We have a VPS hosting 2 websites. WebsiteA.com has SSL.

WebsiteB.com doesn't have SSL but google indexes WebsiteB.com with HTTPS URLS from WebsiteA.com

Example: https://www.websiteB.com/url-from-website-A which of course doesn't exist and gives error but google indexes it.

It's not just one URL that have been duplicated, it's every url from website A.

We suppose it has an impact on SEO (duplicate content somehow) because we lost ranking.

VPS misconfiguration ? We use Ubuntu / Apache.

<VirtualHost *:80>
  ServerName websiteA.com
  ServerAlias www.websiteA.com
  Redirect permanent / https://www.websiteA.com/

<VirtualHost *:443>
  ServerName websiteA.com
  Redirect permanent / https://www.websiteA.com/

<VirtualHost *:443>

  DocumentRoot /var/www/websiteA.com/public/
  ServerName www.websiteA.com

  php_flag display_errors On
  php_value memory_limit 256M
  php_value error_reporting 2047
  php_value post_max_size 32M
  php_value upload_max_filesize 32M

  <Directory /var/www/websiteA.com/>
    Require all granted
    AllowOverride All
    Options +FollowSymLinks

  Include /etc/letsencrypt/options-ssl-apache.conf
  SSLCertificateFile /etc/letsencrypt/live/websiteA.com/fullchain.pem
  SSLCertificateKeyFile /etc/letsencrypt/live/websiteA.com/privkey.pem

<VirtualHost *:80>

  DocumentRoot /var/www/websiteB.com
  ServerName websiteB.com
  ServerAlias www.websiteB.com

  <Directory /var/www/websiteB.com/>
    Require all granted
    AllowOverride All
    Options +FollowSymLinks

New contributor
Seb Fanals is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • 1
    Please post your VirtualHost configurations from your Apache config – Gerald Schneider May 16 at 8:52
  • I edited my post, thanks – Seb Fanals May 16 at 9:10

Well, the Apache has to serve something when someone accesses it via https://websiteB.com. So it uses the content it has, from websiteA.

This is explained in detail in the Apache documentation, here a quote from it:

Apache automatically discriminates on the basis of the HTTP Host header supplied by the client whenever the most specific match for an IP address and port combination is listed in multiple virtual hosts.

The ServerName directive may appear anywhere within the definition of a server. However, each appearance overrides the previous appearance (within that server). If no ServerName is specified, the server attempts to deduce it from the server's IP address.

The first name-based vhost in the configuration file for a given IP:port pair is significant because it is used for all requests received on that address and port for which no other vhost for that IP:port pair has a matching ServerName or ServerAlias. It is also used for all SSL connections if the server does not support Server Name Indication.

(highlighting by me)

Add a VirtualHost for websiteB on Port 443 and point it to the correct document root. If you don't have a certificate for it use the certificate from websiteA. People visiting it will receive a warning about the invalid certificate, but they get that now anyway. At least they (and the search engines) get the correct content, if they choose to ignore the invalid certificate.

But with Let's Encrypt there is absolutely no reason not to provide a valid certificate nowadays.

Alternatively you could configure a redirect for https://websiteB requests to http, but visitors would still get the certificate warning before they are redirected. As I said, a Let's Encrypt certificate for websiteB would be the easiest solution, both for management and for your visitors.

  • Yes exactly... so it means on shared hosting they automatically add an (invalid) SSL certificate to every website that doesn't use SSL ? Well then we will add SSL to websiteB. Can you edit your post please with "uses the content it has, from websiteA" so I can accept the answer. – Seb Fanals May 16 at 9:30
  • No. Apache tries to find a documentroot for the request. It takes the domain name, the port and the ip address of the server into account. since it can't find a combination of all three for https requests for websiteB it takes the one that matches most closely, which is your websiteA virtualhost. This is a pure Apache thing and has nothing to do with shared hosting. This behaviour is documented here: httpd.apache.org/docs/current/en/vhosts/details.html – Gerald Schneider May 16 at 9:34
  • I don't understand what you want me to add. – Gerald Schneider May 16 at 9:35
  • As you stated in the comment it takes the one that matches most closely, which is websiteA so can you change your original post to "So it uses the content it has, from websiteA" (not B) – Seb Fanals May 16 at 9:55
  • Oh, I didn't see I had a typo there. It's corrected. – Gerald Schneider May 16 at 9:57

Your Answer

Seb Fanals is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.