How to Track QR Code Scans with Short Links
A QR code is only a picture of a URL. Put a short link you control inside it and you can change the destination later, count every scan, and see which printed placement worked.
On this page
A QR code is a picture of a piece of text, and that text is almost always a URL. Once it is printed on a flyer, a menu, a box or a shop window, the URL inside it can never be changed again. So the whole trick to tracking QR codes is to encode a short link on a domain you control, and let a redirect rule decide where that link actually goes. The destination stays editable, the scans get counted, and you learn which printed placement did the work.
Here is the setup end to end: making the link, choosing the redirect type, tagging it so scans are identifiable, testing before print, and reading the numbers you get back.
Why You Never Encode the Final URL
Put the real page address straight into the code and you have created two problems that only show up after the print run. The destination is frozen, so a moved page, a finished promotion or a plain typo means reprinting everything. And the visit is invisible: it arrives at your site looking like any other direct visit, with nothing to say a printed code sent it.
A short link solves both at once. The code points at a path on your own site, that path redirects to wherever you want today, and the redirect is a moment where you can count the hit and label it. The code becomes a pointer, not a destination.
Step 1: Make the Short Link on Your Own Domain
Pick a short, readable path: /qr/menu, /go/summer, /p/flyer. Use your own domain rather than a public shortener, because the shortener owns the stats, can rate-limit or rebrand, and takes every printed code with it if it shuts down. Your own domain also looks like you, which matters when the URL is printed as text under the code, and it should be, since some people will type it instead of scanning.
Then create the redirect rule that points that path at the real page. In WordPress that is a plugin job: DevDome Redirect Manager turns any path on your site into a rule with a destination, a redirect type, and click counting attached. Keep the path short for a reason that is not cosmetic: fewer characters means a less dense code, and a less dense code scans faster from further away.
Step 2: Choose a Redirect Type That Stays Editable
This is the step people get wrong. A 301 tells browsers the move is permanent, and a permanent redirect is cacheable, so a phone that has already followed it can keep going to the old destination even after you change the rule. On a printed code that is close to unfixable.
For anything printed, use a temporary redirect instead, a 302, or a 307 when the request method has to survive. You are explicitly telling every client that this destination may change, which is exactly the truth about a campaign. Our 301 vs 302 guide covers the wider rule, but for QR the answer is short: permanent codes need temporary redirects.
Step 3: Tag the Link So Scans Are Identifiable
Tag at two levels. First the path itself: give every placement its own rule, so /qr/menu-tent and /qr/window-poster are separate counters. One shared code across five placements can only ever tell you that something worked.
Second, the destination: add campaign tags to the URL the rule points at, so the visit shows up as a campaign in your analytics rather than as direct traffic. A typical set is utm_source=qr, utm_medium=print, utm_campaign=summer-menu and utm_content=table-tent. Keep the names lowercase and consistent, because most analytics tools treat QR and qr as two different sources. Our UTM guide for WordPress has the naming rules that save you from cleaning this up later.
Step 4: Test the Code Before It Goes to Print
Generate the code from the short link, then run four checks. Scan it with both an iPhone camera and an Android phone, since they use different decoders. Run the short link through a redirect checker to confirm it returns the type you intended and lands in a single hop. Print it at final size and scan from the distance a real person will stand at, which for a window poster is a metre or more. And leave the quiet zone, the blank margin around the code, intact, because designers routinely crop it and a cropped code fails silently.
Two habits worth keeping: print the plain URL under the code for people who will not scan, and check that the landing page holds up on a phone, on mobile data, in daylight.
What the Scan Numbers Really Mean
Your rule counts hits on a URL, and a hit is not a person. Link previewers fetch URLs to build preview cards, security scanners follow them, and crawlers find any path that is ever published. Printed codes are less exposed than links sitting in a page, but the redirect path is a normal URL and gets discovered eventually.
The scale of that padding is easy to underestimate. On one of our own affiliate sites last month, real visitors produced about 9,450 tracked clicks while automated traffic fired another 4,070 on the same links, which is close to 3 in 10 raw click events. A counter that does not separate the two would have reported a campaign that never happened.
So read two numbers side by side: hits on the rule, and human visits on the landing page. The gap between them is your real story. Because the counting happens on your server as the redirect fires, nothing is stored on the scanner’s phone, which is the same reason cookieless measurement sits on a more GDPR-friendly footing.
Keeping Codes Alive After They Are Printed
Codes outlive campaigns, so plan for the afterlife. When a promotion ends, repoint the rule at a sensible fallback rather than deleting it, because a deleted rule turns every printed code into a 404. Keep a simple inventory too: rule path, where it was printed, when, and what it points at now.
One failure mode deserves its own warning. If a cache layer has stored the old redirect, scans can keep landing on last month’s page after you have already changed the rule, which is why redirects break after you add caching. Redirect Manager serves rule paths cache-safe and can purge across 10 common WordPress cache plugins when you save, so the change you just made is the change people get. Then watch the per-rule click stats, complete with a desktop, mobile and tablet split, and let the placement with the best numbers decide next year’s print budget.
Disclosure: DevDome publishes this blog and makes the products it mentions. We describe what they do rather than promise results.
Key takeaways
- A QR code stores a URL and nothing else, and once it is printed that URL can never change.
- Encode a short link on your own domain, then redirect it, so the destination stays editable.
- Use a temporary redirect type for printed codes; a permanent one can be cached and outlive your change.
- Give every placement its own path and campaign tags, or you cannot tell the flyer from the shop window.
- Scans are hits, not people: split humans from bots before you judge a campaign.
Sources
- MDN: HTTP 301 Moved Permanently — what a permanent redirect signals, and why the response is cacheable
- MDN: HTTP 302 Found — the temporary redirect used for destinations you intend to change
- Google Analytics Help: URL builders and campaign data — the official definitions of utm_source, utm_medium, utm_campaign and utm_content
Links last checked August 17, 2026.
Frequently asked questions
Do I need a paid QR tracking service?
Not for the tracking itself. A redirect rule on your own domain does the same job: it counts every hit, it can be repointed later, and the printed URL stays yours rather than belonging to a service that might change its terms or disappear. Paid services mainly add design tooling and bulk management, which matters more when you are printing hundreds of distinct codes.
Can I change where a QR code points after it is printed?
Yes, as long as the code contains a short link you control. You edit the redirect rule and every future scan goes to the new destination. The one caveat is caching: if the rule was set as a permanent redirect, a phone that scanned it before may keep using the old target, which is why a temporary type is the safer choice for print.
Does counting QR scans need a cookie banner?
Counting a redirect happens on your server as the hit arrives, so nothing is written to the scanner's phone by the redirect itself. That keeps the scan count on a GDPR-friendly footing. Whatever the landing page then loads is a separate question, and the usual suspects such as embedded video, chat widgets and ad tags still apply.
Why is my scan count higher than the visits on the landing page?
Some of the gap is real people leaving before the page renders, on a bad connection or by scanning and then locking the phone. The rest is automated: link previewers, security scanners and crawlers all fetch URLs they find, and they hit a redirect path just like anything else. Compare the two numbers regularly, because a sudden gap usually means one of the two is being padded.