Fix a short link that opens the wrong page
Why a CodeQR short link opened something unexpected — the order options are applied, caches, blocked shorteners, in-app browsers and stray clicks.
A short link with several options turned on can surprise you: one setting quietly wins over another, or the answer comes from a cache you do not control. This page gives the order CodeQR applies, then the symptoms in the order people report them.
Availability
- Plan: every plan. Some of the settings mentioned belong to paid plans; each is linked to its own article.
- Where: the link builder, and a terminal for the checks.
The order a visit is decided
When someone opens go.example.com/summer-menu, CodeQR works down this list and stops at the first thing that applies:
- Password — the visitor sees the password page and nothing below is evaluated.
- A banned link — blocked for abuse.
- Expiration — expired links forward to the Expiration URL, or show the expired page. The visit is not counted.
- The click is recorded. Everything below happens after the visit is on your report.
- Flexible link without a destination — the fill-in page.
- Pre-redirection form — the form, unless the visitor already filled it in.
- A crawler with Custom Link Preview on — the preview card instead of a redirect.
- Link cloaking — the destination inside your address.
- Smart Rules — the first rule that matches.
- iOS, then Android, then country targeting.
- The destination URL.
Two consequences catch people out: cloaking wins over Smart Rules, so a cloaked link ignores rules it also has, and a password hides every other setting, including expiry.
The destination changed but people still land on the old page
Your change is live on the very next request — CodeQR keeps no delay of its own. What holds the old answer is outside CodeQR:
- The visitor's browser may have cached the redirect. A reload with a hard refresh, or a private window, shows the truth.
- The app they clicked from may have prefetched the link.
- A QR code that was printed still encodes the same address, so it follows the new destination — unless the Short Link key was changed, which breaks it.
Check what the link answers right now, from outside every cache:
curl -sSI https://go.example.com/summer-menu
HTTP/2 302 location: https://example.com/the-new-page
If location is right, the link is right.
The preview card is out of date
The card is cached by whichever app rendered it, not by CodeQR. Read Set a custom link preview image and title — the short version is that changing the card does not change what was already shared, and WhatsApp in particular offers no way to refresh it. Confirm what CodeQR is serving today with ?bot=1 on the end of the link.
The UTM parameters are gone
Turning off UTM Builder deletes those parameters from the destination URL. Check the location line: what you see there is what the browser requests, parameters included. A destination that redirects again on your own site can also drop them.
Clicks nobody made
New links sometimes show visits within minutes of being sent. Common sources, none of them fraud:
- Security scanners. Corporate mail systems open every link in a message before delivering it.
- Preview generation. Chat apps fetch the link to draw the card, though CodeQR does not count requests it recognizes as crawlers.
- Your own testing. Visits from the same browser within five minutes count once, but a different browser or device counts again.
Someone says the link is blocked
Whole categories of shortened links are blocked by corporate firewalls, some antivirus products and a few mail filters — the domain is judged, not your link. A domain of your own is the durable fix: it carries your reputation instead of a shared one. A link that was reported for abuse is disabled by CodeQR itself and answers with a neutral page.
The link opens inside an app instead of the browser
Instagram, Facebook and TikTok open links in their built-in browser, which does not share cookies or logins with the visitor's real browser. People report being logged out, carts appearing empty, and payment sheets failing. There is no setting that forces the real browser; what helps is telling people to use the Open in browser option in the app's menu when a login is involved.
The wrong app store, or the wrong country page
Device and country targeting are read from the visit itself. A visitor on a laptop never matches an iOS rule, and someone on a VPN is treated as being where the VPN exits. Test with the device you are targeting, and see Send iOS and Android visitors to their app store and Geo redirect by country, region, city, or language.
A Smart Rule did not fire
Rules are evaluated in order and the first match wins. How Smart Rules choose a destination — and why it differed walks through each attribute; remember that cloaking, an expiry or a password all take precedence.
The link opens a "not found" page
The key does not exist on that domain. Copy the link from Links rather than retyping it, and check the domain in the address: keys are unique per domain, so go.example.com/promo and links.example.com/promo are different links. Capitalization is not the problem — keys resolve regardless of case.
The destination received extra parameters
Anything appended to the short link is passed through to the destination, and a parameter with the same name replaces the one stored on the link. That is deliberate — it lets one link carry a different utm_source per channel — but it means a stray ?fbclid=… from a social app also arrives at your page.