Every page canonicaled to the homepage. A script did it on a delay.

Every page canonicaled to the homepage. A script did it on a delay.

A recipe site lost 52% of organic traffic over six weeks after a CMS upgrade. No redesign, no content change. Rankings just evaporated, replaced by the homepage outranking its own articles for long-tail queries.

View source showed correct self-referential canonicals. So why was Google treating 9,000 recipes as duplicates of the homepage?

I inspected the rendered DOM in URL Inspection. There were two canonical tags. The server-rendered correct one — and a second one, injected later by an analytics-adjacent script that 'normalized' canonicals to the root domain. Last tag wins in Google's parsing. The script's homepage canonical won.

The smoking gun: it only appeared in the rendered HTML, never the raw source. Classic JS-injected SEO sabotage, shipped by a third-party tag nobody audited.

We killed the script. One canonical, server-rendered, correct.

Google reprocessed canonicals over four weeks. Indexed recipe pages went from 'duplicate, Google chose different canonical' back to canonical-self. Organic recovered from -52% to +8% versus pre-incident in nine weeks.

Raw source and rendered DOM disagreed. The crawler only cares about the second one.