Best Practices Small

Fix HTTPS on your www/apex twin

People type a domain both with and without www. If the form you do not use has no valid certificate, their browser shows a security warning instead of your site. This check asks the www/apex twin of the scanned host for its root over HTTPS, once, and reports a failed TLS handshake or a rejected certificate. A twin that does not exist at all is not reported.

Find out whether your site has this problem, and every other check, in one free scan.

Check your site free

Why it matters

Visitors who type the other form of your domain get a browser security error instead of your site, and most will not try again.

How to fix

1 Add the twin (www.example.com or example.com) to your certificate or to your hosting platform's custom domains.
2 Redirect it permanently to your main domain once it serves HTTPS.
3 Open both forms in a browser and confirm each lands on your site with no warning.

Common mistakes

Getting a certificate for example.com but not www.example.com, or the other way round.
Pointing the twin's DNS at an old server that no longer has a valid certificate.
Redirecting the twin over plain HTTP only, so HTTPS requests to it still fail.

How to verify

1 Open https:// plus the twin in a browser and confirm it lands on your site with no warning.
2 Run curl -I against the twin over HTTPS and confirm it answers without a certificate error.

Ready to see where you stand?

Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.

Scan your site