What is frontend & what is backend in WordPress?
So even though, some parts of your site's "frontend" may be restricted by a password protected barrier, it's still considered as frontend. It's more accurate if you call it WordPress Admin Panel, instead of calling it the backend.
Why would WordPress Admin Panel pages need
Unless for a very very rare use case where you may make the admin pages public, there can be no SEO benefits from it. However,
rel="canonical" can still be used (even for the admin panel pages): As part of the standard practice.
For a web page,
The web page URL that is recognized as the go to URL for a collection of different pages having very similar or the same content.
Since this is the standard practice, even if you don't get any SEO benefit from it, it's still the right thing to do.
Where does it come from:
wp_admin_canonical_url() function in WordPress 4.2.
rel="canonical" part was there from the beginning & WordPress developers found no reason to remove it since then.
The original change came from the support ticket titled: Remove message parameters from admin URl's in the browser address bar. And if you go through the discussion, you'll see that the
rel=canonical part was added as part of standard practice, nothing more.
Check the comment from the original developer:
rel=canonical is a standard practice, and I think this is a good use of it.
Why WordPress needs the
<link id="wp-admin-canonical" /> tag?
As evident from the above discussion,
rel=canonical part of the
<link> tag is only there for standard practice, however, the
<link id="wp-admin-canonical" rel="canonical" href="__URL__" />
itself is functional. It was added to keep the URL & browser history clean from single-use query variable names.
For example, if you activate a Plugin, at the top of your admin panel, it gives you a message like:
After that, say you close the browser & open it back again later (or simply refresh the page). At that point, prior to WordPress 4.2 (if the browser is set to open the last opened tab), the page would still say:
even though nothing really happened this time. Same applies when you use browser back button (because the message is shown in response to the single-use URL parameters from browser history as well).
This happens because WordPress redirects you to a URL like:
after you activate a plugin. Notice the
activate=true query string in the URL. This has no purpose other than showing you that "Plugin activated" message. So it has no use in the URL or browser history after the "Plugin activated" message is delivered to you.
That's why, in WordPress 4.2
wp_admin_canonical_url() function was introduced, where
As of writing this, there are 23 such single-use query variables that can be removed from the canonical URL from
'activate', 'activated', 'approved', 'deactivate', 'deleted',
'disabled', 'enabled', 'error', 'hotkeys_highlight_first',
'hotkeys_highlight_last', 'locked', 'message', 'same', 'saved',
'settings-updated', 'skipped', 'spammed', 'trashed', 'unspammed',
'untrashed', 'update', 'updated', 'wp-post-new-reload'
However, it can be extended from Plugins or Themes using the
removable_query_args filter hook.