Direct answer: Across 25 sites, 17 http entries end on https and 8 stay on http; https is reachable on 21 (the other four failed: two connection failures, two certificate errors); final hosts are 19 www, 2 apex; only 4 send HSTS; only 9 declare a canonical — and all nine match the final host. Single request per entry, pilot.
This layer decides how many entries exist for the same content. If http and https, www and apex, with and without parameters all resolve without a canonical, link equity and crawling are split. Earlier rounds looked at page content and crawl policy; this one looks at the entry itself.
Method
For each site: request http://host/ and https://host/, follow redirects, record the final URL, status and hop count; then parse the first canonical and the Strict-Transport-Security header from the https homepage. UA LingyiResearchBot/1.0, two requests per site, six seconds apart, 20-second timeout.
| Metric | Rule |
|---|---|
| http→https | Final scheme of the http entry is https |
| Host consistent | Both entries end on the same host (port and case ignored, www kept) |
| www / apex | Whether the https final host starts with www. |
| HSTS | Strict-Transport-Security present on the https response |
| Canonical host match | Canonical host equals the https final host |
Result 1: upgrade, failure and coexistence
| Entry | Sites | Note |
|---|---|---|
| http ends on https | 17 / 25 | The common pattern |
| http stays on http | 8 / 25 | Three of them also serve https separately, so both entries exist |
| https reachable | 21 / 25 | All finals are https |
| https request failed | 4 / 25 | Two connection failures, two certificate errors |
The four https failures differ: two cannot connect even without certificate verification; two are certificate errors, one returning 403 when unverified and one returning 200 but landing back on http://. The last is an https-to-http downgrade, which is worse than a site that never offered https.
Result 2: hosts and HSTS
- 19 end on www, 2 on apex (hehaixny.com, cn-kede.com); no www↔apex redirect pair was observed.
- 21 sites end on the same host from both entries; the four failures cannot be compared.
- Only 4 send HSTS: most redirect, but do not tell the browser to remember https-only.
- Average 0.8 hops on the http entry; the longest needed two.
Result 3: few canonicals, but written correctly
| Canonical | Sites | Note |
|---|---|---|
| Declared | 9 / 25 | All absolute https URLs |
| Missing | 16 / 25 | Common on older templates |
| Host matches final | 9 / 9 | Everyone who wrote one wrote the host correctly |
| Host mismatch | 0 | — |
The counter-intuitive result: the problem is not wrong canonicals, it is missing ones. The 16 without one are not broken today, but parameterised links, extra domains or a redesign will leave them without a consolidation signal. Adding one line costs far less than cleaning up duplicates later.
Five actionable conclusions
- http should do one thing: 301 to https. Do not let http and https both serve.
- Never let https fall back to http. One certificate-error site did exactly that; fix it first.
- Pick one host. www or apex is fine, but the other should 301 across; the two apex sites here are worth a self-check.
- Add HSTS. At 4/25, most sites redirect but do not "remember".
- Add canonical. 16 missing, and the nine existing ones are all correct — a one-line template change.
Limits
- Single request: redirects and certificates may vary by CDN, region and WAF.
- Root path only: deep links, language directories and parameterised URLs are not covered.
- Limited certificate reading: only connection failure / certificate error / 200, no chain or expiry analysis.
- First canonical only: duplicates are not expanded.
- Non-random sample: 25 sites, a pilot.
Data and recalculation
Anonymised data: equipment-host-canonical-pilot-2026.csv (25 rows, 19 fields, with a notes column for the four https failures and one http 400). The repository keeps docs/research/2026-11-host-canonical-pilot.csv.
Parsing and verdicts: scripts/host_canonical_probe.py; tests: scripts/test_host_canonical_probe.py (17 tests, no network). Run:
python -m unittest scripts.test_host_canonical_probe
Related: the 30-site robots scan, the performance proxy pilot and the 12 acceptance clauses.
Sources and definitions
- HTTP status and redirects: RFC 9110: rfc-editor.org.
- HSTS: RFC 6797: rfc-editor.org.
- canonical: RFC 6596: rfc-editor.org.
- Capture: around 2026-11-02 04:10 Asia/Shanghai, UA
LingyiResearchBot/1.0, two requests per site, six seconds apart.