Canonical Tag and Canonical URL: How Google Really Decides

On 23 September 2026 I checked all 224 URLs from the sitemaps of seo-kreativ.de. For each URL I compared which canonical the page declares and which URL Google chose as canonical. The result is unspectacular: not a single deviation. That is exactly the point. All signals say the same thing here. Google chooses the same URL. Where the signals contradict each other, Google decides for itself.

That is what this article is about. The canonical tag is not a switch but a request. Google writes in its documentation on canonicalization: “indicating a canonical preference is a hint, not a rule.” When Google follows the request, when it doesn’t and how you can tell is what I show here. Plus a look at the dark side: canonicals that point to other domains because someone injected them.

A canonical tag is a link element in the <head> of a page. The same declaration can also be sent as an HTTP header, more on that below. It points to the URL you want to set as the main version of a piece of content, the canonical URL:

<link rel="canonical" href="https://www.example.com/shoes/sneakers/" />

It becomes necessary because the same content is often available under several addresses: with and without www, via HTTP and HTTPS, with sorting or tracking parameters, as a print version or via several category paths. Google groups such pages and picks one of them as the canonical URL. According to Google, this page is “the main source to evaluate content and quality”. According to Google, it is crawled most regularly, the duplicates less often.

Duplicate content is not a flaw in itself. Google writes: “Some duplicate content on a site is normal and it’s not a violation of Google’s spam policies.” The canonical just helps Google show the version you want to show.

In its guide to consolidating duplicate URLs, Google orders the methods by how strongly they can influence the choice:

Google adds: “these methods can stack and thus become more effective when combined.” If the canonical, the sitemap and internal links point to the same URL, the chance that Google adopts it goes up. According to Google, other factors are HTTPS over HTTP and URLs in hreflang clusters. None of the methods is required: without any declaration Google chooses by itself, and according to Google a site will likely do just fine that way.

How many signals count in total was estimated by Google engineer Allan Scott in December 2024 on the “Search Off the Record” podcast. The official transcript has: “I suspect it’s somewhere in the neighborhood of 40.” That is not a published list of signals. And when signals conflict, for example a redirect in one direction and a canonical in the other, the system falls back on weaker signals.

The following cases are in Google’s documentation and help:

• The target page is not similar. The Page indexing report help says: “If the user-declared canonical is not similar to the current page, then Google won’t ever choose that URL as canonical.” If you point every article in a category to the category page, you won’t get what you want.
• The signals conflict. Canonical to A, internal links and sitemap to B: then, according to Google, other signals decide. Google explicitly advises against specifying different URLs for the same page with different methods.
• The canonical is not in the head. According to the documentation, Google only accepts the element in the <head>. That is why Google tells you to make sure at least the head is valid HTML. Under the rules of the HTML standard, an invalid element can end the head early. A canonical after it then lands in the body. How that happens is shown in my article on HTML parsing and SEO.
• There are several canonicals. According to Google this “may lead to unexpected results”. It happens, for example, when a theme and an SEO plugin both output a canonical.
• The canonical carries an hreflang, lang, media or type attribute. According to the documentation, Google does not use such annotations for canonicalization.

In the HTML

Google recommends absolute rather than relative URLs. Relative paths work, but according to Google they can cause problems in the long run, for example if a test environment is crawled by accident. Since July 2026 Google also explicitly recommends setting the canonical on the canonical page itself, as a self-referencing canonical. On WordPress, SEO plugins such as Yoast set it automatically by default, according to the vendor.

Also watch the exact spelling. Google’s John Mueller wrote on Reddit in October 2025, as reported by Search Engine Journal: “URL path, filename, and query parameters are case-sensitive, the hostname / domain name aren’t. Case-sensitivity matters for canonicalization, so it’s a good idea to be consistent there.” A canonical to /Price-List/ therefore names a different URL than /price-list/.

In the HTTP header, for example for PDFs

For documents without an HTML head, such as PDF files, you can send the canonical as an HTTP header. According to the documentation, Google supports this for web search. An example for Apache:

<Files "price-list.pdf">
  Header add Link "<https://www.example.com/price-list/>; rel=\"canonical\""
</Files>

The response then contains a line Link: <https://www.example.com/price-list/>; rel="canonical". You can check this with curl -I on the PDF URL.

Via JavaScript

Google writes in its JavaScript SEO documentation: the best place for the canonical is the HTML. If a script sets it in addition, Google says to keep the value the same as in the HTML. If it isn’t possible in the HTML at all, you can set it via JavaScript and leave it out of the original HTML. If a script sets a second, different canonical, you get exactly the conflict from the previous section. More in my guide to JavaScript SEO and rendering.

With hreflang

On multilingual sites, the canonical points to the page in the same language, not to the main language. Google writes: “make sure to specify a canonical page in the same language, or the best possible substitute language”. What else goes wrong is covered in my article on hreflang.

The basics of noindex and robots.txt are in my guide to crawling and indexing. How much crawl budget duplicates cost on large sites is shown in Optimize crawl budget.

The Page indexing report contains three messages related to the canonical:

For the third message, open URL Inspection and compare the user-declared with the Google-selected canonical under “Page indexing”. Google names two limits: the live test “cannot predict whether or not the tested version will be considered canonical”, and the value shown “can be a few hours out of date” from the index.

If Google shows a URL you don’t want, this is how I proceed: first check whether the two pages really should be the same. If yes, align all signals with the preferred URL, meaning canonical, internal links, sitemap and a redirect where appropriate. If no, make the content clearly different. According to Google, a page may then stay in the duplicate cluster for up to two weeks.

How often Google follows a declared canonical isn’t in any documentation. That is why I measured it for my own website. The basis was all 224 URLs from the post and page sitemaps, 113 in German and 111 in English. For each URL I fetched the delivered HTML and looked for a canonical in the head, in the body and in the HTTP header. That was a plain HTTP fetch without JavaScript rendering. I did not follow redirects, all URLs answered directly. Then I queried the Search Console URL Inspection API for the canonical Google detected and the one it chose. The fields evaluated are userCanonical and googleCanonical of the URL-prefix property. I compared the URLs as strings, ignoring only a trailing slash. The last query ran on 23 September 2026 at 20:17 CEST.

Four URLs appear in Search Console as crawled but currently not indexed. The data gives no indication that Google treats them as duplicates of another URL. For three of them Google chose the declared URL itself as canonical, so it did not classify the page as a duplicate of another one. For the English contact page the API response contains no value in the googleCanonical field. Why Google doesn’t index these pages, the status doesn’t say.

The measurement shows agreement, not cause. It also has clear limits. It only covers URLs listed in the sitemaps. I did not check parameter variants, pagination or tag archives, and that is where duplicates arise. On a website with 224 URLs and a plugin that sets the canonical consistently, 223 matches out of 223 are no great feat. A shop with filter URLs looks different. So what transfers is not the rate but the method: put the declared and the chosen canonical side by side for your most important URLs.

Several guides still recommend a canonical from the partner to the original for syndicated content. Google now sees it differently. Its troubleshooting guide says: “The canonical link element is not recommended for those who want to avoid duplication by syndication partners, because the pages are often very different. The most effective solution is for partners to block indexing of your content.”

The reason is in the sentence: the partner’s page has a different layout, different navigation and different content around it. It is often not similar enough to the original, and Google doesn’t adopt a canonical to a dissimilar page. If you pass on content, agree on the noindex requirement explicitly with the partner. After that, it’s worth checking that it has actually been implemented.

That it can work anyway is shown by a case of my own. Medium lets you set a canonical to the original for republished texts. The English version of my article on parasite SEO has been on Medium since April 2026, with a canonical to the original. On 24 September 2026 I checked: Medium serves the copy with index,follow. All links in the text carry ugc nofollow. For the search “parasite seo 2026” in the US, my original ranks at position 10. The Medium copy does not appear among the first eleven results. That is consistent with Google following the canonical. It is not proof: rankings have many causes, and URL Inspection only shows your own websites.

If Google follows the canonical, it consolidates the signals of the individual URLs, according to Google “such as links to them”, for example links to exactly this copy. It says nothing about a bonus for the whole platform. How this affects rankings can’t be derived from a single post. In my view, the real benefit lies with the readers on Medium.

What Google documents

In its guide to troubleshooting canonicalization, Google describes three cases in which a foreign domain may be chosen as canonical:

• Hack: “Some attacks on websites introduce code that returns an HTTP 3xx redirect or inserts a cross-domain rel=”canonical” link annotation into the HTML <head> or HTTP header, usually pointing to a URL hosting malicious or spammy content.” Google adds that its algorithms may then choose the malicious URL instead of the URL on the compromised website.
• Copy without permission: “In rare situations, our algorithm may select a URL from an external site that is hosting your content without your permission.” Google then refers to the host of the copy or a request under the US copyright law DMCA.
• Misconfigured servers: a server may serve content from another domain, or two unrelated servers return identical soft 404 pages that Google fails to identify as error pages.

Allan Scott of Google said about such cases in December 2024 on the “Search Off the Record” podcast: “The most dire case being a hijacking, we see those and we act really fast because those are just disasters.”

Not every foreign domain in that field is an attack. In September 2026, Search Engine Journal reported on a website for which Google showed an unrelated casino URL as canonical. One explanation offered was an error page that Googlebot had received instead of the content. Identical error pages from different websites then end up in the same duplicate cluster. John Mueller considered that possible and wrote: “Ultimately I don’t think this matters (though yes, it’s confusing).” In every case, he said, the page does not show in Search with its normal content. His advice: find the error and check important pages automatically on a schedule. The canonical itself is a side issue here.

What is not documented

In 2018 the trade press described another variant: an attacker copies the head of your page onto a spam page and sets a canonical there pointing to your URL. Google would then merge the two, and your page would suffer. Search Engine Journal itself wrote that the attack had been observed but not tested and verified. I found no documented case in which that shifted rankings. According to Search Engine Roundtable, John Mueller contradicted the assumption in 2018 that a canonical merges pages: “it’s either one or the other.” My reading: a canonical on someone else’s website is not a documented way to force Google’s choice for your URL. It becomes dangerous when it sits on your own page, in the HTML or the HTTP header. That is exactly why the hack is the dangerous case.

How to check your site

• Look at the Google-selected canonical in URL Inspection for your important pages. A foreign domain in that field is an alarm signal.
• Check the delivered head and the HTTP headers, not just the backend. curl -sI https://your-site.com/ shows a canonical in the Link header, the page source shows the one in the HTML.
• Look for signs of hacked content in the Security issues report in Search Console.
• For a copy without permission, contact the host or take the copyright route Google names.

Parasite SEO, on the other hand, is not a canonical trick. Google’s spam policies mean content that appears on another website “mainly because of that host’s already-established ranking signals”. In my view, a canonical therefore doesn’t fit that logic: it is meant to keep the copy on the host from standing as a search result of its own. This has little to do with spam backlinks. How I handle those is covered in my article on spam backlinks and negative SEO.

The canonical tag works well as long as everything else says the same thing. Things get difficult when plugins, redirects and internal links point in different directions. Search Console tells you where Google decided differently. For syndication, noindex on the partner’s side helps more today than a canonical, and a foreign domain as the Google-selected canonical is a reason for a security check.