Safety
www vs Apex Canonical Host for HTTPS Marketing Sites
July 27, 2026
www vs apex canonical host for HTTPS marketing sites is a single-source-of-truth decision, not a branding argument. Choose example.com or www.example.com, serve TLS on both if you must, and 301/308 the loser to the winner on HTTPS. Cookies, HSTS, canonical tags, sitemaps, and ads should name that winner. Two live hosts with different headers is how sessions split and HSTS includeSubDomains surprises you. RoastMyOpsec follows a bounded public redirect chain from the URL you submit. It does not hijack DNS or test Host-header tricks.
The practical difference
The apex is the bare domain. www is a hostname that is usually a CNAME to the CDN. Either can be canonical. The miss is serving both as first-class sites with different CSP, cookies, or certificates.
Redirects must land on HTTPS. An HTTP apex that hops to HTTPS www is fine if the chain is short and the final host is the one in Search Console. A loop or a hop to a different registrable domain is a different finding — see open redirects.
How to choose based on the stack
CDN in front: many teams canonical to www because the apex cannot CNAME at some DNS hosts (unless ALIAS/ANAME). Apex-first shops use ALIAS to the same edge. Pick one, document it, match the cert SANs (apex + www), then turn on HSTS on the canonical host. includeSubDomains only if every subdomain is ready — www is a subdomain of the apex; the apex is not a subdomain of www.
| Setup | What users type | What must be true | Takeaway |
|---|---|---|---|
| Canonical www | example.com → https://www… | Apex cert + redirect; cookies not Domain=.example.com unless you mean it | Common with CDN CNAME |
| Canonical apex | www → https://example.com | www cert + redirect; HSTS on apex covers www only with includeSubDomains | Fine if DNS ALIAS works |
| Both live, no redirect | Either | Two costumes | Fix this week |
| HTTP canonical, HTTPS extra | Either | Cleartext first hop | See HSTS vs redirect |
What the roast can see
The submitted URL's redirect chain and whether the destination is HTTPS. Scan the host you actually advertise — and once more on the other hostname if both still answer. Cookie flags are graded on the landing Set-Cookie, which may be the canonical host only.
Common mistakes
The first mistake is HSTS on www only while the apex still speaks HTTP.
The second mistake is Set-Cookie Domain=.example.com while you thought sessions were www-only.
The third mistake is sitemap and ads still listing the non-canonical host.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Is www more secure than the apex?
- No. Security is TLS, HSTS, cookies, and one canonical host. www vs apex is operations, not a strength ranking.
- Should I scan both www and the apex?
- If both still return 200 without redirecting, yes — they are two public costumes. After a clean redirect, scanning the canonical URL is enough for headers.
- Does RoastMyOpsec pick my canonical host for me?
- No. It audits the URL you paste and follows bounded redirects. You choose the winner in DNS and the CDN.