| @@ -150,9 +150,11 @@ | ||
| 150 | 150 | * @param string $api_key Verification key. |
| 151 | 151 | * @return string Absolute key file URL. |
| 152 | 152 | */ |
| 153 | 153 | public static function key_location(string $api_key): string { |
| 154 | - return home_url('/' . $api_key . '.txt'); | |
| 154 | + // Matches the scheme the submitted URLs go out with, so IndexNow is | |
| 155 | + // never told to verify ownership at an address on the other scheme. | |
| 156 | + return Url_Scheme::apply(home_url('/' . $api_key . '.txt')); | |
| 155 | 157 | } |
| 156 | 158 | |
| 157 | 159 | /** |
| 158 | 160 | * Actively verify that the advertised keyLocation is reachable and returns |
| @@ -522,8 +524,20 @@ | ||
| 522 | 524 | })); |
| 523 | 525 | if (empty($urls)) { |
| 524 | 526 | return ['success' => false, 'message' => 'No URLs matched this site host', 'submitted_count' => 0]; |
| 525 | 527 | } |
| 528 | + | |
| 529 | + // Every submission path lands here, so this is where the site's scheme | |
| 530 | + // preference is applied (#638). Submitting http URLs for a site served | |
| 531 | + // over https asks search engines to index an address that redirects, | |
| 532 | + // and it is the canonical mismatch all over again in the one place a | |
| 533 | + // site owner cannot see it happening. | |
| 534 | + $urls = array_values(array_unique(array_map( | |
| 535 | + static function ($u): string { | |
| 536 | + return Url_Scheme::apply((string) $u); | |
| 537 | + }, | |
| 538 | + $urls | |
| 539 | + ))); | |
| 526 | 540 | |
| 527 | 541 | // Enforce the shared per-submission cap so every path (manual, bulk, MCP) |
| 528 | 542 | // behaves consistently. |
| 529 | 543 | if (count($urls) > self::MAX_URLS_PER_SUBMISSION) { |
