Why it matters
Google watches for canonical hijacking, where several domains try to be canonical for the same content, including a site owner's own copies such as a staging site. A crawlable copy competes with production for canonical selection and can win.
How to meet it
Protect staging, preview and QA environments with HTTP authentication or an IP allowlist, since a 401 or 403 cannot be indexed, and add a site-wide noindex header as a second layer. Never launch with staging's blanket noindex or Disallow: / still in place, and never point production canonicals or hreflang at a staging host.
How to test it
curl -I on the staging host returns 401 or 403 without credentials; the pre-launch check confirms production has no global noindex and no Disallow: /.
How Regensbot covers it
Decided from one URL.
An audit reads the response, the headers, the HTML, robots.txt, the sitemaps and the structured data, and the finding shows the evidence it saw.
Sources
Google documents02
- 01Fix canonicalization issuesGoogle Search Central (opens in a new tab)
- 02What is canonicalizationGoogle Search Central (opens in a new tab)
Claims in the knowledge base02
- D2-C388ConsistentHandling web duplicationShown on screen
- D2-C387ConsistentHandling web duplicationShown on screen
Claim IDs refer to the Search Central Live 2026 knowledge base. The knowledge base (opens in a new tab)
- Consistent
- Google's documentation supports it without stating it.