Custom Function to redirect singular post if specific meta field is empty

Question

I have a custom post type People that has several metafields. When the ecpt_bio meta field is empty, the post will link to whatever URL is entered in the ecpt_website meta field on the post archive template.

However, users can still access the bio-less single-people.php posts if they have the direct link, or via Google.

I wrote a custom function that if ecpt_bio is empty and ecpt_website exists it redirects to that website (which then notifies search engines).

Is the following code correct and secure, or is it missing something?

Thanks!

add_action( 'template_redirect', 'redirect_empty_bios' );
function redirect_empty_bios() {
    if(is_singular('people') ) :
        global $post;
        $bio = get_post_meta($post->ID, 'ecpt_bio', true);
        $link = get_post_meta($post->ID, 'ecpt_website', true);
        if(empty($bio) && isset($link)) {
            wp_redirect(esc_url($link), 301);
            exit;
        } 
    endif;
}

Answer 1

Technically, this code looks like it is accomplishing what you are trying to do, and I don't see any glaring holes.

But, do you really intend on redirecting people away from your site when they just clicked to view someone's bio? That sounds very confusing to the user and would result in a poor user experience, I think.

Regarding security, who is entering the data into the ecpt_website field? You or users? If users, I would definitely avoid that.

I assume these are offsite links, but if you are using internal links, you should use wp_safe_redirect() instead which is meant for internal linking.