Your homepage probably has eight addresses
Take three binary choices — http or https, www or bare, trailing slash or not — and you get eight distinct URLs that a browser will happily load and a crawler will happily treat as eight different pages. Add index.php or index.html, add a ?utm_source= from a newsletter, and the count keeps climbing.
Nobody built it on purpose. It's what a default server config does when nobody says otherwise. The damage is that links, crawl attention and ranking signals spread across copies instead of stacking on one page.
| Pattern | Typical cause | The fix |
|---|---|---|
| http and https both respond | SSL added, old protocol left listening | 301 every http request to https at the server or CDN |
| www and non-www both respond | DNS points both, no host rule | Pick one, 301 the other. Neither is better for SEO — just commit |
| Trailing slash and no slash both respond | Framework default, or two routes for one page | Pick one convention, 301 the other, use it in every internal link |
| Tracking and filter parameters | UTMs, gclid, fbclid, session IDs, sort and filter states | Self-referencing canonical on the clean URL; robots.txt for infinite filter combinations |
Redirects are rules. Canonicals are opinions.
This is the distinction that decides your fix order. A 301 removes the duplicate from existence — the server never serves it again, so nothing can link to it, crawl it or index it. A canonical tag leaves the duplicate fully live and politely asks Google to prefer another URL.
For protocol, host and trailing slash you want the rule, not the opinion. There is no legitimate reason for http://www.example.com/page/ to keep resolving. Kill it at the server, and read 301 redirect for how to avoid stacking these into chains — redirecting http→https→www→slash in four hops is a common and lazy result.
For parameters you're stuck with the opinion. You can't stop someone pasting your URL with a UTM attached, and you don't want to break the link when they do. So the parameterised URL keeps working, and a self-referencing canonical tag on the clean version tells Google which one to index.
- Server first. One protocol, one host, one slash convention. Test each variant with
curl -Iand confirm a single 301 to the survivor. - Internal links second. Every link in your nav, footer, sitemap and body copy points at the final URL. Linking to a URL that redirects works, but it wastes crawl and it's how chains get born.
- Canonical tags third. Self-referencing everywhere, pointed at the clean version, matching the URLs in your sitemap exactly.
Parameters, session IDs, and the ones that actually change the page
Not every parameter is noise. ?colour=black might genuinely change what's on the page; ?utm_campaign=diwali never does. The test is whether the content differs in a way a searcher would want separately.
Google retired the URL Parameters tool in Search Console in 2022, so you no longer get to tell Google to ignore a parameter — it works it out from what it sees. That puts the burden back on your configuration: canonical the noise parameters to the clean URL, and if a filter system can generate tens of thousands of combinations, block the pattern in robots.txt before it eats your crawl budget.
Session IDs in URLs are the worst version — every visitor generates a unique URL for the same page. That's a platform fix, not an SEO fix.
How split signals look in Search Console
You rarely see canonicalization problems as an error message. You see them as things quietly not working.
- Duplicate without user-selected canonical in the Page Indexing report — Google found copies and you didn't declare a preference.
- Duplicate, Google chose different canonical than user — you declared one and Google disagreed. Your other signals are contradicting your tag.
- Two of your own URLs appearing for the same query in the Performance report, each with a fraction of the impressions. That's one page's authority cut in half.
- Indexed page count higher than your published page count. If you have 180 pages and Google reports 420 indexed URLs, the extra 240 are variants.