I created a website having user-registration system and invited my friend to join it. I gave him the link of no-www version: http://mydomain.com but now after reading this and this, I want to shift to www.mydomain.com.

But there's a problem. I saw that my browser is storing separate passwords for mydomain.com and www.mydomain.com. So in my friend's browser his password must have been stored for no-www. That means after I shift to www and next time he opens the login page, his browser wouldn't auto-fill the username and password fields and there will also be an extra entry (of no-www) in his browser's database of stored passwords.

Can this be avoided? Can I do something that will convey to browsers that www.mydomain.com and mydomain.com are the same website? I already have a CNAME record for www pointing to mydomain.com but it seems that search engines consider CNAME as alias but browsers consider them as different websites, I don't know why.

1 Answer 1


This is a limitation of the browser software and not that of your website, a browser will store passwords for an exact match URL which means if they visit the www site then that's where the password will be saved for, this is the same case for 'most' cookie based sessions.

Enforcing www

You can prevent this problem reoccurring by enforcing www in the URL address, this means no one will ever be able to visit the site without www and if they do it will redirect them to the correct address - meaning that saved passwords and sessions based cookies will be saved only for the correct URL preventing any problems.

There are many ways of how you can enforce www and this is one common solution using Apache with mod_rewrite:

SOURCE: What are the most commonly used and basic Apache htaccess redirects

Catch all and redirect non-www to www

You should opt to use mod_write for redirecting all requests for non www versions of your site because the $1 varible will catch page names, so example.com/page1/ will automaticly redirect to www.example.com/page1/.


RewriteEngine On
RewriteCond %{HTTP_HOST} !^www\. RewriteRule ^(.*)$
http://www.%{HTTP_HOST}/$1 [R=301,L]

People with saved passwords

You may find that you have to ask your site visits to clear their saved cookies and forms within the browser they are using should any further problems occur.

  • Thanks. By saved passwords I meant the new feature of browsers to permanently save password ("Do you want to save password for this site?"). I realize I wasn't clear. It seems the best solution possible is to convey to the users that the website now is on www.
    – gom
    Jun 30, 2013 at 18:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.