Your homepage has four addresses. Pick one.

Type your domain four ways: http://example.com, http://www.example.com, https://example.com and https://www.example.com. All four should end at the same URL, in one redirect, with your canonical tag agreeing. It takes five minutes to check, and it's worth it.

What goes wrong

• Chains. http://www redirects to https://www, which redirects to https://. Two hops where one would do. Google's crawler follows up to 10 redirect hops, so it gets there, but every hop is a wasted round trip for every visitor and crawler, and every old link pays it too.
• Two live versions. Both www and bare return 200 with the same content. Search engines pick one for you, and your links get split between them.
• Temporary redirects. A 302 says the move is temporary. Google's documentation treats a permanent redirect as a strong signal about which URL to keep, and a temporary one as a weak signal.
• A canonical that disagrees. The redirects land on https://example.com/, but the canonical tag says https://www.example.com/. Now your signals argue with each other.
• HTTPS gaps. No HSTS header, so a first visit can still start over plain http. Or mixed content: an https page that loads images or scripts over http.

Why it keeps happening

Redirects pile up over years. The host adds an https rule, a plugin adds a www rule, someone adds a CDN rule on top, and nobody tests all four starting points at once. Each rule works on its own, so nothing looks broken.

The fix

1. Pick the final address: with or without www, always https.
2. Send the other three straight there with a single 301 each.
3. Make every canonical tag, sitemap URL and internal link use the final address.
4. Add an HSTS header once https works everywhere.

The free HTTPS & Redirect Checker (my own product) tests all four versions at once and shows every hop, plus HSTS and mixed content.