md#comment-content-7301)
 26.   [Rafa Carvalhido](https://profiles.wordpress.org/rafacarvalhido/)  [  2 years ago  ](https://developer.wordpress.org/reference/functions/wp_safe_redirect/#comment-7301)
 27. [You must log in to vote on the helpfulness of this note](https://login.wordpress.org?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Ffunctions%2Fwp_safe_redirect%2F%23comment-7301)
     Vote results for this note: 0[You must log in to vote on the helpfulness of this note](https://login.wordpress.org?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Ffunctions%2Fwp_safe_redirect%2F%23comment-7301)
 28. I think it is worthy of a note saying this is the only (safe) way I found to redirect
     from an admin URL to frontpage. In my case, I created a CPT and wanted the new
     posts to be entered only from the frontend because of the masks and validation
     I had already set up. This is the code:
 29.     ```php
         function wpdocs_change_add_new_link_for_cpt_clientes() {
         	if ( $_SERVER['REQUEST_URI'] !== '/wp-admin/post-new.php?post_type=my_cpt_slug' ) {
         		return;
         	}
     
                 wp_safe_redirect( urldecode( 'https://front.end/url-to-link-to/' ) );
                 exit;
         }
         add_action( 'init', 'wpdocs_change_add_new_link_for_cpt_clientes' );
         ```
     
 30. Change `my_cpt_slug` to your actual CPT slug.
 31.  [Log in to add feedback](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Ffunctions%2Fwp_safe_redirect%2F%3Freplytocom%3D7301%23feedback-editor-7301)

You must [log in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Ffunctions%2Fwp_safe_redirect%2F)
before being able to contribute a note or feedback.