Three CMS Platforms Still Ship Without Canonical Tags — 16 Years After Launch

Three content management systems this year required a developer to implement canonical tags — a markup format Google, Microsoft, and Yahoo jointly announced in 2009. Sally Mills, an in-house SEO, consultant, and web developer writing for Search Engine Journal, calls that failure emblemomatic of an industry stuck on repeat, submitting the same fix tickets again and again.

Her piece, "The 11 SEO Features Every CMS Should Ship With (Most Still Don't)," lays out a baseline checklist and a set of above-and-beyond features. She names specific platform gaps throughout, based on platforms she has worked on directly.

Which platform gaps did Mills document?

The failures she cites are concrete:

• Webflow: She had to hardcode HTML tables into pages because the editor lacks built-in table support.
• WordPress: No out-of-the-box robots.txt editing, no sitemap page exclusion, no per-page noindex — gaps that push users toward bloated SEO plugins.
• Shopify: Sitemaps cannot exclude pages when additional markets are used, because sitemaps "are generated automatically and include all market-specific URLs." Shopify also won't redirect to remove a trailing slash, and it forces certain templates into specific URL structures.
• Squarespace: It canonicalizes product subcategories back to the main category (a finding Tom Stefanou showed her).
• WordPress, SilverStripe, and Webflow: All three had sites missing canonical tags this year because the tags were not enabled by default.

What are the 11 baseline requirements?

Mills' checklist for any crawlable, bot-accessible CMS:

1. Clean semantic HTML — correct elements for components; data in tables, lists in list tags, sidebars in aside elements. This also aids screen readers and cleaner CSS.
2. Server-side rendered content — Google queues every 200-status page for rendering, but rendering happens after crawl and can be delayed; most AI crawlers, including OpenAI's and Anthropic's, execute no JavaScript at all. Mills has watched Copilot spin up a browser on request, but says you can't bank on that for discovery.
3. Sitemap with controls — XML sitemaps are common, but excluding a folder or page is often impossible; hreflang sitemap control earns extra credit.
4. Robots.txt — 85% of robots.txt requests return 200, meaning roughly 15% of sites still lack the file entirely.
5. Canonical tags — without them, search engines index the wrong page version.
6. Meta robots — index control, with bonus points for nosnippet, indexifembedded, and max-snippet.
7. Metadata and OG tags — WordPress ships page titles but no meta descriptions or Open Graph tags out of the box.
8. Customizable error pages with correct status codes — the classic trap is a 404 template returning a 200, which tells Google "all good" while the page says "not found."
9. Single host enforced — 301 redirect to one HTTPS/www version without chains.
10. Trailing slash and capitalization redirects — consistent lowercase, consistent slash.
11. Customizable URL structure — no forced duplicate index URLs or locked-in templates.

Which advanced features save the most time?

Mills pairs the baseline with automation she has built herself. An automated table of contents, generated from page H2s and able to include H3s and H4s or exclude chosen headings, can earn sitelinks in Google's results; even WordPress needs a plugin like Rank Math for this. Her largest cleanup job came after migrating a site with tens of thousands of URLs from an old .NET platform, where every internal link still pointed at the old URL and hopped through a redirect — a Python script against the CMS API rewrote each link to its final destination.

She also wants:

• Automatic 301 redirects when a URL changes, plus a scheduled script updating internal links and suggesting relevant targets.
• A 404 internal-link report with bulk link replacement, instead of editing broken links one by one.
• Native 410 status code support, which she has used only a few times on live sites because so few CMSs offer it.
• A redirect manager offering status-code choice (301, 302, 307/308, 410), regex rules, query-string control, redirect-loop guardrails, and scheduled expiry for promo pages.

Guardrails matter most, she argues. She once took an entire website down with a single stray pipe character in a regex redirect rule — one "|" in the wrong place matched every URL and sent them all to the same page. A manager that tested rules against a sample of URLs before saving would have caught it in seconds.

What should image handling and AI connections look like?

Mills has yet to find a CMS that handles images well. Her requirements: one clean, stable URL per image across CDN and resizing; automatic WebP or AVIF conversion, compression, and cropping on upload; width and height attributes to prevent CLS; lazy loading except for the first image; per-page custom OG images; and max-image-preview: large. One enterprise system she worked with added an ID to every image file and generated numerous distinct URLs per optimization, a duplication risk for sites dependent on image search.

On AI workflows, she now makes fewer changes directly in a CMS and instead connects via CLI or MCP — on some of her WordPress sites she updates content and development work directly from Claude. She recommends testing the Claude Code CLI connection, with testing processes and guardrails before connecting anything to a public site. A simple script-injection settings section, with code validation and a release process, would also eliminate repeat marketing-script tickets.

Her closing advice for teams: analyze which tickets recur, automate where possible, and build developer partnerships. Asked for a CMS recommendation, she answers, "It depends." Watch whether platform roadmaps pick up MCP and CLI support next — that is where Mills sees her own workflow already shifting.