Canonical URL — agent readiness

Why an agent cares

An agent that cannot tell which of several addresses is authoritative may cite, cache or link the wrong one. RFC 6596 permits far more than search engines honour, so most findings here are about what will be ignored rather than what is invalid.

Adoption

Web baseline. Standard equipment on the web. Its absence is the exception rather than its presence.

Direction of travel: ► flat, as at 2026-07-28.

RFC 6596, and two decades of CMS and SEO defaults. Absence is the exception, not the norm.

What we check

Absence is never a finding. Every check below runs only when this technology is detected, so a site that has not adopted this is not assessed on it and appears in no report. 5 of these 7 can fail it. In Lumar these appear on each page's own row.

Check	Severity	Raises	On whose authority
Canonical Outside Head	high	usability	vendor profile: Google Search: consolidate duplicate URLs
Supporting documents: Google Search: consolidate duplicate URLs Related guidance in Google Search: consolidate duplicate URLs. Bad: this canonical <link> sits outside the <head>, where Google and most consumers ignore it, so the declaration has no effect. Fix: move the <link rel="canonical"> tag into the document <head>.
Canonical Conflicting	high	usability	vendor profile: Google Search: consolidate duplicate URLs
Supporting documents: Google Search: consolidate duplicate URLs Related guidance in Google Search: consolidate duplicate URLs. Bad: the page declares more than one distinct canonical target (head tag vs Link header, or duplicate tags), so no single canonical wins and consumers may ignore them all. Fix: keep exactly one declaration pointing at one absolute URL; remove or align the extras.
Canonical Empty Href	medium	usability	vendor profile: WHATWG HTML — link types (rel=canonical), Google Search: consolidate duplicate URLs
Supporting documents: WHATWG HTML — link types (rel=canonical), Google Search: consolidate duplicate URLs Related guidance in WHATWG HTML — link types (rel=canonical) and Google Search: consolidate duplicate URLs. Bad: the canonical link's href is empty, so no canonical is actually declared and consumers fall back to guessing. Fix: set href to the page's full preferred URL, e.g. href="https://www.example.com/page".
Canonical Invalid URL	medium	usability	Lumar readiness bar, beyond The Canonical Link Relation
Supporting documents: The Canonical Link Relation Lumar readiness bar: no specification requires this. Bad: the canonical target isn't a usable http(s) URL (e.g. mailto:, data:, or malformed), so agents can't fetch the canonical resource. Fix: point the canonical at the page's full https URL.
Canonical Insecure URL	medium	usability, security (CWE-319)	Lumar readiness bar, beyond The Canonical Link Relation
Supporting documents: The Canonical Link Relation Lumar readiness bar: no specification requires this. Provisional security check; precision has not yet been measured. Bad: this https page names a plain http:// canonical, so agents and crawlers that follow it are sent to the unencrypted copy, where content can be altered in transit. A Lumar bar: RFC 6596 allows it. Fix: point the canonical at the https URL, e.g. https://example.com/page. An advertised HTTP destination permits unencrypted communication. OWASP API API8 (2023) — Security Misconfiguration ASVS V12.2.1 (5.0.0) — TLS for external HTTP services Only advertised transport configuration is observed; API deployment security is not fully assessed. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.
Canonical Relative	informational	nothing	specification: The Canonical Link Relation
Supporting documents: The Canonical Link Relation The Canonical Link Relation permits this, so it never fails the site. Informational (does not fail canonicalValid): the canonical href is relative. RFC 6596 permits it, but a relative href silently inherits base-URL and deployment mistakes, so Google recommends an absolute URL: href="https://www.example.com/page".
Canonical Cross-Origin	informational	nothing	specification: The Canonical Link Relation
Supporting documents: The Canonical Link Relation The Canonical Link Relation permits this, so it never fails the site. Informational (does not fail canonicalValid): the canonical resolves to a different origin, which RFC 6596 permits (syndication, migrations). Verify it's intentional; an unexpected cross-origin canonical hands this page's authority to another site.

Examples

Both run through the same checks as a live scan: the first passes, the second is flagged.

correcthtmlexcerpt

<link rel="canonical" href="https://example.com/discoverability/correct.html" />

present but wronghtmlexcerpt

<link rel="canonical" href="/discoverability/some-other-page.html" />

    <link rel="canonical" href="http://example.com/discoverability/issues.html?ref=dup" />

Specifications

Document	Revision	Kind
RFC 6596 — The Canonical Link Relation	Published RFC	specification
Google Search: consolidate duplicate URLs	Version of 10 July 2026	vendor profile
WHATWG HTML — link types (rel=canonical)	Living Standard	specification

Last re-read against the published documents: 2026-09-27.