glimanaDocs
/
Open Glimana →

Issue guide · Security

Both the www and non-www versions return 200

SeverityHigh
CategorySecurity
ScopeWhole site
EffortSmall
Verified byManually
Rule keywww_duplicate

Short answer

https://example.com/ and https://www.example.com/ both return 200 directly, with no redirect between them. That is two complete copies of the site. Choose one host as canonical (either is fine; consistency is what matters) and redirect the other with a 301 at the server or CDN.

Why it matters

Every page exists twice, with two URLs. Inbound links split between them, search engines have to guess which to index, and users can end up with two sessions (cookies are host-specific) or two logins. Canonical tags reduce the damage but do not consolidate crawl budget the way a redirect does.

How Glimana detects it

At the start of each crawl Glimana probes the host variants. The rule fires when two or more https:// variants return 200 with zero redirect hops. The evidence lists the variants that answered.

How to fix it

  1. Find the affected pages in Glimana. Open Issues › Both the www and non-www versions return 200. This is a site-level check, so the single row carries the full evidence: the URLs, values or days involved. The task under Tasks shows the same list and the expected gain.

  2. Apply the fix on your platform.

    Decide which host stays, then:

    1. Redirect at the server/CDN. A host-level 301 from the other variant to the canonical one, preserving the path.
    2. Set the site URL. CMS settings, APP_URL, canonical tags and sitemap entries must all use the canonical host.
    3. Register both in Search Console and set the preferred one as the property you watch; keep the Bing/GSC connection in Glimana on the canonical host.

    Set Settings › General › WordPress Address and Site Address to the canonical host; WordPress then redirects the other automatically. If a host-level rule is also needed (for example with a CDN in front), add it in .htaccess or Cloudflare Redirect Rules.

    Under Settings › Domains, set the canonical domain as the primary and enable "Redirect all traffic to this domain". Shopify then 301s the other hostname.

    Nginx: a separate server block for the non-canonical host that returns 301 https://canonical$request_uri. Cloudflare: a Redirect Rule or Bulk Redirect. Apache: a RewriteCond %{HTTP_HOST} rule.

  3. Publish and clear caches. Apply the server or CDN change (reload Nginx/Apache, save the Cloudflare rule), purge the cache, then check the live response with curl -sI https://your-domain/page — the status line and headers you see there are exactly what Glimana and Googlebot get.

  4. Verify in Glimana. Open the task under Tasks and click Mark as done once you have confirmed the fix yourself; this rule is not auto-closed by a crawl. After confirming with curl -I https://www.example.com/ (or the non-www variant) that the response is a 301 to the canonical host, mark the task done; the rule stops firing on the next crawl.

How the fix is verified

Verified manually. After confirming with curl -I https://www.example.com/ (or the non-www variant) that the response is a 301 to the canonical host, mark the task done; the rule stops firing on the next crawl.

Sources

Page is not on HTTPSThe page is served over plain HTTP. Browsers mark it "Not secure", and Google has preferred HTTPS URLs since…Mixed content (HTTP resource on an HTTPS page)An HTTPS page loads scripts, styles, images or iframes over HTTP. Browsers block or upgrade them, and the…No HTTP → HTTPS redirectThe HTTP version of your site returns 200 instead of redirecting. Two copies of the site exist, and visitors…No HSTS headerThe site does not send Strict-Transport-Security. It is a security best practice; it has no effect on search…