Canonical Points to External URL: When to Fix It

TL;DR: Your page's canonical points at a URL on a different domain. That tells Google your page is a copy of someone else's page and the other site should get the index slot and the credit. If you republish syndicated content on purpose, the intent is right, but Google recommends blocking indexing of the copy (noindex) rather than a cross-domain canonical. If you do not, this line is quietly handing your rankings to another domain — and sometimes it was put there by a hack, not by you.

What "canonical points to external URL" means

A canonical names the authoritative version of a page when several URLs hold the same content. When the href lives on a different registrable domain or subdomain than the page serving it, it is a cross-domain canonical. Your page is telling search engines "the real me is over there." Google obliges: it consolidates ranking and link signals onto the external URL and typically drops your page from the index. That is the tag working as designed — which is precisely why an unintended one is so damaging.

A real failing tag, and the fix

An article page that should own its own traffic, pointing off-domain:

<!-- On https://yoursite.com/blog/keyword-research/ -->
<link rel="canonical" href="https://medium.com/@someone/keyword-research-abc123" />

You just told Google the Medium repost is the master and yours is the duplicate. Your own post drops out; Medium keeps the ranking. Unless syndication was the deal, replace it with a self-referencing canonical:

<!-- On https://yoursite.com/blog/keyword-research/ -->
<link rel="canonical" href="https://yoursite.com/blog/keyword-research/" />

If you find external canonicals you never wrote — pointing at spammy or unrelated domains — treat it as a compromise. Someone injected them to steal your equity or to cloak. Audit for unexpected plugins and modified templates before you simply overwrite the tag.

Legitimate vs. harmful cross-domain canonical

How to detect it

1. Screaming Frog: in the Canonicals tab, add a filter comparing canonical host to page host, or use Reports > Canonicals > Canonicalised and scan the Canonical Link Element 1 column for any domain that is not yours. Configure a custom extraction if you want a clean "external canonical" list exported in one pass.
2. GSC URL Inspection: inspect the page and read "User-declared canonical." If it shows a hostname that is not your property, that is the external canonical confirmed. Pages affected this way often show "Duplicate, Google chose different canonical than user" or drop to "Excluded."
3. curl: curl -s https://yoursite.com/blog/keyword-research/ | grep -i 'rel="canonical"' — if the printed domain is anything other than yoursite.com, you have an off-domain canonical. Sweep the whole site by feeding a URL list through a loop.

How to fix it

1. Confirm intent. Is this a syndication arrangement you actually made? If yes and you are the syndicator, ask the partner to noindex its copy and link back to you, since Google does not recommend a canonical for syndicated copies; leave your own pages self-referencing.
2. For every unintended external canonical, set an absolute self-referencing canonical to your own URL.
3. If the target domain is unfamiliar or malicious, stop and treat it as a security incident: check for injected code, rogue admin users, and modified header.php or SEO-plugin settings before cleaning the tag.
4. Fix the source — a wrong site-URL setting, a migration leftover, or a template variable — so the tag renders correctly everywhere.
5. Re-crawl, then request re-indexing for the pages you rescued. Cross-check against Canonical Points to a Noindex URL, another contradiction that strands pages.

FAQ

Is a cross-domain canonical ever legitimate?

Yes, for duplicates across domains you control. For syndicated content Google does not recommend it: the site republishing your work should block indexing of its copy (noindex) and link back to your original so you keep the ranking. The direction matters — the copy points to the source, not the other way around.

My page canonicals to a site I have never heard of. What now?

Assume a compromise until proven otherwise. Injected external canonicals are a known black-hat tactic for siphoning authority. Audit the install, remove the injection at its source, then reset self-canonicals and rotate credentials.

Does an external canonical guarantee my page is deindexed?

Not guaranteed, but likely. Google treats it as a strong hint and usually consolidates onto the external URL, removing yours. It may occasionally ignore an obviously wrong one, but you should not gamble on that.

Should the canonical use the same protocol and www setting as the target?

Match the target's live, indexable version exactly — right protocol, right host, no redirect. A canonical that points at a URL which then redirects is a chain and dilutes the signal.

How do I keep syndication safe?

Get the arrangement in writing, have partners noindex their copy and link to your original, and monitor with a scheduled crawl so a partner's template change never silently flips the direction. Background in Duplicate Content: Causes, Myths, and Fixes.

Related canonical checks: Canonical Points to a Different Internal URL · Canonical Points to the HTTP Version · Canonical Tags: The Complete Reference