Session or cookie-based language redirects routinely make one language unreachable. If the default locale has no URL prefix, an unprefixed path carries no locale signal, so the redirect middleware treats it as unset and sends the visitor to whatever was stored - meaning the default language can never be selected again. The same mechanism serves the wrong language to anyone opening a shared link, and can undermine hreflang entirely.
locale-redirect-trap-audit.md
---
name: locale-redirect-trap-audit
description: Use when visitors report being unable to switch back to a language, or when a shared link opens in the wrong language for the recipient.
---
# Locale redirect trap audit
Session or cookie-based language redirects routinely make one language unreachable. If the default locale has no URL prefix, an unprefixed path carries no locale signal, so the redirect middleware treats it as unset and sends the visitor to whatever was stored - meaning the default language can never be selected again. The same mechanism serves the wrong language to anyone opening a shared link, and can undermine hreflang entirely.
## What you need first
- The site with locale switching enabled
- curl or any client that can hold and replay cookies
## Method
1. Request a prefixed URL in a non-default language to establish a stored preference.
2. Replay the same client, now requesting the unprefixed equivalent. If it 302s back to the stored language, the default locale is unreachable and the bug is confirmed.
3. Repeat for a deep path, not just the home page. A redirect that only fires at the root is acceptable; one that fires on every path is not.
4. Request the default-language URL with no cookie at all - this is what a crawler sees. If it redirects, hreflang validation will fail regardless of how correct the markup is.
5. Fix by making the URL authoritative: only ever act on a stored preference at the bare root, and only record a preference when the visitor explicitly asks for one via the switcher.
6. Re-test all four cases: choose a language, return to root, choose the default language, and open an explicit path with a conflicting preference stored.
## What this produces
A four-case pass/fail matrix proving every language is reachable, explicit URLs are never overridden, and a cookieless request receives the canonical default.
## Where this goes wrong
- Testing only the home page, where the bug is least visible
- Testing with a browser that already holds a preference, so the broken path never triggers
- Assuming crawlers are unaffected - they are not, because the redirect changes what is served at the canonical URL
---
From the QuQi skill library - https://www.quqi.io/skills/locale-redirect-trap-audit
Free to download · no account, no email
A four-case pass/fail matrix proving every language is reachable, explicit URLs are never overridden, and a cookieless request receives the canonical default.