News
hreflang vs Canonical on Single-Language Public Sites
March 3, 2024
hreflang vs canonical on a single-language public site is an international-targeting decision versus a duplicate-URL decision: skip hreflang until you ship real language or region variants, and use canonical (plus 301s) for www, parameters, and copies. Fake hreflang clusters confuse crawlers and sometimes advertise locale hosts that are still staging. RoastMyOpsec does not score hreflang or canonical as standalone Fs.
The practical difference
rel=canonical says “this live URL is a duplicate of that preferred URL.” hreflang says “these URLs are alternate language or region versions of each other.” Google’s international docs require reciprocal annotations. A single-language brochure with hreflang="en" pointing at itself plus a phantom hreflang="de" 404 is noise.
Canonical is still useful on a one-locale site for query-string copies and CMS aliases. Hostname consolidation remains a 301. Mixing hreflang into that problem is how teams invent /de/ that noindex-fails while the sitemap lists it.
Locale subdomains are public origins. If de.example.com is not ready, do not advertise it in hreflang. That is inventory OPSEC, not a header finding.
How to choose based on what you shipped
One language, one host: no hreflang. Canonical self-tags optional; 301 the duplicate hosts. Multiple languages you actually serve: reciprocal hreflang, unique URLs, and canonicals that do not smash locales into one page. x-default is for a language chooser you really ship, not a decorative tag.
| Option | When it wins | Watch-out | Takeaway |
|---|---|---|---|
| No hreflang | You only publish one language | Copy-pasting hreflang from a tutorial | Default for single-language sites |
| rel=canonical | Duplicates exist on the same locale | Canonicalizing locales into one URL | Duplicates, not translations |
| hreflang cluster | You ship real localized URLs | One-way links and staging hosts in the cluster | Reciprocal and live only |
| 301 host consolidation | www, apex, or http should not linger | Using hreflang instead of a redirect | Move the host; do not annotate it |
When hreflang still wins
hreflang still wins the week you actually launch a second locale with crawlable pages and matching return tags. On a single-language site it does not win. Canonical still wins for true duplicates. Missing hreflang is the correct empty state.
Common mistakes
The first mistake is adding hreflang on a one-locale site because a checklist said so.
The second mistake is listing locale hosts in hreflang that are staging or unpublished.
The third mistake is using canonical to collapse different languages into one URL.
What a URL roast can prove
The free roast does not grade hreflang, canonical, JSON-LD, Open Graph, or RSS as standalone Fs. It does inspect security headers, TLS, cookies, .git/HEAD, .env, package.json signatures, and js-secrets on the URL you consented to scan. Keep locale inventory honest; do not advertise unfinished hosts in public annotations.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Do I need hreflang on an English-only site?
- No. Add it when you publish real alternate language or region URLs that return 200.
- Can hreflang replace canonical?
- No. They answer different questions. Translations are hreflang; duplicates are canonical or 301.
- Does RoastMyOpsec score hreflang?
- No. It is not a standalone F. Confirm clusters in Search Console if you ship them.