One address for each page: www, https, canonical tags and redirects

Last updated 14 October 2026

By the FocalScore team at Astrolabix LLC. First published 14 October 2026. Sources last checked October 2026.

The short answer

Decide on one form of your address, with https:// and either with or without www. Send each other form to it with one permanent (301) redirect, link to it from your own pages, and name it in a canonical tag in the head of each page. Then visitors, search engines and anyone sharing a link all end up at the same address.

What "one address" means

The same homepage can often be opened at several addresses:

http://yoursite.com
http://www.yoursite.com
https://yoursite.com
https://www.yoursite.com
https://www.yoursite.com/index.html
https://www.yoursite.com/Home

To a person they are one page. To a search engine they are separate addresses that happen to show the same thing, and it has to work out which one is the real one. Google calls this choosing the canonical, and it takes your redirects, your canonical tags, your internal links and your sitemap as signals.

Why it matters to a small business

Links count for one page, not several. When some people link to www and others don't, you want both to point at the same page in Google's eyes.
Visitors get the secure page. A plain http:// page has no padlock, and anything typed into it can be read on the way.
Each extra redirect is a wait. A visitor sent from http://yoursite.com to https://yoursite.com and then to https://www.yoursite.com makes two round trips before the page starts to load.

How the free scan decides

HTTPS enforced fails when the http:// address doesn't redirect to https://.
Redirect chains / loops fails when reaching the final address takes more than one redirect, and Your address settles in one step when the bare domain is passed along several times before it loads.
Canonical tags fails when a page's canonical tag is missing or points somewhere wrong, and Canonical tag uses your secure address when an https page names the http:// address as its canonical.
Each page answers at one address asks for the same page at other addresses (an index alias such as /Home or /index.php, a made-up query parameter, the address in capitals) and fails when one of them shows the page with no redirect and no canonical tag naming the proper address.
Internal links point at final addresses fails when your own links go through a redirect instead of to the final address, and No pages redirect with a meta refresh when a page sends visitors on with a meta refresh rather than a server redirect.

The fixes, by platform

Shopify, Wix and Squarespace

In the builder's domain settings, set the address you want as the primary domain. The builder then sends the other forms to it and serves the site over https. For pages that moved, use the builder's redirect tool; Shopify's help centre describes its URL redirects.

WordPress

In Settings › General, make the WordPress Address and the Site Address the same, starting with https:// and with your chosen www form. WordPress then redirects pages to that address and adds a canonical tag to posts and pages. The redirect from http:// to https:// is usually a switch in your hosting control panel; if it isn't, it goes in .htaccess, above the # BEGIN WordPress line.

Apache (.htaccess)

These lines send any request that isn't https://www.yoursite.com there in one step. Replace the address with yours; for the form without www, remove www. from both lines.

<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{HTTPS} off [OR]
  RewriteCond %{HTTP_HOST} !^www\.yoursite\.com$ [NC]
  RewriteRule ^(.*)$ https://www.yoursite.com/$1 [L,R=301]
</IfModule>

If your site sits behind a proxy or CDN that answers visitors over https but talks to your server over plain http (Cloudflare on its Flexible setting, for one), your server always sees the request as http and this rule redirects forever. Switch the CDN to talk https to your server first, or set the redirect in the CDN instead of here.

Windows hosting (IIS and ASP.NET)

IIS does this with the URL Rewrite module, which your host has to have installed. The rule goes in web.config, inside <system.webServer>. Keep a copy of the file before you edit it, and if it already has a <rewrite> element, add the rule to its <rules> instead of pasting a second one.

<rewrite>
  <rules>
    <rule name="One address" stopProcessing="true">
      <match url="(.*)" />
      <conditions logicalGrouping="MatchAny">
        <add input="{HTTPS}" pattern="off" />
        <add input="{HTTP_HOST}" pattern="^www\.yoursite\.com$" negate="true" />
      </conditions>
      <action type="Redirect" url="https://www.yoursite.com/{R:1}" redirectType="Permanent" />
    </rule>
  </rules>
</rewrite>

The same loop warning applies here: behind a proxy or CDN that reaches your server over plain http, IIS sees every request as http and this rule redirects forever. Make the CDN connect over https first, or set the redirect in the CDN.

Two things specific to IIS. It treats /About and /about as the same page, so the capitals version answers too; the canonical tag below covers that. And on ASP.NET MVC the homepage often also answers at /Home and /Home/Index: either redirect those to / or make sure the canonical tag names /. The URL Rewrite reference explains each part of the rule.

Meta refresh

If a page moves visitors on with <meta http-equiv="refresh">, replace it with a server redirect. Google follows a meta refresh, but recommends a server redirect where you can set one.

The canonical tag

In the head of each page, name that page's own proper address in full. It is the safety net for the addresses a redirect doesn't catch, such as a tracking parameter on a shared link.

<link rel="canonical" href="https://www.yoursite.com/services/">

Most builders and SEO plugins add it for you; check that it starts with https://, uses your chosen www form and names the page itself, not the homepage. Google treats it as a strong hint, not a command, so it works best when your redirects, links and sitemap say the same thing.

How to check yours

Type each of the four http/https and www forms of your homepage into a private browser window and check that each lands on the same address. The free scan does the same, also tries the index aliases, and lists each hop it followed; the sample report shows the layout.

Checklist

You have chosen one address: https, with or without www.
Each other form reaches it in one permanent redirect.
Each page has a canonical tag naming its own full https address.
Index aliases such as /Home or /index.php redirect, or are covered by the canonical tag.
Your menus and links point at final addresses, not ones that redirect.
No page relies on a meta refresh to move visitors on.

What the free scan checks for this

These are the FocalScore checks that cover this guide's subject. Each one in your report says what it found, shows the evidence and gives the fix.

Canonical tags
Redirect chains / loops
HTTPS enforced
Internal links point at final addresses
Your address settles in one step
Canonical tag uses your secure address
No pages redirect with a meta refresh
Each page answers at one address

Sources

Last checked October 2026. Documentation, settings and rules change; if one of these pages now says something different, it is right and this guide is out of date. Tell us at info@focalscore.com.