Robottobeta Run a check

Guide

www vs non-www: picking one and redirecting the rest

It barely matters which host you choose. It matters a lot that every other version redirects to it in one step.

By Robotto Team · · 4 min read

Every domain has at least four addresses for its home page: http://example.com, http://www.example.com, https://example.com and https://www.example.com. Only one of them should serve the site. The other three should redirect to it, permanently, in a single hop.

When that isn't true, you get duplicate copies of every page. Links from other sites split between them, analytics splits, and search engines have to pick a version on your behalf. They're good at it, but they sometimes pick the one you didn't want, and the signals take time to settle every time something changes.

Which one should you choose?

For search ranking, neither. Google treats www and the bare domain as two hostnames and will index whichever you consistently point to. The real differences are operational.

www.example.com example.com
DNS Can be a CNAME to a CDN or host The apex can't be a plain CNAME; needs A/AAAA records, ALIAS/ANAME, or CNAME flattening
Cookies Cookies set on www stay on www Cookies set on the apex can be sent to every subdomain
Looks Longer, familiar to older audiences Shorter, common on newer brands
Typing People who type www get where they meant People who leave it off get where they meant

The DNS point used to decide it for many teams. Most DNS providers now flatten CNAMEs at the apex, so either works. The cookie point matters if you run other services on subdomains and don't want the main site's cookies sent to them.

If your site already has years of links to one version, keep that one. Switching gains nothing and costs a migration.

What correct looks like

Say you chose https://www.example.com. The four requests should look like this:

https://www.example.com/   200
https://example.com/       301 -> https://www.example.com/
http://www.example.com/    301 -> https://www.example.com/
http://example.com/        301 -> https://www.example.com/

Each wrong version reaches the right one in one redirect. That last line is the one most often wrong. A typical misconfiguration does it in two steps:

http://example.com/        301 -> https://example.com/
https://example.com/       301 -> https://www.example.com/

That works, and search engines will follow it, but it's slower for visitors and adds one more place for a rule to break. It usually happens because the http-to-https rule and the www rule live in different places, for example the CDN handles https and the origin server handles www.

The Robotto checker requests all four versions and shows each chain. The Canonical column goes amber when a version needs more than two redirects or uses a temporary 302, and red when the versions end up on different hosts.

Setting it up

Do it in one place if you can. If a CDN sits in front of your site, the CDN is usually the best place, because it answers before the request reaches your server.

On Cloudflare, a single redirect rule can match both the bare host and plain http and send everything to https://www.example.com with the path and query string kept. Turn on "Always Use HTTPS" too, but test the order. If both fire, you can end up with two hops again.

On nginx, give the wrong hosts their own server block:

server {
    listen 80;
    listen 443 ssl;
    server_name example.com;
    # ssl_certificate ... (the certificate must cover example.com too)
    return 301 https://www.example.com$request_uri;
}

server {
    listen 80;
    server_name www.example.com;
    return 301 https://www.example.com$request_uri;
}

On Apache with .htaccess:

RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} !^www\.example\.com$ [NC]
RewriteRule ^ https://www.example.com%{REQUEST_URI} [L,R=301]

Both send every wrong combination to the right one in one hop and keep the path.

The certificate has to cover both names

A redirect from https://example.com can only happen after the TLS handshake. If the certificate only covers www.example.com, browsers show an error before they ever see your redirect. Make sure the certificate lists both names. Most automated certificate setups do this if you ask, but it's easy to miss the bare domain when you add a site.

Don't forget the other signals

Redirects do most of the work. A few other things should point the same way:

  • The <link rel="canonical"> tag on each page should use the chosen host.
  • Internal links, sitemaps and the Sitemap: line in robots.txt should use it too.
  • Hreflang tags and Open Graph URLs, if you use them.
  • If you've chosen HTTPS for good, send an HSTS header from the final host so browsers stop trying plain http.

Mixed signals don't break anything outright. They slow down how fast search engines settle on the version you wanted.

When www has no DNS record at all

Some sites never set up www. If nobody links to it, that's fine; the checker notes it without marking it as a problem. But people do type www out of habit, and a handful of old directories add it automatically. Adding a DNS record and a redirect costs nothing and catches those visitors.

Check after every change

Redirects break during moves: a new host, a new CDN, a DNS provider change, an expired certificate on one of the names. After any of those, run the domain through the checker and read the four chains. It takes a few seconds, and it's much faster than finding out from a traffic report a month later.

More guides