If your med spa website opens at yourclinic.com but shows an error or a security warning at www.yourclinic.com, or the other way round, every patient who types the other version hits a dead end. On September 27, 2026 we loaded both addresses for 393 med spa homepages in 21 US cities. 382 worked either way. Ten had one address that failed, and in all ten it was the www version. When we re-tested those ten on October 26, five now forwarded correctly, four still failed in a browser, and one blocked automated checks so we couldn't tell.
What we found on 393 med spa websites
The sites are the same Google-search sample behind our 389-site grading study: clinics that showed up for searches like "botox Miami" or "med spa Denver". For each one, an automated check loaded the main address and the other version (with or without www) and recorded what came back.
- 382 sites (97%) loaded at both addresses, usually with one forwarding to the other.
- 10 sites failed on the www version. Three had no DNS record for www at all. Seven answered with an error.
- 1 site didn't answer the second check either way, so it isn't counted.
- All 393 loaded over HTTPS at their main address.
Ten out of 393 is a small share, but for those ten clinics the problem is total: anyone who reaches them through the www address sees no website at all. A month later we tested the ten again:
- 5 now forward www to the main address correctly. Either someone fixed it, or the failure on September 27 was temporary.
- 2 serve a security certificate that doesn't include the www name, so Chrome shows "Your connection is not private".
- 1 serves an expired certificate on www, with the same warning.
- 1 still has no DNS record for www, so the browser says the site can't be reached.
- 1 blocks automated requests, so we couldn't confirm either way.
Why both addresses have to work
You don't control which version people use. A business card printed years ago, an old directory listing, a local magazine's write-up, a patient texting your link to a friend: each one uses whatever the person typed. If that version fails, the visit ends on an error page, and a patient who sees a security warning on a medical website is unlikely to click past it.
Google also cares which one is the main address. When both versions show the same page without a redirect, Google treats them as duplicates and picks one itself. Its guide to consolidating duplicate URLs recommends a permanent redirect from the version you don't want to the one you do. Our homepage SEO basics study covers the other signals from the same sample.
The three causes, in plain terms
- No DNS record for www. DNS is the address book that tells browsers where your site lives. Each name needs its own entry, and if www was never added, browsers can't find it. This tends to happen after a move to a new platform, when the bare domain gets set up and www is forgotten.
- A certificate that doesn't cover www. The security certificate behind the padlock lists the exact names it is valid for. If it was issued for yourclinic.com only, a visit to www.yourclinic.com stops at a warning page before your site loads. Chrome labels this NET::ERR_CERT_COMMON_NAME_INVALID.
- An expired certificate on one name. The main address renews automatically, but www sits on a separate certificate or server setting that didn't. Chrome labels this NET::ERR_CERT_DATE_INVALID.
In the October re-test, three of the four sites still failing had a certificate problem rather than a missing record. Those are the harder ones to spot, because the site looks fine to the owner, who always types the main address.
How to check yours in two minutes
- On your phone, type www.yourclinic.com into the browser and load it.
- Then type yourclinic.com without the www.
- Both should end on the same address, with the padlock showing and your homepage loaded.
- If either one shows "Your connection is not private", "This site can't be reached" or a hosting company's default page, you have the problem.
Our free website grader tests the other version automatically as part of its checks, and tells you whether it failed on DNS or with an error.
How to fix it
- Missing DNS record: log in wherever your domain's DNS is managed (often the registrar, or Cloudflare) and add the www record your website platform asks for, usually a CNAME. Squarespace, Wix, Showit and WordPress hosts each list the exact value on their domain-connection page.
- Certificate that skips www: most platforms issue a free certificate automatically once both names point at them. On a traditional host, ask support to re-issue the certificate for both names.
- Expired certificate: the same fix. Ask the host why automatic renewal stopped for that name, so it doesn't happen again next year.
- Redirect: in your platform's domain settings, choose the main version and make sure the other forwards to it with a 301.
Once both work, update your Google Business Profile, Instagram bio and directory listings to the main version, so patients skip the redirect. If you are planning a move to a new platform, put this on the launch-day list; our redesign guide covers the rest of a move that keeps your rankings.
Where to start
Run your site through the free grader to check both addresses, your certificate and more than a dozen other basics in about 30 seconds. If you'd like a person to look at everything, request a free audit and we'll email the top fixes, no call needed. And if you're moving platforms anyway, our med spa web development includes the DNS, certificate and redirect setup for both addresses.