Canonical Tags, Redirects and HTTPS: One Address for Every Page

The same page can often be reached through several addresses: with and without www, over http:// and https://, with a tracking code from a WhatsApp campaign, with a filter applied, or through two different categories. To you it's one page. To a search engine, each address could be a separate page with identical content.

Three tools fix this, and they work as a team:

• HTTPS makes the secure address the only real one.
• Redirects send people and search engines from old or alternative addresses to the right one.
• Canonical tags name the main version when several addresses must keep working.

This guide covers all three and how to use them together, including a step-by-step plan for moving a site.

Why one address matters

Duplicate content isn't a penalty, but it causes real trouble:

• Split signals. Links and attention spread across several addresses instead of building up one.
• The wrong address ranks. Google might show the version with a tracking code, the http:// version or the filtered view.
• Wasted crawling. Crawlers spend time on copies instead of your new pages.
• Messy reports. Search Console and analytics split one page's numbers across several rows.

Common sources of duplicates:

• http:// and https://, or www and non-www versions
• trailing slashes: /page and /page/
• tracking parameters: ?utm_source=whatsapp
• filters and sorting: ?color=red&sort=price
• the same product in two categories: /sarees/red-silk and /wedding/red-silk
• copies of your content on other websites

HTTPS: the secure address comes first

HTTPS encrypts the connection between the visitor and your site, so form details and payments can't be read or changed on the way. You can tell a site uses it by the https:// in the address.

Every website needs it, even a simple brochure site:

• Trust. Browsers label plain HTTP pages "Not secure", especially pages with forms, and many visitors leave.
• Rankings. Google has used HTTPS as a light ranking signal since 2014.
• Features. Many browser features only work on HTTPS.

The certificate is usually free. Most hosts offer Let's Encrypt with one click. Vercel, Netlify, Shopify, Wix and Squarespace include HTTPS automatically, and Cloudflare can add it in front of any site. Free certificates last about 90 days and renew automatically. If a renewal fails, visitors see a full-page security warning, so don't ignore expiry emails from your host.

Mixed content

If an HTTPS page loads images, scripts or styles over http://, browsers may block them or show a warning. Change those addresses to https://. Your browser's developer console lists every mixed content error on a page.

Redirects: sending old addresses to the right one

A redirect sends anyone who visits one address to another automatically. You need one whenever a page moves: a new website, a renamed product, a switch to HTTPS or two pages merged into one.

Google has said both permanent and temporary redirects pass ranking signals. The difference is which address it keeps showing. With a 301, Google understands the new address is the one to show. With a 302, it may keep the old one in results for a while, expecting it to return.

Use a 301 when:

• moving from http:// to https://
• choosing www or non-www and redirecting the other
• changing your domain name
• renaming a page, such as /product-12 to /red-silk-saree
• merging two thin pages into one stronger page
• deleting a page that has a close replacement

Use a 302 when:

• a product is temporarily out of stock and you send visitors to its category
• a seasonal page points to a temporary offer
• the site is briefly down for maintenance

Chains and loops

A chain is when A redirects to B, which redirects to C. Each hop slows the page and adds a chance for something to break. After a site moves twice, old links often run through chains without anyone noticing. Point every old address straight to the final one, and update internal links so no redirect is needed at all.

A loop is when addresses redirect to each other forever, and the browser shows "too many redirects". I caused one on Rankdesk. I added a rule to send /blog/ (with a slash) to /blog. But the web framework I use treats both addresses as the same route, so /blog matched the rule too and redirected to itself. Every visit to the blog failed until I removed the rule. After adding any redirect, open both the old and the new address in a private window.

Deleted pages: redirect or 404?

Redirect a deleted page only when there's a genuinely relevant replacement. Sending everything to the home page confuses visitors, and Google often treats those redirects as "soft 404s" anyway. With no replacement, let the page return 404 or 410 (gone). That's a normal part of a website changing.

This site is an example. Rankdesk once had 35 shorter guides. When I merged related ones into longer guides, each old address got a 301 to the guide that now covers its topic. The old robots.txt and sitemap guides, for instance, now redirect to one guide on robots.txt, noindex and sitemaps.

Canonical tags: naming the main version

Sometimes several addresses must keep working. Tracking links from ads have to load, and filtered category pages are useful to shoppers. You can't redirect those, so you label the main version instead with a canonical tag in the page's <head>:

<link rel="canonical" href="https://example.com/silk-sarees">

Every version of the page carries the same canonical pointing to the preferred address. The preferred page points to itself, a "self-referencing canonical", which is a good default for every page on your site.

Rules for canonical tags

1. Use full addresses with https:// and your domain, not relative paths.
2. Point to a page that works: status 200, not redirected, not noindex, not blocked by robots.txt.
3. One canonical per page. A theme and a plugin both adding one is common, and two conflicting tags may both be ignored.
4. Be consistent. Internal links, the sitemap and the canonical should all use the same address.
5. Don't point different pages to one. Page 2 of a category isn't a copy of page 1. A blue saree isn't a copy of the red one.

Google treats a canonical as a strong hint, not a command. If your other signals disagree, for example all your internal links point to a different version, Google may pick its own. The URL Inspection tool in Search Console shows both the canonical you declared and the one Google chose.

Which one to use

Moving a site, step by step

Whether you're switching to HTTPS, changing domain or rebuilding the site, the plan is the same:

1. List every important old address from your sitemap, Search Console and analytics.
2. Map each one to its new address in a spreadsheet, one row per page.
3. Set up 301 redirects for every row, page to page. http://example.com/sarees goes to https://example.com/sarees, not to the home page.
4. Avoid chains. http://example.com should reach https://www.example.com in one step, not via https://example.com.
5. Update internal links, canonical tags and the sitemap to the new addresses.
6. Fix mixed content if you moved to HTTPS.
7. In Search Console, add a Domain property (it covers every version), submit the new sitemap, and for a domain change use the Change of Address tool.
8. Update your Google Business Profile, social profiles and directory listings.
9. Keep the redirects for at least a year, ideally for good.

A careful move with page-to-page 301s usually causes little or no lasting change in rankings. Rankings fall when redirects are missing, point to the home page or run through long chains.

How to set them up

• WordPress: an SEO plugin such as Yoast or Rank Math adds self-referencing canonicals. Use the Redirection plugin or your SEO plugin's redirect manager for redirects.
• Shopify: canonicals are automatic. Redirects are under Online Store, Navigation, URL Redirects.
• Apache hosting: redirect rules go in the .htaccess file.
• Vercel, Netlify and similar: set redirects in the project configuration or in your server code.
• Custom sites: add the canonical to each page template. The meta tag generator includes it with your other head tags.

Check your addresses

The Rankdesk SEO audit shows whether a page loads over HTTPS, follows the full redirect chain from the address you enter, flags temporary or multi-step redirects, and reports which address the canonical tag points to. Audit the versions people actually reach: the http:// home page, a link with a tracking code and an old address from before a redesign. Each should land on the clean HTTPS address in one step.