How a single redirect can log your visit twice

When you tap a link on a news site in Sydney or a community board in Hobart, you expect to land somewhere useful and then move on with your day. Behind that simple action sits a chain of small technical decisions, and one of the easiest to overlook is the humble redirect. A redirect is meant to send you from one address to another, but the way it is set up can mean the same person is counted twice in the logs of one site, or in the logs of two sites that share a tag.

For marketers in Melbourne and small business owners in Perth, double counting quietly skews every chart and report that gets reviewed on a Monday morning. For everyday readers, it feeds data brokers a slightly inflated picture of where you go, how often you go there, and what you looked at on the way. Once you understand the underlying mechanism, the pattern is easy to spot in tools like Google Analytics, Plausible, or the dashboards that ship with Australian ecommerce platforms such as Shopify and the local WooCommerce stores that power many independent retailers.

The real surprise is how thin the technical line is between a clean visit and a doubled one. A single parameter, a missing or extra trailing slash, or a server that forwards traffic through two hops can each turn one click into two recorded sessions. The practical consequence ranges from mildly annoying reporting errors to genuine privacy concerns under Australian privacy law, especially when the doubled record carries slightly different inferred attributes.

What a redirect actually does on the wire

When a browser asks for a page, the server can respond with a 301, which signals a permanent move, or a 302, which signals a temporary one, along with a Location header pointing somewhere new. The browser follows that pointer almost instantly, then asks the new address for the page you wanted. From your point of view, the address bar updates and you keep scrolling. From the analytics point of view, two requests just happened on your behalf, one to the first URL and one to the second.

Most of the time the second request is what the site owner wants to measure, and the first one is just plumbing. A tag in the first page might fire a pageview event before the redirect runs, then the second page fires another. If the tag manager does not suppress the first hit, you get the familiar pair of entries that look like two visits from the same person minutes apart, often with referrer fields that do not quite line up and timestamps that are nearly identical.

This is the same plumbing that powers short links on services used widely in Australia, from internal company intranets to campaign tracking run by Brisbane agencies for tourism clients in far north Queensland. The plumbing itself is not the problem; it is the bookkeeping around it that decides whether your session shows up once or twice in the dashboard your boss reads every week.

Why one click can produce two sessions

There are a few common paths to the doubled entry. The first is a tracking pixel or script that loads on the intermediate page before the redirect fires, registering a hit that the destination never asked for. The second is a server-side redirect that includes a query string the analytics tool treats as a fresh campaign source, even though the only thing that changed is a tiny parameter like ?ref=email or ?utm_source=internal. The third is a chain of two redirects, where the middle hop pings a counter on its own before the destination gets the request.

Each path produces a slightly different fingerprint. A common one in Australian ecommerce stores is a customer who clicks a product link in a brand email, lands briefly on a brand-controlled short URL, and is then bounced to the product page. The brand page logs the visit, the short URL logs another, and the email platform logs a third when the click-through pixel fires after the inbox loads. The shopper sees one product page. The dashboards see a crowd that never quite existed.

The hidden cost is not just inflated numbers in a report. Filters, audiences, and lookalike models built on top of that data inherit the same distortion, and a campaign that appears to convert at twice the rate it really does may soak up the next quarter's ad budget before anyone notices the discrepancy. A campaign manager in Adelaide reviewing the numbers on a Friday afternoon can easily mistake double counting for genuine growth.

The Australian privacy and compliance angle

Australian privacy law treats the collection of personal information seriously. Under the Privacy Act 1988 and the Australian Privacy Principles, organisations that collect data about Australians need to be transparent about what they gather, why they gather it, and how long they keep it. A doubled session means the same personal identifier, sometimes a hashed email or a cookie ID, can end up tied to two slightly different profiles, which complicates consent records and breach responses if something later goes wrong.

The Office of the Australian Information Commissioner has been clear that over-collection is itself a concern, separate from any actual breach. When a single redirect logs your visit twice, the second hit often carries a different set of inferred attributes because the referrer or landing parameters changed mid-flight. The result is two versions of you sitting in a marketing database, and that is the kind of outcome that makes consumer advocates in Canberra and regulators at the ACCC uneasy about how cleanly consent was captured.

For smaller operators running a Shopify store out of a garage in Geelong or a Squarespace site for a local café in Fremantle, the risk can feel remote. Yet the Notifiable Data Breaches scheme applies just as much to a two-person team as to a major bank. Cleaner tracking hygiene reduces the surface area for mistakes, including the kind of mistake that turns a routine redirect into a reportable incident under Australian law.

How to spot double counting in your own data

The first tell is two pageviews from the same user in the same minute, often with different referrers and almost identical timestamps. In Google Analytics 4 and Plausible, you can build a segment that looks for sessions under thirty seconds with more than one pageview where the first referrer is your own domain. That segment will quietly fill up with redirect artefacts that would otherwise hide inside the much larger pile of genuine visits from readers across Sydney, Brisbane, and the regional towns the NBN now reaches.

The second tell is campaign tagging. If every internal short link carries a unique UTM parameter, the analytics tool will treat each one as a fresh source, even when the destination is the same page you would have reached without the tag. Australian agencies that rely heavily on UTM tagging for clients in retail, tourism, and higher education frequently discover that their own tracking redirects are the loudest source of internal traffic in any given month.

A useful habit is to test in an incognito window with a clean profile and a single click. Capture the network panel in your browser developer tools and watch how many HTTP requests fire before the destination page fully renders. If the count is higher than you expected, the redirect chain is doing more work than it should, and your analytics is almost certainly recording more than one session per visitor.

Practical habits that reduce the noise

The cleanest fix is to fire analytics tags only on the final destination, not on the intermediate hop. Tag managers make this straightforward with a trigger that waits for a specific pageview or a custom event from the destination server. Once that trigger is in place, the same click produces one entry instead of two, and your reports start to match the reality your customers actually experience.

A second habit is to audit your short links and campaign tags every quarter. Australian businesses running loyalty programs through apps like Stamp Me or running email campaigns through platforms such as Mailchimp and Klaviyo often maintain dozens of tagged URLs at any given time. A stale redirect can quietly keep firing months after a campaign ends, and a short spreadsheet review each quarter catches most of them before they pollute the next report.

Finally, be honest with readers about what is happening when a link does not behave the way they expect. A short note on the page, or a brief look at where links actually lead, sets the right expectation and reduces the support tickets that come in from confused customers in places as far apart as Cairns and Ballarat.