www and non-www redirect
What the other spelling of the host does. Serving the site at both www and the bare name puts every page at two addresses; a 301 to one of them settles it.
A site can usually be reached under two spellings of its host name: with www. and without. If both answer with the page, every URL exists twice. Links, shares and ranking signals are split between the two copies, analytics count them separately, and cookies set on one host are missing on the other.
How SiteScan checks it
The scanner takes the other spelling of the host you scanned and requests its HTTPS home page without following redirects. The row is labelled with that host name:
- green: it answers with a permanent redirect (301 or 308);
- amber “Serves content”: it answers 200 with the page itself, so the site is duplicated;
- amber with a status code: it redirects, but only temporarily (302 or 307).
If the other spelling does not exist in DNS, does not answer, or returns an error, the row is not shown — there is nothing to duplicate.
How to fix
Pick one host as canonical and permanently redirect the other to it, keeping the path: on nginx return 301 https://example.com$request_uri; in the server block for www.example.com. The certificate must cover both names, or the redirect itself fails with a warning. Make the canonical tags on the pages point to the same host.
See this check on your own site
Run a free scan: the report shows this row for your domain along with the other checks of the site audit.
More in “Addresses & redirects”
What SiteScan checks
TLS certificate
- TLS certificate expiry
- Outdated TLS versions (TLS 1.0/1.1)
- TLS certificate chain
- TLS certificate issuer
- Certificate signature algorithm
Domain registration
- Domain registration expiry
- Registered domain name
- Domain registrar
- Domain registration date
- Domain last updated date
- Domain status codes (EPP)
- Domain transfer lock
- Registrar abuse contact
- RDAP and WHOIS data source
Indexing
- robots.txt file
- CSS and JS blocked in robots.txt
- XML sitemap
- Sitemap index file
- Off-domain URLs in the sitemap
- Sitemap lastmod dates
- Broken URLs in the sitemap
- RSS and Atom feed
Addresses & redirects
Security headers
- HTTP security headers and grade
- Strict-Transport-Security (HSTS) header
- Content-Security-Policy (CSP) header
- X-Content-Type-Options: nosniff
- X-Frame-Options and clickjacking
- Referrer-Policy header
- Permissions-Policy header
- HSTS preload list
- CORS and cross-origin reads
- HTTP TRACE method
Delivery & reputation
- Cache-Control header for HTML
- ETag and Last-Modified revalidation
- HTTP/3 and QUIC support
- Server version disclosure in headers
- DNS blocklist (DNSBL) check
Internal links
Exposure
- Exposed sensitive files (.env, .git, backups)
- Directory listing enabled
- Public JavaScript source maps
- Exposed WordPress endpoints
Well-known files
- security.txt file
- llms.txt for AI assistants
- llms-full.txt file
- ads.txt authorized sellers file
- humans.txt file
- Well-known change-password URL
DNS & email
- MX records (mail servers)
- SPF record
- DMARC record and policy
- DNSSEC signing
- CAA record
- Nameserver redundancy
- IPv6 support (AAAA record)
- MTA-STS policy
- TLS-RPT reporting record
- BIMI record (brand logo in email)
- Wildcard DNS record
- Dangling CNAME and subdomain takeover
Privacy & consent
- Analytics and tracking scripts
- Cookie consent banner
- Privacy policy link
- Terms of service link
- Imprint (Impressum)
- Accessibility statement
Core Web Vitals
- Lighthouse performance score
- Largest Contentful Paint (LCP)
- Cumulative Layout Shift (CLS)
- Interaction to Next Paint (INP)
- CrUX field data vs lab data