HTTPS describes a secure connection; www is part of the hostname. They are separate choices. A business can use https://www.example.com as its single public address while redirecting other public variants to it.
Choose one preferred public address
Record the preferred scheme and hostname. Check that alternative public addresses lead to the same page on that address, without a redirect loop. Preserve campaign parameters that are needed for attribution.
Use the same public origin in canonical tags, sitemaps and internal links. Keep private administrative applications separate and excluded from indexing.
Check Analytics on the final page
Do not assume the URL entered when creating an Analytics stream is the only hostname capable of sending events. Inspect whether the expected measurement ID loads on the page where the visitor actually lands.
Also check consent state, browser blockers, duplicate tags and network failures. A redirect alone does not establish why visitor data is missing.
Inspect the site's security policy
A content security policy can block an otherwise correct Analytics installation. Google's tag security guidance lists required destinations, including Analytics collection endpoints. Add only the destinations needed for the enabled features.
Ask the developer to verify one normal page view and one client-side navigation after the appropriate consent choice. Check campaign attribution with an approved test URL and confirm that sensitive query parameters are not transmitted.
Payment webhooks and authentication callbacks need separate regression checks; changing their addresses casually can break working integrations. Commission a focused development review that records both redirect behaviour and permitted Analytics delivery.