Site-wide configuration
How to redirect http to https
The http:// address does not redirect to https://. Both versions are reachable, so search engines see two copies of the site and some visitors stay on the insecure one.
What it is, and what it costs
You have a certificate and https works, but http still serves the site instead of redirecting. That leaves a full duplicate on the insecure protocol, splits signals between the two, and lets visitors land on the "Not Secure" version.
How to fix it
Add a permanent (301) redirect from http:// to https:// at the server or CDN level, and consider HSTS to make browsers default to https.
- WordPress: Really Simple SSL adds the redirect; or add it in the server config.
- Nginx / Apache / Cloudflare: a standard "always use https" rule handles it.
How to check your site
Load http://yoursite.com and watch: it should 301 to the https version, not stay on http.
Related: adding HTTPS in the first place.
Questions people ask
- Do I need HSTS too?
- It is a good next step: it tells browsers to always use https, closing the small window before the redirect fires. Add it once the redirect is solid.
Does your site have this?
Check your site to see whether http redirects to https.
See also
- How to build a custom 404 pageWhen someone follows an old link to a page that is gone, a bare server error tells them nothing and they leave. A 404 page with your normal layout, a short line of explanation, and a search box turns that dead end into a way back into the site.
- How to move your site to HTTPSThe site is served only over plain http. Browsers mark it as Not Secure, anything typed into it travels in the clear, and HTTPS has been a ranking signal for years.
- How to fix an invalid HTTPS certificateThe HTTPS certificate does not verify: expired, self-signed, or issued for a different name. Browsers show a full-page warning before anyone reaches the site, and search engines will not index it normally.
- How to fix title tag problemsThe title tag is the line people read in search results, and the strongest single signal on the page about what it is for. Four things go wrong with it, and a site with one of them usually has two. Each is below, with what it costs and how to put it right.