How to add conditional redirects to a QR code

Each rule declares one or more conditions. When a scan arrives, rules are checked from the highest priority down and the first match wins — the ones below it are never evaluated. A default destination catches everyone else.

Because the decision happens on the server at scan time, rules need a dynamic code. A static code has the URL baked into the pattern and there is nothing to evaluate.

The useful conditions are the ones a browser or a phone reveals without asking the visitor anything. Country comes from IP geolocation and is right most of the time; device and OS come from the user agent; language comes from the Accept-Language header the browser already sends.

None of these is perfect. A traveller on a roaming SIM may resolve to the wrong country, and a browser set to English on a phone bought in Spain will ask for English. That is why rules are a routing convenience rather than a guarantee, and why the default destination has to be usable on its own.

Make specific rules higher priority than broad ones. A rule matching German iOS users should outrank a general mobile rule, because the specific one is more likely to be what you meant; if the broad rule came first it would swallow the scan and the specific rule would never run.

Always set a default. A scan with no country, an unrecognised language or a crawler hitting the code from a data centre still has to land somewhere sensible, and the default is what stops a rule set from turning into a dead end.

Three patterns cover most real cases: one print run for several markets, one package for several languages, and one poster for two app stores.

In each case the value comes from printing once. Every rule you add is cheaper than a second artwork, a second print run and a second code to manage.

Rules fail quietly: a bad order or a typo in a country code still sends the visitor somewhere, just not where you intended. Test each branch before the print run by opening the code from the source you are trying to match — a VPN for another country, a phone and a laptop for the device split — rather than trusting the dashboard preview.

Check the default path deliberately too, by simulating a scan that matches nothing. It is the branch most likely to be forgotten and the one that catches real visitors.