| @@ -150,9 +150,11 @@ | ||
| 150 | 150 | * @param string $api_key Verification key. |
| 151 | 151 | * @return string Absolute key file URL. |
| 152 | 152 | */ |
| 153 | 153 | public static function key_location(string $api_key): string { |
| 154 | - return home_url('/' . $api_key . '.txt'); | |
| 154 | + // Matches the scheme the submitted URLs go out with, so IndexNow is | |
| 155 | + // never told to verify ownership at an address on the other scheme. | |
| 156 | + return Url_Scheme::apply(home_url('/' . $api_key . '.txt')); | |
| 155 | 157 | } |
| 156 | 158 | |
| 157 | 159 | /** |
| 158 | 160 | * Actively verify that the advertised keyLocation is reachable and returns |
| @@ -247,9 +249,9 @@ | ||
| 247 | 249 | } |
| 248 | 250 | |
| 249 | 251 | return sprintf( |
| 250 | 252 | /* translators: %d: HTTP status code returned by the key URL. */ |
| 251 | - __('The key file could not be verified (HTTP %d). Open it in a browser — it should show the key and nothing else.', 'thinkrank'), | |
| 253 | + __('The key file could not be verified (HTTP %d). Open it in a browser: it should show the key and nothing else.', 'thinkrank'), | |
| 252 | 254 | $code |
| 253 | 255 | ); |
| 254 | 256 | } |
| 255 | 257 | |
| @@ -523,8 +525,20 @@ | ||
| 523 | 525 | if (empty($urls)) { |
| 524 | 526 | return ['success' => false, 'message' => 'No URLs matched this site host', 'submitted_count' => 0]; |
| 525 | 527 | } |
| 526 | 528 | |
| 529 | + // Every submission path lands here, so this is where the site's scheme | |
| 530 | + // preference is applied (#638). Submitting http URLs for a site served | |
| 531 | + // over https asks search engines to index an address that redirects, | |
| 532 | + // and it is the canonical mismatch all over again in the one place a | |
| 533 | + // site owner cannot see it happening. | |
| 534 | + $urls = array_values(array_unique(array_map( | |
| 535 | + static function ($u): string { | |
| 536 | + return Url_Scheme::apply((string) $u); | |
| 537 | + }, | |
| 538 | + $urls | |
| 539 | + ))); | |
| 540 | + | |
| 527 | 541 | // Enforce the shared per-submission cap so every path (manual, bulk, MCP) |
| 528 | 542 | // behaves consistently. |
| 529 | 543 | if (count($urls) > self::MAX_URLS_PER_SUBMISSION) { |
| 530 | 544 | $urls = array_slice($urls, 0, self::MAX_URLS_PER_SUBMISSION); |
| @@ -573,9 +587,9 @@ | ||
| 573 | 587 | // actually means, and name the URL to check. |
| 574 | 588 | if ($response_code === 403) { |
| 575 | 589 | $response_message = sprintf( |
| 576 | 590 | /* translators: %s: public URL of the IndexNow key file. */ |
| 577 | - __('Key file could not be verified. Search engines must be able to read your key at %s — open it in a browser: it should show the key and nothing else.', 'thinkrank'), | |
| 591 | + __('Key file could not be verified. Search engines must be able to read your key at %s. Open it in a browser: it should show the key and nothing else.', 'thinkrank'), | |
| 578 | 592 | $key_location |
| 579 | 593 | ); |
| 580 | 594 | } |
| 581 | 595 | } |
