Canonical Points to External URL: When to Fix It

TL;DR: Your page's canonical points at a URL on a different domain. That tells Google your page is a copy of someone else's page and the other site should get the index slot and the credit. If you syndicate content on purpose, that is correct. If you do not, this line is quietly handing your rankings to another domain — and sometimes it was put there by a hack, not by you.

What "canonical points to external URL" means

A canonical names the authoritative version of a page when several URLs hold the same content. When the href lives on a different registrable domain or subdomain than the page serving it, it is a cross-domain canonical. Your page is telling search engines "the real me is over there." Google obliges: it consolidates ranking and link signals onto the external URL and typically drops your page from the index. That is the tag working as designed — which is precisely why an unintended one is so damaging.

A real failing tag, and the fix

An article page that should own its own traffic, pointing off-domain:

<!-- On https://yoursite.com/blog/keyword-research/ -->
<link rel="canonical" href="https://medium.com/@someone/keyword-research-abc123" />

You just told Google the Medium repost is the master and yours is the duplicate. Your own post drops out; Medium keeps the ranking. Unless syndication was the deal, replace it with a self-referencing canonical:

<!-- On https://yoursite.com/blog/keyword-research/ -->
<link rel="canonical" href="https://yoursite.com/blog/keyword-research/" />

If you find external canonicals you never wrote — pointing at spammy or unrelated domains — treat it as a compromise. Someone injected them to steal your equity or to cloak. Audit for unexpected plugins and modified templates before you simply overwrite the tag.

Legitimate vs. harmful cross-domain canonical

How to detect it

1. Screaming Frog: in the Canonicals tab, add a filter comparing canonical host to page host, or use Reports > Canonicals > Canonicalised and scan the Canonical Link Element 1 column for any domain that is not yours. Configure a custom extraction if you want a clean "external canonical" list exported in one pass.
2. GSC URL Inspection: inspect the page and read "User-declared canonical." If it shows a hostname that is not your property, that is the external canonical confirmed. Pages affected this way often show "Duplicate, Google chose different canonical than user" or drop to "Excluded."
3. curl: curl -s https://yoursite.com/blog/keyword-research/ | grep -i 'rel="canonical"' — if the printed domain is anything other than yoursite.com, you have an off-domain canonical. Sweep the whole site by feeding a URL list through a loop.

How to fix it

1. Confirm intent. Is this a syndication arrangement you actually made? If yes and you are the syndicator, the partner should canonical to you; leave your own pages self-referencing.
2. For every unintended external canonical, set an absolute self-referencing canonical to your own URL.
3. If the target domain is unfamiliar or malicious, stop and treat it as a security incident: check for injected code, rogue admin users, and modified header.php or SEO-plugin settings before cleaning the tag.
4. Fix the source — a wrong site-URL setting, a migration leftover, or a template variable — so the tag renders correctly everywhere.
5. Re-crawl, then request re-indexing for the pages you rescued. Cross-check against Canonical Points to a Noindex URL, another contradiction that strands pages.

FAQ

Is a cross-domain canonical ever legitimate?

Yes. Google explicitly supports cross-domain canonicals for syndicated content: the site republishing your work can canonical back to your original so you keep the ranking. The direction matters — the copy points to the source, not the other way around.

My page canonicals to a site I have never heard of. What now?

Assume a compromise until proven otherwise. Injected external canonicals are a known black-hat tactic for siphoning authority. Audit the install, remove the injection at its source, then reset self-canonicals and rotate credentials.

Does an external canonical guarantee my page is deindexed?

Not guaranteed, but likely. Google treats it as a strong hint and usually consolidates onto the external URL, removing yours. It may occasionally ignore an obviously wrong one, but you should not gamble on that.

Should the canonical use the same protocol and www setting as the target?

Match the target's live, indexable version exactly — right protocol, right host, no redirect. A canonical that points at a URL which then redirects is a chain and dilutes the signal.

How do I keep syndication safe?

Get the arrangement in writing, make partners canonical to your original, and monitor with a scheduled crawl so a partner's template change never silently flips the direction. Background in Duplicate Content: Causes, Myths, and Fixes.

Related canonical checks: Canonical Points to a Different Internal URL · Canonical Points to the HTTP Version · Canonical Tags: The Complete Reference