Mistake: tokens dropped on HTTPS to HTTP hops

Mistake: tokens dropped on HTTPS to HTTP hops

Failure mode: traffic source sends HTTPS, one hop in your redirect chain is HTTP, and the browser strips the Referer plus any data you tried to pass via referer. Sub-IDs vanish.

Fix — checklist:
— Map every hop: source link, tracker domain, prelander, offer. Note the protocol of each.
— Confirm every domain in the chain is HTTPS with a valid certificate. One HTTP hop downgrades the whole chain.
— Never pass clickid or sub-IDs via Referer. Pass them as explicit query parameters on each redirect.
— Test: open the source link, land on the offer, inspect the final URL. Every token you injected must be present and populated.
— Set up a redirect-health monitor that flags any 3xx pointing to an http:// target.

Verify: run the full chain through a header inspector. Status codes should be 301/302 with no protocol downgrade and no mixed-content warning.

Save this SOP. Run this before every launch.