Why would our server return a 301 status code when Googlebot visits from one IP, but a 200 from a different IP?

[danatanseo]

I have begun a daily process of analyzing a site's Web server log files and have noticed something that seems odd. There are several IP addresses from which Googlebot crawls that our server returns a 301 status code for every request, consistently, day after day. In nearly all cases, these are not URLs that should 301. When Googlebot visits from other IP addresses, the exact same pages are returned with a 200 status code.

Is this normal? If so, why? If not, why not?

I am concerned that our server returning an inaccurate status code is interfering with the site being effectively crawled as quickly and as often as it might be if this weren't happening.

Thanks guys!

[danatanseo]

Howdie,

Yes, I believe we got this sorted out. Interestingly, it wasn't any of the suggestions made here causing the 301 status code responses. I posted a thread in Google Webmaster Tools Forum regarding the issue and received a response that I am 99.5% sure is the correct answer.

Here is a link to that thread for future readers' reference: https://productforums.google.com/forum/#!mydiscussions/webmasters/zOCDAVudxNo

I believe the underlying issue has to do with incorrect handling of a redirect for this domain:  ccisound.com

I am currently pursuing getting it corrected with our IT Director. Once the remedy is in place, I should know right away if it solves the issue I am seeing in the server logs. I'll post back here once I am 100% certain that was the issue.

Thanks all! This has been an interesting one for me!

[Christy-Correll]

Hi Dana, have you definitively sorted this out?

[danatanseo]

They are pretty detailed, I'll send you yesterday's in a zip file so you can take a look. I'm certain that have everything needed. Thanks Eric!

[ForForce]

Right, a DNS manager could do a redirect, but that would not be visible in the web server log.  It would only be visible in whatever is managing the DNS.

[William.Lau]

Depends what kind of DNS manager you are using. A redirect via DNS can still be possible.

In my experience DNS managing software can redirect users with 301 or 302 headers depending on what settings you have. If your DNS manager has a security protocol along with redirect rules, it could be causing the issue.

Examples of DNS redirects:

https://dnsimple.com/url-forwarding-301-redirect

https://support.cloudflare.com/hc/en-us/articles/200172286-How-do-I-do-url-forwarding-with-CloudFlare-

[ForForce]

The request headers will also show if any and what cookies the user may have set.  Which it looks like is how your server determines if it should provide the client the desktop or mobile version.

[ForForce]

How detailed are your log files?  Can you see the user-agent (browser name) Maybe you could ask your IT department to log request headers?  If that will make the log files too big, they can probably do it only for the 'problem' IPs, or only for cases that the webserver returns a 301.  I'll take a look if you like.  Email is in my profile.

Best,

-Eric

[danatanseo]

Thanks so much Eric. Yes, I was thinking about the mobile version of our site being related to what I'm seeing too. However, I am unaware that we 301 redirect anything from the main site to the mobile site. In fact, users can actually switch to the mobile site via desktop by clicking "Mobile Site" in the footer and then browse the mobile version of the site via desktop. All of the URLs are identical.

Just out of curiosity I browsed to the mobile version of our site, grabbed a URL and then plugged it into "Fetch as Googlebot" in GWT. For all options, including desktop and the three mobile options a status code of 200 was returned.

[ForForce]

The problem can't be related to DNS.  If the problem was related to DNS, the request would never make it to your server, and you would never see anything related to the request in your log files.

Because you can see it in your log file, it is definitely happening on your own webserver (not some external problem).

The requesting IP is probobly not the problem, but it could be if your server automatically adds to a banned list any IP that requests > X pages in Y time - your server might think this is a DOS (denial of service) attack.... But if your server was set up to do this, your IT guys would probobly know about it.  This isn't something that is normally enabled 'out of the box' someone would need to intentionally activate a behavior like that.

More likely, is that there is another common denominator besides the requester IP...  I would guess that it's the user agent string (the browser or device the user is using).

Taking a quick look at what I think is your site, you have a mobile version available.  Google of course would be interested in what your site looks like to a mobile browser, and would send a 'fake' user agent string pretending to be so (a cell phone or a tablet etc...)  If your server sees this request, and tries to automatically redirect the browser to the mobile version of the site, then you would have your 301 code (which in this case is exactly what you intended, so your all set!)

There are probably a few other cases that could cause a 301 for just some IPs, but this is the only one that comes to mind at the moment.

Good Luck!

[danatanseo]

Here is the response from my IT Director regarding the possibility that this is being done by our DNS manager:

"I do not believe so. Our DNS does translation of human readable names to IP address. It has nothing to do with the status being returned to a browser, and even if it did it could not write to the log file."

Is this accurate? I understand that the DNS cannot write to the log file, but if the DNS can flag a request to receive a certain status code from the server, then this scenario would still be a possibility.

[danatanseo]

According to our IT Director we have no spam filters, no mod_security module, absolutely nothing on our server to prevent it from being crawled by bot, human or spider from any IP address, including black-listed IPs.

To me, other than the obvious (no security is probably not a good idea at all), that means that the 301 status codes being returned because of a problem with server set up.

I do have server logs that I'd be willing to share privately with anyone who's willing to take a gander. Don't worry, I won't send you a month's worth. 1-2 days should be plenty.

In the meantime I am going to dive in and take a look further. It's entirely possible that IPs from Google are not the only ones receiving nothing but 301 status codes in response to requests.

[danatanseo]

Thanks William. Good suggestion. I am on it! I'll post back here once I know more.

[William.Lau]

I would not be surprised if this was done by your DNS. If you use a DNS manager, they could possibly redirect certain users or IPs based on patterns of visits.

I suggest finding out more about any server configurations from the admin and seeing who they use as a DNS provider or manager.

[danatanseo]

Excellent thoughts!  Yes, they are consistently the same IP addresses every time. There are several producing the same phenomenon, so I looked at this one 66.249.79.174

According to what I can find online this is definitely Google and the data center is located in Mountain View, California. We are a USA company, so it seems unlikely that it is a country issue. It could be that this IP (and the others like it) are inadvertently being blocked by a spam filter.

It doesn't matter the day or time, every time Googlebot attempts to crawl from this IP address our server returns 301 status codes for every request, with no exceptions.

I am thinking I need to request a list of IP addresses being blocked by the server's spam filter. I am not a server administrator...would this be something reasonable for me to ask the people who set it up?

Is returning a 301 status code the best scenario for handling a bot attempting to disguise itself as googlebot? I would think setting the server up to respond with a 304 would be better? (Sorry, that's kind of a follow-up "side" question)

Let me know your thoughts and I'm going to go see if I can find out more about the spam filter.

[StreamlineMetrics]

Where are the 301s taking Googlebot on those IP addresses? And are they the same IP addresses every time? Have you narrowed those IP addresses down to any particular datacenter/country? It could be possible there is some configuration with your server that treats IP addresses differently depending on the country... it could also be that the IP addresses getting the 301s are known blacklisted spam IP addresses but are masking themselves as Googlebot so your server's blacklist software is keeping them out. It's really hard to say without looking into the data myself but I'm definitely interested in what you find out.