diff --git a/src/middleware.ts b/src/middleware.ts
new file mode 100644
index 0000000..3489c0d
--- /dev/null
+++ b/src/middleware.ts
@@ -0,0 +1,26 @@
+import { defineMiddleware } from 'astro:middleware';
+
+const CANONICAL_HOST = 'www.mnqcatering.com';
+
+/**
+ * SEO: this site is undesirably mirrored at mnqeventos.es (same content, no
+ * redirect at the DNS/hosting level). This middleware enforces the canonical
+ * host at the application layer for any host that isn't exactly
+ * www.mnqcatering.com (covers mnqeventos.es, www.mnqeventos.es, and the bare
+ * mnqcatering.com apex).
+ *
+ * NOTE: this must also be verified at the reverse-proxy/hosting layer — host
+ * detection here depends on how the Host header (or X-Forwarded-Host, when
+ * behind a proxy) actually arrives in production. If the proxy doesn't
+ * forward the original host, this check will see the wrong value.
+ */
+export const onRequest = defineMiddleware((context, next) => {
+  const requestHost = context.url.host;
+
+  if (requestHost !== CANONICAL_HOST) {
+    const redirectUrl = new URL(context.url.pathname + context.url.search, `https://${CANONICAL_HOST}`);
+    return context.redirect(redirectUrl.toString(), 301);
+  }
+
+  return next();
+});