Google is indexing urls from another site hosted on the same VPS

Question

We have a VPS hosting 2 websites. WebsiteA.com has SSL.

WebsiteB.com doesn't have SSL but google indexes WebsiteB.com with HTTPS URLS from WebsiteA.com

Example: https://www.websiteB.com/url-from-website-A which of course doesn't exist and gives error but google indexes it.

It's not just one URL that have been duplicated, it's every url from website A.

We suppose it has an impact on SEO (duplicate content somehow) because we lost ranking.

VPS misconfiguration ? We use Ubuntu / Apache.

<VirtualHost *:80>
  ServerName websiteA.com
  ServerAlias www.websiteA.com
  Redirect permanent / https://www.websiteA.com/
</VirtualHost>

<VirtualHost *:443>
  ServerName websiteA.com
  Redirect permanent / https://www.websiteA.com/
</VirtualHost>

<VirtualHost *:443>

  DocumentRoot /var/www/websiteA.com/public/
  ServerName www.websiteA.com

  php_flag display_errors On
  php_value memory_limit 256M
  php_value error_reporting 2047
  php_value post_max_size 32M
  php_value upload_max_filesize 32M

  <Directory /var/www/websiteA.com/>
    Require all granted
    AllowOverride All
    Options +FollowSymLinks
  </Directory>

  Include /etc/letsencrypt/options-ssl-apache.conf
  SSLCertificateFile /etc/letsencrypt/live/websiteA.com/fullchain.pem
  SSLCertificateKeyFile /etc/letsencrypt/live/websiteA.com/privkey.pem
</VirtualHost>

<VirtualHost *:80>

  DocumentRoot /var/www/websiteB.com
  ServerName websiteB.com
  ServerAlias www.websiteB.com

  <Directory /var/www/websiteB.com/>
    Require all granted
    AllowOverride All
    Options +FollowSymLinks
  </Directory>

</VirtualHost>

Answer 1

Well, the Apache has to serve something when someone accesses it via https://websiteB.com. So it uses the content it has, from websiteA.

This is explained in detail in the Apache documentation, here a quote from it:

Apache automatically discriminates on the basis of the HTTP Host header supplied by the client whenever the most specific match for an IP address and port combination is listed in multiple virtual hosts.

The ServerName directive may appear anywhere within the definition of a server. However, each appearance overrides the previous appearance (within that server). If no ServerName is specified, the server attempts to deduce it from the server's IP address.

The first name-based vhost in the configuration file for a given IP:port pair is significant because it is used for all requests received on that address and port for which no other vhost for that IP:port pair has a matching ServerName or ServerAlias. It is also used for all SSL connections if the server does not support Server Name Indication.

_{(highlighting by me)}

Add a VirtualHost for websiteB on Port 443 and point it to the correct document root. If you don't have a certificate for it use the certificate from websiteA. People visiting it will receive a warning about the invalid certificate, but they get that now anyway. At least they (and the search engines) get the correct content, if they choose to ignore the invalid certificate.

But with Let's Encrypt there is absolutely no reason not to provide a valid certificate nowadays.

Alternatively you could configure a redirect for https://websiteB requests to http, but visitors would still get the certificate warning before they are redirected. As I said, a Let's Encrypt certificate for websiteB would be the easiest solution, both for management and for your visitors.