Google rarely penalises duplicate content — what it does is worse in a quieter way: it splits your ranking signals across copies and picks which version to show, often not the one you wanted. WordPress produces duplicates naturally, so every site needs the same short audit.
1. Know where duplicates come from
- Protocol and host splits — http vs https, www vs bare domain, all serving the same pages.
- Archives — a post appears on the blog page, category, tag, date and author archives.
- Parameters — ?utm_source=…, ?replytocom=…, filter and sort strings on shop pages.
- Copies of the whole site — indexed staging or dev subdomains.
2. Use the right fix for each case
Three tools, three jobs. A 301 redirect when a URL should not exist separately at all (http→https, www decision, retired pages). A canonical tag when variants must keep working — parameterised URLs, printable versions — but one URL should get the credit. A noindex for pages that must exist for users but offer search nothing: thin archives, internal search results.
3. Find what is actually duplicated
Search Console → Indexing report: “Duplicate without user-selected canonical” and “Alternate page with proper canonical tag” list your duplicates by URL. A site:yourdomain.com search shows surprises fast — including whether a staging copy is indexed. If it is, that is the emergency: noindex it, gate it behind auth, and remove it from the index before it outranks the real site for your own brand.
4. The WooCommerce special case
Layered navigation creates endless filter/sort URL combinations of the same category. Canonical each filtered view to the base category, and keep faceted parameters out of the sitemap. Product variations rarely need separate indexable URLs — one strong product page beats twelve near-identical ones.
5. Prevent it going forward
A modern SEO plugin defaults most of this correctly — self-canonicals, sensible archive handling. Your job is the site-level discipline: one canonical host and scheme enforced by redirect, staging always noindexed and password-protected, and a quarterly glance at the Indexing report to catch anything new.