diff --git a/src/www/vpn_openvpn_client.php b/src/www/vpn_openvpn_client.php
index 3564d43a4..b7a226e9b 100644
--- a/src/www/vpn_openvpn_client.php
+++ b/src/www/vpn_openvpn_client.php
@@ -137,7 +137,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
             unset($a_client[$id]);
             write_config();
         }
-        header("Location: vpn_openvpn_client.php");
+        header(url_safe('Location: vpn_openvpn_client.php'));
         exit;
     } elseif ($act == "del_x") {
         if (!empty($pconfig['rule']) && is_array($pconfig['rule'])) {
@@ -149,7 +149,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
             }
             write_config();
         }
-        header("Location: vpn_openvpn_client.php");
+        header(url_safe('Location: vpn_openvpn_client.php'));
         exit;
     } elseif ($act == "move"){
       // move selected items
@@ -159,7 +159,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
       }
       $a_client = legacy_move_config_list_items($a_client, $id,  $pconfig['rule']);
       write_config();
-      header("Location: vpn_openvpn_client.php");
+      header(url_safe('Location: vpn_openvpn_client.php'));
       exit;
     } elseif ($act == "toggle") {
         if (isset($id)) {
@@ -171,7 +171,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
             openvpn_resync('client', $a_client[$id]);
             write_config();
         }
-        header("Location: vpn_openvpn_client.php");
+        header(url_safe('Location: vpn_openvpn_client.php'));
         exit;
     } else {
         // update client (after validation)
@@ -339,7 +339,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
             openvpn_resync('client', $client);
             write_config();
 
-            header("Location: vpn_openvpn_client.php");
+            header(url_safe('Location: vpn_openvpn_client.php'));
             exit;
         }
     }
diff --git a/src/www/vpn_openvpn_csc.php b/src/www/vpn_openvpn_csc.php
index 18650f40a..562b853ac 100644
--- a/src/www/vpn_openvpn_csc.php
+++ b/src/www/vpn_openvpn_csc.php
@@ -90,7 +90,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
             unset($a_csc[$id]);
             write_config();
         }
-        header("Location: vpn_openvpn_csc.php");
+        header(url_safe('Location: vpn_openvpn_csc.php'));
         exit;
     } elseif ($act == "del_x") {
         if (!empty($pconfig['rule']) && is_array($pconfig['rule'])) {
@@ -102,7 +102,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
             }
             write_config();
         }
-        header("Location: vpn_openvpn_csc.php");
+        header(url_safe('Location: vpn_openvpn_csc.php'));
         exit;
     } elseif ($act == "move"){
       // move selected items
@@ -112,7 +112,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
       }
       $a_csc = legacy_move_config_list_items($a_csc, $id,  $pconfig['rule']);
       write_config();
-      header("Location: vpn_openvpn_csc.php");
+      header(url_safe('Location: vpn_openvpn_csc.php'));
       exit;
     } elseif ($act == "toggle") {
         if (isset($id)) {
@@ -124,7 +124,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
             write_config();
             openvpn_resync_csc();
         }
-        header("Location: vpn_openvpn_csc.php");
+        header(url_safe('Location: vpn_openvpn_csc.php'));
         exit;
     } else {
         /* perform validations */
@@ -225,7 +225,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
             write_config();
             openvpn_resync_csc();
 
-            header("Location: vpn_openvpn_csc.php");
+            header(url_safe('Location: vpn_openvpn_csc.php'));
             exit;
         }
     }
diff --git a/src/www/vpn_openvpn_export.php b/src/www/vpn_openvpn_export.php
index 14ad4203c..d65ffb5ee 100644
--- a/src/www/vpn_openvpn_export.php
+++ b/src/www/vpn_openvpn_export.php
@@ -112,7 +112,7 @@ if (isset($config['openvpn']['openvpn-server'])) {
         $usrid = isset($_GET['usrid']) ? $_GET['usrid'] : false;
         $crtid = isset($_GET['crtid']) ? $_GET['crtid'] : false;
         if ($srvid === false) {
-            header("Location: vpn_openvpn_export.php");
+            header(url_safe('Location: vpn_openvpn_export.php'));
             exit;
         }
 
diff --git a/src/www/vpn_openvpn_server.php b/src/www/vpn_openvpn_server.php
index d4df42f75..6ecc77c39 100644
--- a/src/www/vpn_openvpn_server.php
+++ b/src/www/vpn_openvpn_server.php
@@ -141,7 +141,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
             unset($a_server[$id]);
             write_config();
         }
-        header("Location: vpn_openvpn_server.php");
+        header(url_safe('Location: vpn_openvpn_server.php'));
         exit;
     } elseif ($act == "toggle") {
         if (isset($id)) {
@@ -153,7 +153,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
             openvpn_resync('server', $a_server[$id]);
             write_config();
         }
-        header("Location: vpn_openvpn_server.php");
+        header(url_safe('Location: vpn_openvpn_server.php'));
         exit;
     } else {
         // action add/update
@@ -406,7 +406,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
             write_config();
             openvpn_resync_csc(); // dump client specific overrides, the required set may have changed
 
-            header("Location: vpn_openvpn_server.php");
+            header(url_safe('Location: vpn_openvpn_server.php'));
             exit;
         } elseif (!empty($pconfig['authmode'])) {
             $pconfig['authmode'] = implode(",", $pconfig['authmode']);