Duplicate across http/https or www: pick one canonical host

What it means

The same content is reachable on more than one protocol or host variant without a redirect consolidating them — for example both http://example.com and https://example.com, or both www.example.com and example.com, each returning 200 with identical content. To Google these are different URLs serving the same page, which is the textbook duplicate-content configuration.

Why it matters

Google treats http vs https and www vs non-www as distinct URLs. When each variant answers 200 with the same body you have created duplicates that compete with one another. Google will try to pick a single canonical on its own, but you have left that choice to its inference rather than declaring it — and the signals that should accrue to one URL (links, engagement, crawl priority) scatter across the variants instead of consolidating. The cost is diluted ranking signals plus wasted crawl budget: Googlebot fetches every variant to work out they are duplicates. The fix — choosing one canonical host and permanently redirecting the others — consolidates all signals onto a single URL and stops the duplication at the source, which is stronger than relying on canonical tags alone.

How to fix it

1. Decide your single canonical host and protocol — almost always https:// and one of www/non-www.
2. Configure the server to 301 (or 308) redirect every other variant to it, at the host level, before your application runs.
3. Chain nothing: http://www should redirect straight to the final https:// canonical in one hop.
4. Set self-referencing canonical tags on pages pointing at the canonical-host URL, and set HSTS on the https host to lock protocol upgrades.
5. Re-crawl and confirm every variant now returns a single 301 to the chosen host.

When it's not a problem

Crawlinx only flags this when a variant returns 200 and its content hash matches the homepage — a true, live duplicate. A variant that already 301s to your canonical host is correct and is never flagged; that is exactly the state you want. To avoid extra requests on shared scans, Crawlinx probes only the homepage's variants. If you intentionally serve distinct content on www and non-www (rare and generally inadvisable), the content hashes will differ and it will not be flagged.

How common is it?

16 audited sites in our corpus currently show this issue. The breakdowns below show which platforms, gatekeepers, verticals and countries are most exposed.

Related guides

• Canonical Tags Guide: rel=canonical Explained
• Duplicate Content SEO: What It Is and How Canonicalization Fixes It