HTTPS, www and redirect chains: getting one clean URL

A typical domain can be reached in at least four ways: http://example.com, http://www.example.com, https://example.com and https://www.example.com. Search engines treat each as a separate URL. The job is to choose one, make it work perfectly over HTTPS, and send every other variant straight to it with a permanent redirect in a single hop.

Choose the main host

With www or without makes no difference to rankings. What matters is consistency. Pick the version already used by most of your backlinks and internal links, and stick to it in the canonical tags, the sitemap, the Search Console property and the site's own base URL setting. Changing it later is possible but means a full site redirect, so decide once.

Which redirect code

Code	Meaning	Use for
301	Moved permanently	http → https, non-main host → main host, old URL → new URL
308	Permanent, method preserved	Same as 301; also keeps POST as POST. Google treats it like a 301.
302 / 307	Temporary	Genuinely temporary moves: maintenance, A/B tests, geo or login redirects

Google has said it will eventually treat a long-standing 302 like a 301, but a temporary code tells every search engine and browser that the old URL should be kept. For protocol and host consolidation there is no reason to send that message. Use 301 (or 308) and let caches remember it.

One hop, not a chain

The most common mess is a chain: http://example.com → https://example.com → https://www.example.com → https://www.example.com/. Each hop costs a round trip for every visitor and every crawler request. Google follows up to ten hops, so a chain rarely blocks indexing, but it wastes crawl time, slows the first visit and multiplies the places where something can break.

Every variant should reach the final URL in one redirect. That means the rule on the http side must already know the main host, rather than only upgrading the protocol.

nginx

# every http request, any host → https main host, one hop
server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://www.example.com$request_uri;
}

# https on the non-main host → main host
server {
    listen 443 ssl;
    http2 on;
    server_name example.com;
    ssl_certificate     /etc/ssl/example/fullchain.pem;
    ssl_certificate_key /etc/ssl/example/privkey.pem;
    return 301 https://www.example.com$request_uri;
}

# the real site
server {
    listen 443 ssl;
    http2 on;
    server_name www.example.com;
    ssl_certificate     /etc/ssl/example/fullchain.pem;
    ssl_certificate_key /etc/ssl/example/privkey.pem;
    # ...
}

Note that the non-main host also needs a valid certificate for its HTTPS listener; otherwise a visitor who types https://example.com sees a certificate warning before the redirect can happen. Use a certificate that covers both names.

Apache (.htaccess)

RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} !^www\.example\.com$ [NC]
RewriteRule ^ https://www.example.com%{REQUEST_URI} [R=301,L]

Behind a load balancer or CDN that terminates TLS, %{HTTPS} is always off on the origin. Check the forwarded header instead (commonly X-Forwarded-Proto), or configure the redirect at the CDN. Getting this wrong produces an infinite redirect loop.

Certificates: the full chain

A certificate can look fine in a desktop browser and still fail for crawlers and some phones. The usual cause is a missing intermediate certificate: browsers that cached the intermediate from another site work, clients that did not fail. Configure the server with the full chain file (for Let's Encrypt, fullchain.pem, not cert.pem). Also watch for:

• Expired certificates after a renewal job silently stopped. Renewal should be automated and monitored.
• A certificate for example.com served on www.example.com, or the reverse.
• A CDN in front with a valid edge certificate while the origin uses a self-signed one. Visitors see no error, but the moment the CDN is bypassed, everything breaks. Know which certificate your visitors actually receive.

HSTS

Once HTTPS works everywhere, send the Strict-Transport-Security header so browsers stop trying http at all:

Strict-Transport-Security: max-age=31536000; includeSubDomains

Start with a short max-age (for example 300 seconds) and raise it after confirming every subdomain serves HTTPS. includeSubDomains applies to all subdomains, including that old forgotten one on an internal tool. HSTS does not replace the 301: crawlers and first-time visitors still need the redirect.

Testing without fooling yourself

Browsers cache 301s aggressively, so testing in a browser after changing rules gives misleading results. Use curl and look at one hop at a time:

curl -sI http://example.com/pricing
curl -sI http://www.example.com/pricing
curl -sI https://example.com/pricing
curl -sI https://www.example.com/pricing

Without -L, curl does not follow the redirect, so each response shows the status line and the Location header. The first three should each return 301 with Location: https://www.example.com/pricing (or your main host). The fourth should return 200. To count hops end to end:

curl -s -o /dev/null -L --max-redirs 5 \
  -w '%{num_redirects} hops, final %{http_code} %{url_effective}\n' \
  http://example.com/pricing

Test a deep URL, not only the homepage: rules that work on / sometimes drop the path or the query string. Also test without -k so certificate problems show up as errors instead of being skipped.

Signals that must agree

• Canonical tags on every page use the main host and https (see canonical tags).
• Internal links, image URLs and the sitemap use the main host and https, so the site does not redirect its own links.
• Search Console has a Domain property, or a URL-prefix property for the exact main host.

What the DeskSEO checker reports

The free SEO checker requests the http and https versions, with and without www, and reports: http not redirecting with a 301, a 302 instead of a 301, both hosts returning 200 (duplicate host), a temporary www redirect, a chain of two or more hops, and certificate errors. Together these items carry 22 of the 100 points, because nothing else on the site matters if the main URL is not clean. Details of the weights are on how scoring works.