There are several posts on this forum related to this issue with existing customers being redirected to a bogus page on the ee website when trying to buy something (I really don't understand why this is not being taken seriously).
In the absence of EE seeming to care about this, I have done some research in the hope that my findings will help the team responsible for the website resolve the issue.
It starts with being directed to this URL by the "Log in for saving" buttons: https://ee.co.uk/shop/mobile/add-sim-only-deals
After lots of HTTP negotiations, the web server redirects the browser to https://ee.co.uk/what-do-you-want-to-do-today when https://ee.co.uk/signin-saf responds with a HTTP 303 with location header "/what-do-you-want-to-do-today" which is a blank page with only the EE header and footer like this:
My conclusion is that the web server has processed my login and decided that I should be directed to https://ee.co.uk/what-do-you-want-to-do-today. This may be the correct URL and maybe it works for most existing customers, but those of us reporting this issue either should not be being redirected to it, or the page is just not working correctly for us.
The web developers should be able to figure out what is going on. I am available for hire if they need help, bless them. If this info does make its way to the dev team, maybe this error message from the chrome developer tools console might help:
Refused to load the image '<URL>' because it violates the following Content Security Policy directive: "default-src 'self' 'unsafe-eval' 'unsafe-hashes' 'unsafe-inline' data: blob: google-analytics.com static.isitetv.com pixel-config.reddit.com login.microsoftonline.com paa-reporting-advertising.amazon *.paa-reporting-advertising.amazon s.pinimg.com ct.pinterest.com reevoo.com tyviso.com t.co *.cloudfront.net wmstatic.global.ssl.fastly.net s.salecycle.com <URL> *.tags.tiqcdn.com <URL> api.braintreegateway.com cdn.jsdelivr.net <URL> amazon-adsystem.com *.online-metrix.net <URL> <URL> consent.trustarc.com update.adblock360.org the.sciencebehindecommerce.com edge.adobedc.net *.paypal.com usersync.gumgum.com client-analytics.braintreegateway.com *.twitter.com <URL> ad.360yield.com d169-54-eu-west-2.api.decibelinsight.net google.com imp2.nowinteract.com gstatic.com <URL> <URL> client-api.arkoselabs.com eb2.3lift.com <URL> *.smartadserver.com <URL> snap.licdn.com static3.avast.com adobedtm.com <URL> *.idomoo.com <URL> sync.lemmatechnologies.com js.smct.co tiktok.com *.sentry.io cloudfront.net <URL> jadserve.postrelease.com e1.emxdgt.com public-prod-dspcookiematching.dmxleo.com dmx.districtm.io *.google-analytics.com u.4dex.io *.ee.co.uk acs.revolut.com 3dsecure.zen.com <URL> sofia.trustx.org alb.reddit.com *.liveperson.net ws.sessioncam.com smartadserver.com ajax.googleapis.com lh3.ggpht.com openx.net smct.co decibelinsight.net 3dsportal.ecustomerpayments.com *.casalemedia.com ads.betweendigital.com <URL> <URL> ws.cs.1worldsync.com *.smct.io collection.decibelinsight.net <URL> lpsnmedia.net i.ytimg.com <URL> *.microsoft.com plugin.ucads.ucweb.com p294588.clksite.com at.alicdn.com zr.ee.co.uk vkanalytics.net c.cnzz.com ee-tagging.s3.amazonaws.com ee.real-digital.co.uk liveperson.net twitter.com facebook.com bt-verify.arkoselabs.com everesttech.net app.wizdom.ai ee-outage.s3.amazonaws.com channel-cards-html.lloydsbankinggroup.com fonts.googleapis.com <URL> firehose.eu-west-1.amazonaws.com ee-dtp-static.s3.amazonaws.com tags.tiqcdn.com authorize.omniture.com nebula-cdn.kampyle.com sprinklr.com doubleclick.net *.smct.co <URL> <URL> cdn.decibelinsight.net <URL> sync.bfmio.com portal.decibel.com cdn.studentbeans.com <URL> social.hotukdeals.com liveper.sn plugin.monotote.com <URL> a.optmnstr.com criteo.com <URL> cdn.scite.ai *.google.com sitecatalyst.omniture.com vip.timezonedb.com api.uniqodo.com btbsecure.business.bt.com static.queue-it.net ee-datacalc.s3.amazonaws.com analytics.google.com cdn.nowinteract.com secure.quantserve.com *.alicdn.com sc-static.net scp.kampyle.com akamaihd.net insights.uniqodo.com smct.io *.googleadservices.com thisisdax.com ms-cookie-sync.presage.io verify.monzo.com *.algolianet.com *.omtrdc.net bt-api.arkoselabs.com *.cdn.jsdelivr.net idomoo.com medallia.eu youtube-nocookie.com s.pubmine.com secure5.arcot.com events.smct.co authentication.cardinalcommerce.com unpkg.com *.criteo.net ls.smct.io fonts.gstatic.com btsecurepayments.bt.com gdata.youtube.com cloudiq.com googlesyndication.com api.experianaperture.io *.everesttech.net ads.avct.cloud rialto-gms.s3.amazonaws.com track.adform.net cdn.walkme.com sentry.io *.lpsnmedia.net liveengage.com *.thisisdax.com ee-uk-ppf.wm-staging.com <URL> use.typekit.net *.doubleclick.net rtb.gumgum.com vimeo.com payments.braintree-api.com pixel.tapad.com <URL> gjtrack.ucweb.com *.demdex.net snapchat.com <URL> <URL> *.akamaihd.net bat.bing.com <URL> dispatcher.adxcore.com t.paypal.com <URL> cdn.honey.io *.facebook.net production-3d-device-assets.s3-eu-west-1.amazonaws.com eeretailapp.co.uk googleadservices.com *.cloudiq.com *.lijit.com <URL> *.openx.net *.googlesyndication.com bt-token.ecustomersupport.com builder.adobedemo.com *.opendns.com tyviso.fra1.cdn.digitaloceanspaces.com ep.smct.co algolianet.com *.tyviso.com secure4.arcot.com <URL> code.jquery.com match.sharethrough.com *.uniqodo.com *.2o7.net microsoft.com c.s-microsoft.com ss-analytics.ee.co.uk <URL> *.reevoo.com resources.digital-cloud-uk.medallia.eu cdn.syndication.twimg.com <URL> track.uniqodo.com contextual.media.net tracking.audio.thisisdax.com accounts.studentbeans.com uniqodo.com <URL> <URL> opendns.com udc-neb.kampyle.com lpcdn.lpsnmedia.net <URL> *.adobedtm.com snappcm-dev.com cdn.cs.1worldsync.com simage2.pubmatic.com i.salecycle.com cdn.co-buying.com <URL> *.youtube-nocookie.com assets.revlifter.io <URL> s.ytimg.com cdn.smct.co md-scp.kampyle.com connect.studentbeans.com 3dsecure.bnpparibas.pl acs2.swedbank.se algolia.net ipb.smct.co *.insights.algolia.io/ <URL> *.pinterest.com *.googleapis.com *.promotionx.io <URL> api.greenadblocker.com bh.contextweb.com ping.pdst.fm *.uqd.io sync.teads.tv api.opmnstr.com accdn.lpsnmedia.net bt.canto.global acs3.mpts.modirum.com assets.adobedtm.com ee.co.uk casalemedia.com consent-pref.trustarc.com <URL> <URL> eefinance.co.uk production-3d-device-assets.s3.eu-west-1.amazonaws.com region1.google-analytics.com *.criteo.com fonts.smct.io *.bidswitch.net secure7.arcot.com *.snapchat.com mp.4dex.io pinterest.com contentsquare.net <URL> ads-twitter.com googleapis.com <URL> *.amazon-adsystem.com <URL> sync.search.spotxchange.com *.tiktok.com liveperson.com *.algolia.net translate.google.com online-metrix.net cdnjs.cloudflare.com adservice.google.com *.gstatic.com prf.hn insights.algolia.io/ liveengage.net <URL> demdex.net 15gifts-public-assets.s3.amazonaws.com gateway.zscalerone.net region1.analytics.google.com promotionx.io partners.tremorhub.com engagement.uniqodo.com criteo.net <URL> js.smct.io ee.15gifts.com ee.cloud-iq.com snappcm.com ads.avocet.io adservice.google.co.uk <URL> *.sprinklr.com <URL> px.ads.linkedin.com cognito-identity.eu-west-1.amazonaws.com facebook.net <URL> p0.mycdn.co cdn.smct.io *.facebook.com *.ads-twitter.com <URL> assets.queue-it.net df0b7f32-3ds.sibs.ro prod-browsext.pricesearcher.com saltcdn2.instagram.com sync.go.sonobi.com uqd.io <URL> onetag-sys.com *.eefinance.co.uk api.home.bt.com <URL> <URL> cpm.convergeselect.net cb2d09ce-3ds.sibs.ro eeuk.queueit.net omtrdc.net *.contentsquare.net". Note that 'img-src' was not explicitly set, so 'default-src' is used as a fallback.
Another observation - navigating to https://ee.co.uk/what-do-you-want-to-do-today by typing it into the browser address bar gets a 302 response redirecting to https://ee.co.uk/
