A baseline includes a stateless API, durable mapping database, cache, rate limiter, and analytics pipeline. On creation, validate the URL, apply abuse policy, generate a code, persist the mapping, and return the short URL. On redirect, validate the code, check cache, read the mapping on a miss, verify status/expiry, and return a redirect response.

Cache popular mappings with a TTL that respects link expiration and disable operations. Invalidation is important when a link is disabled or destination changes. Analytics should be asynchronous so a slow event sink does not block redirects; accept that analytics may be delayed or sampled if the product allows it.

Keep the mapping store authoritative. If a cache is unavailable, redirects should fall back to the database with protection against overwhelming it. Add rate limits, bot detection, malware/phishing checks, and controls against code enumeration.