With www or Without, Pick One

Four addresses for one site

Type your site's address four ways: with www and without, starting with http and with https. On many small business sites, all four load.

To a visitor that looks harmless. The same page appears however they typed it.

To a search engine it is four separate addresses with identical content. Links from other sites point at whichever version their authors happened to use, and the credit for them is split.

Google usually picks one version to show, but not always the one you would have chosen.

The four versions

• http, no www: unencrypted, and what many people still type.
• http with www: the form on older cards and directories.
• https, no www: secure and short.
• https with www: secure and familiar to most customers.

The second lingers longest. It is on old business cards, in directory listings and in links from articles written years ago, so it keeps receiving visits long after the site has moved on.

Why splitting matters

Links are one of the ways search engines judge a page. Split across four versions, each looks less linked to than the site really is.

Duplicate versions also waste the attention search engines give a site, since the same pages can be crawled up to four times.

And a visitor who lands on the plain HTTP version of a login or payment page now sees a Not secure warning in Chrome, which the HTTPS version avoids.

Which one to pick

Search engines do not prefer www or the bare domain. Choose on practical grounds.

Choose HTTPS first, since the address you keep should be secure. Then choose whichever form is already printed on the vans, signs and cards, because that is what customers type.

If years of links point at one version, keeping it saves redirects.

Some hosting setups work more simply with www. Ask whoever manages the hosting before deciding, since this is their territory.

A worked example

A cidery with a tasting room in an orchard district had its first site built with www. Its labels, printed later, used the address without it.

When the site moved to HTTPS last year, the new version was set up without www, but the old www pages kept loading over plain HTTP. All four versions answered.

Search results showed the old HTTP pages for some searches and the new ones for others. Links from a regional tasting route map and two travel articles pointed at the old version.

The cidery chose the address on its labels, on HTTPS, and had the other three redirected to it in one step. The certificate was reissued to cover both names, and the preferred domain was set in Search Console.

Within a few weeks, search results showed only the chosen version.

Redirect the other three in one step

The fix is a 301, the code for a permanent redirect, from each unwanted version to the matching page on the chosen one.

Matching matters. The old address of the contact page should land on the new contact page, not on the home page.

Each redirect should be a single step. A chain from http to www to https works, slowly, and every hop is another chance for something to break.

Redirects are set on the server, usually in a configuration file or the hosting control panel. It is a short job for a developer and an easy one to get subtly wrong.

One common slip is a temporary redirect, known as a 302, where a permanent one was meant. It tells search engines the old address may come back, so they may go on showing it.

The certificate must cover both names

A security certificate names the addresses it protects. One issued only for the www version does not cover the bare domain, and the reverse.

If a visitor types the uncovered version with https, the browser shows a security warning before the redirect can even happen.

Free certificates can cover both names at no extra cost. When the certificate renews, check that it still does.

Settings that must agree

In WordPress, the WordPress Address and Site Address settings should both use the chosen version. If they disagree with the server's redirects, pages can loop or mix versions.

Internal links, images and menus should use the chosen version too, so the site is not redirecting itself on every page.

Old addresses typed into page content or the theme are the usual leftovers. An image still loaded over plain HTTP on an HTTPS page can make the browser drop the padlock.

Each page's canonical tag, a line in the code naming its preferred address, should point to the chosen version, and the sitemap should list only addresses on it.

The preference in Search Console

Add all four versions to Search Console as separate properties. It treats them as different sites, and a message about one does not appear under another.

Once both the www and bare versions are verified, the site settings let you choose a preferred domain. Set it to match your choice.

That setting covers www or not, but not HTTP or HTTPS. The redirects handle that part.

Then submit the sitemap under the chosen version.

Everywhere else the address appears

Update the website field in Google My Business, the social media profiles, the AdWords final URLs and the email signatures.

Nothing breaks if they are left, since the redirects catch them, but every direct link saves a hop.

And print the chosen version on the next run of cards and labels, so the address customers type matches the one search engines see.

The counter-case

If the four versions already redirect to one in a single step, and the certificate covers both names, there is nothing to do but check it once a year.

Subdomains with a real purpose, such as a separate shop or booking system, are not duplicates and should stay.

And the choice itself matters far less than making it. Neither www nor the bare domain helps or hurts a site on its own.

What matters is one address, with every other version redirected to it.

The check

1. Type all four versions into a browser.
2. Note where each one ends up.
3. Choose one, on HTTPS.
4. Redirect the other three in one step.
5. Confirm the certificate covers both names.
6. Set the preferred domain in Search Console.
7. Update listings and profiles to match.

Step five is the one most often missed. Redirects that work over HTTP fail with a warning over HTTPS when the certificate names only one version, and visitors see the warning first.

Choosing and installing that certificate is covered in which kind of security certificate a small business needs.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.