Skip to content
SERPCompass

HTTPS that is missing, not enforced or has certificate problems

Serve every page over HTTPS with a valid certificate that covers both your www and non-www addresses, and permanently redirect every http:// address to its https:// twin. Then change resource, link and form addresses on your pages from http:// to https://, renew the certificate automatically before it expires and allow only TLS 1.2 and 1.3. Shopify, Wix and Squarespace issue certificates for you.

Last updated 29 October 2026, when every step was checked against the vendor's documentation.

Why it matters

HTTPS encrypts the connection between a visitor's browser and your site. When a page exists at both an http:// and an https:// address, Google prefers to index the HTTPS one, and Search Console's HTTPS report lists the reasons it could not: an invalid certificate, an HTTPS address that redirects to HTTP, an HTTP page named as canonical, or a sitemap that points to HTTP. Google treats moving from HTTP to HTTPS as a site move: it recommends permanent 301 or 308 redirects, internal links changed to the new addresses and sitemaps updated.

Do not expect a ranking jump from HTTPS alone. Google's page experience guide lists secure serving among the questions to ask about your pages, and says that page experience aspects other than Core Web Vitals do not directly help a site rank higher. The reasons to fix it are what visitors' browsers do, and the second copy of every page that plain HTTP leaves open.

An HTTPS page that loads an image, script, stylesheet or frame over http:// has mixed content. Browsers block scripts, stylesheets, frames, srcset images and fonts loaded that way, and retry plain images, audio and video over https://, so anything without an https:// copy fails to load. A form on a secure page that sends to an http:// address makes browsers show a security warning each time someone submits it.

A certificate has an end date, after which browsers show visitors a security error instead of your page. Let's Encrypt, the free certificate authority, issues 90-day certificates by default; that falls to 64 days on 10 February 2027 and 45 days on 16 February 2028, and Let's Encrypt has ended its expiry reminder emails. Renewal has to be automatic, and checked.

TLS 1.0 and 1.1 are retired: RFC 8996 says they must not be used, and Chrome removed them in version 84. A certificate also covers only the names listed in it, so example.com and www.example.com both need to be in it: a visitor who types the missing one gets a security error before any redirect can run.

HSTS, the Strict-Transport-Security header, tells a browser that has seen it once to use only HTTPS for your site from then on, and not to let visitors click through certificate errors. Browsers ignore it when it arrives over plain HTTP.

SERPCompass rates pages served over plain HTTP, a site with no working HTTPS and a certificate that has expired or expires within 7 days as critical. An http:// address that does not redirect, mixed content, forms that send to http://, a certificate expiring within 30 days, a www or non-www twin with an invalid certificate and TLS below 1.2 are warnings; http:// internal links and a missing HSTS header are notices. For short-lived certificates the 30 and 7 days shrink to a third and a sixth of the certificate's lifetime. These thresholds are ours.

The audit findings this guide fixes: Pages served over plain HTTP; Site has no working HTTPS; HTTP version does not redirect to HTTPS; Mixed content (HTTP resources on HTTPS pages); Internal links to HTTP URLs; Forms that submit to HTTP; Missing HSTS header; TLS certificate expires within 30 days; TLS certificate expires within 7 days; Outdated TLS version (below TLS 1.2); The www or non-www address has an invalid certificate.

Find every page with this problem

Run the free scan on your domain. It notes every page it crawls over plain HTTP, requests the http:// address of your start page to see whether it redirects to https://, reads each HTTPS page for images, scripts, stylesheets, frames, media, links and form actions that use http://, checks the HSTS header on the first HTTPS page, and opens a TLS connection to read the certificate's expiry date, the TLS version the server agrees to and whether the www or non-www form of your domain has a valid certificate. The Gap Report and a SERPCompass workspace list the affected pages and the http:// addresses on each. To check by hand, run curl -sI http:// followed by your domain: the first line should be a 301 or 308 and the location line an https:// address. Your browser's developer tools console lists mixed content on the page you have open. In Google Search Console, the HTTPS report shows how many of your indexed pages are HTTP and why.

Scan my site free

How to fix it on your platform

Moving to a new domain, certificates on a CDN or load balancer, and redirect chains are not covered here; redirects have their own guide.

WordPress (no SEO plugin)

  1. Get a certificate from your host for both your domain and its www form; WordPress works over HTTPS once the web server has one.
  2. Go to Tools > Site Health. From WordPress 5.7, when your server already supports HTTPS, the HTTPS status there offers a button that switches the WordPress Address and Site Address to https:// in one step, and switches back if HTTPS then fails.
  3. Or go to Settings > General, change WordPress Address (URL) and Site Address (URL) to start with https:// and click Save Changes. If the fields are greyed out, WP_SITEURL and WP_HOME in wp-config.php set them: change them there.
  4. After the switch, WordPress rewrites http:// addresses on your own domain as pages are shown in post content, excerpts, text widgets and custom CSS, without changing what is stored. Any other place that stores a full http:// address, such as a custom menu link or a theme setting, needs changing by hand.
  5. Redirect http:// to https:// in your web server's configuration (Apache or NGINX below) or your host's control panel, and check it with curl -sI.

Sources: HTTPS (WordPress advanced administration handbook); Site Health screen (WordPress documentation); Improved HTTPS detection and migration in WordPress 5.7 (Make WordPress Core); Settings General screen (WordPress documentation).

Shopify

  1. Shopify issues free TLS certificates for your myshopify.com address, for domains bought or transferred through Shopify, and for other domains connected by pointing their A and CNAME records at Shopify. You cannot install a certificate of your own.
  2. After connecting a domain from another provider, allow up to 48 hours. On the Domains page its status should read Connected, and a padlock should show beside your store's address. Shopify then redirects visitors from http:// to the encrypted store.
  3. If the admin shows SSL unavailable, check your domain's CAA records. You need none unless you are required to use them; if you have them, each must allow letsencrypt.org, pki.goog; cansignhttpexchanges=yes and ssl.com.
  4. Shopify treats a page that loads any asset not delivered over HTTPS as insecure. Host images and files on Shopify, or serve them, webfonts included, over HTTPS from wherever they live.
  5. In descriptions, pages and blog posts, change http:// links to your own store into links that start with /, such as /collections/summer-collection, which Shopify recommends for links within your store.

Sources: Secure connections (Shopify Help Center); Using the rich text editor (Shopify Help Center).

Wix

  1. All Wix sites run on HTTPS with a certificate Wix provides; Wix does not support certificates from other providers.
  2. If your domain shows a certificate error, check its DNS records in Wix's troubleshooting article: with Wix's name servers, keep the default A and CNAME records; when pointing, the A record is for @ and the CNAME for www. After a DNS change, allow up to 48 hours.
  3. For a domain bought outside Wix, ask your domain host to make sure DNSSEC is not signed for it.
  4. If an HTML element on a page contains code with http:// addresses, click it, click Edit Code, remove them or replace them with https:// and click Publish.

Sources: Request: third-party SSL certificates (Wix Help Center); Troubleshooting your SSL certificate (Wix Help Center).

Squarespace

  1. Squarespace protects every domain correctly pointed at your site with a free certificate, one for each custom domain and subdomain, including the www form if you use it separately.
  2. Open the SSL panel, choose Secure (Preferred) under Security preference, keep HSTS Secure on and click Save. Secure sends visitors to HTTPS once the certificate is issued; Insecure leaves both HTTP and HTTPS open, and domains connected before October 2016 start on Insecure.
  3. Mixed content on Squarespace comes from integrations, code-based customisations and custom code: edit each one so it loads over https://.

Source: Understanding SSL certificates (Squarespace Help Center).

Let's Encrypt with Certbot

  1. With shell access to your server, Let's Encrypt recommends the Certbot client. Without it, your host gets and manages the certificate for you, automatically or once you turn on a setting.
  2. Request one certificate that names both forms of your domain, such as certbot certonly -d example.com -d www.example.com. Certbot's --apache and --nginx plugins obtain the certificate and install it in that server.
  3. To add a missing name to an existing certificate, name the certificate and list every domain it should cover: certbot certonly --cert-name example.com -d example.com,www.example.com.
  4. Most Certbot installations schedule certbot renew for you: look for it with systemctl list-timers or in your crontab, and test it with certbot renew --dry-run. From Certbot 4.0, a certificate is renewed when less than a third of its lifetime remains.
  5. Do not renew on a fixed 60-day timer: Let's Encrypt says that will not be enough once certificates last 45 days. And since it no longer emails expiry reminders, watch the expiry date yourself.

Sources: Getting started (Let's Encrypt); FAQ (Let's Encrypt); User guide (Certbot documentation); Decreasing certificate lifetimes to 45 days (Let's Encrypt); Expiration email service shut down (Let's Encrypt).

Apache

  1. Redirect HTTP in a dedicated port 80 virtual host with Redirect permanent "/" "https://www.example.com/". Apache's documentation prefers this to mod_rewrite.
  2. Only if you cannot edit the server configuration, use mod_rewrite in .htaccess instead (see the examples).
  3. In the HTTPS virtual host, send HSTS with Header always set Strict-Transport-Security "max-age=31536000"; always adds it to error responses too.
  4. Allow only current TLS versions with SSLProtocol TLSv1.2 TLSv1.3 (TLS 1.3 needs OpenSSL 1.1.1 or later).

Sources: Redirecting and remapping with mod_rewrite (Apache HTTP Server); mod_headers (Apache HTTP Server); mod_ssl (Apache HTTP Server).

NGINX

  1. Answer plain HTTP in its own server block that listens on port 80 and returns return 301 https://www.example.com$request_uri;.
  2. In the HTTPS server block, which listens with listen 443 ssl;, set ssl_protocols TLSv1.2 TLSv1.3;.
  3. Add HSTS with add_header Strict-Transport-Security "max-age=31536000" always;. A location block with add_header lines of its own does not inherit this one: repeat it there.
  4. A certificate for both names goes in ssl_certificate and ssl_certificate_key, with both names in its SubjectAltName field.

Sources: Module ngx_http_rewrite_module (nginx); Module ngx_http_core_module (nginx); Configuring HTTPS servers (nginx); Module ngx_http_ssl_module (nginx); Module ngx_http_headers_module (nginx).

Plain HTML

  1. Change every resource address that starts with http:// to https://: the src of images, scripts, frames, audio, video and source elements, srcset, and stylesheet and icon links. Check that the file loads over https:// first.
  2. For files on your own site, a relative address such as /images/van.jpg loads over the page's own connection.
  3. Change internal links that start with http:// to https:// or to relative paths, so no link passes through the redirect.
  4. Change every form action that starts with http:// to https://.
  5. On many pages, change addresses with a script rather than by hand, and include stylesheets, scripts and redirect rules, not only the HTML.
  6. Open the browser's developer tools console on each page: browsers report mixed content there. Content-Security-Policy: upgrade-insecure-requests makes browsers fetch what is left over https://; it is a safety net, not a replacement for fixing the addresses.

Sources: Fixing mixed content (web.dev); Mixed content (MDN); Enable HTTPS on your servers (web.dev); Sending form data (MDN); Site moves with URL changes (Google Search Central).

Examples

  • Bad 
    <img src="http://www.example.com/images/van.jpg" alt="Our service van">

    On an HTTPS page this is mixed content: the browser retries it over https:// and shows nothing if that fails.

  • Good 
    <img src="/images/van.jpg" alt="Our service van">

    A relative address loads over the page's own HTTPS connection.

  • Bad 
    <form action="http://www.example.com/contact" method="post">

    Browsers warn the visitor each time they send it, because the data is not encrypted.

  • Bad 
    $ curl -sI http://www.example.com/
HTTP/1.1 200 OK
Content-Type: text/html

    The http:// address answers with the page itself, not a redirect, so both copies stay open.

  • Good 
    <VirtualHost *:80>
    ServerName www.example.com
    Redirect permanent "/" "https://www.example.com/"
</VirtualHost>

    Apache's recommended redirect: one permanent hop to the https:// address.

  • Good 
    RewriteEngine On
RewriteCond "%{HTTPS}" !=on
RewriteRule "^(.*)" "https://%{SERVER_NAME}$1" [R=301,L]

    The .htaccess version, for when you cannot edit the server configuration.

  • Good 
    server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://www.example.com$request_uri;
}

    Both http:// names go straight to the https:// host you chose, keeping the path.

  • Good 
    Strict-Transport-Security: max-age=31536000; includeSubDomains

    One year, subdomains included. Add includeSubDomains only when every subdomain works over HTTPS.

Common mistakes

  • Installing a certificate but leaving http:// open: without a permanent redirect, both copies of every page stay reachable.
  • Redirecting with a temporary 302 instead of a permanent 301 or 308, which Google recommends for a move from HTTP to HTTPS.
  • Covering only one of example.com and www.example.com with the certificate, so visitors and links that use the other get a security error.
  • Fixing image and script addresses but forgetting form actions, srcset and the addresses inside stylesheets.
  • Leaving http:// addresses in your sitemap and canonical tags after the move: Search Console names both among the reasons an HTTPS page is not indexed.
  • Sending HSTS with includeSubDomains or preload before every subdomain works over HTTPS. hstspreload.org warns that the preload list cannot easily be undone: removal takes months to reach Chrome users.
  • Trusting renewal to run on its own. A renewal job that fails silently is found only when the certificate expires: test it with certbot renew --dry-run and watch the expiry date.

Questions and answers

Does HTTPS improve my Google rankings?

Not directly. Google lists secure serving among the page experience questions to ask about your pages, but says that aspects other than Core Web Vitals do not directly help a site rank higher. It does prefer to index the HTTPS version of a page that exists at both addresses. Fix HTTPS so every page has one address, and because browsers block mixed content and warn about insecure forms.

What is mixed content and how do I fix it?

Mixed content is an HTTPS page that loads an image, script, stylesheet, frame or other file over http://. Browsers block most of it and retry plain images, audio and video over https://. Change each address to https://, or to a relative path for your own files, once the file loads over HTTPS. The browser's developer tools console lists what is left.

How do I stop my SSL certificate from expiring?

Let a tool renew it automatically, and check that the renewal works. Shopify, Wix and Squarespace manage certificates for you. On your own server, Certbot schedules renewals, and certbot renew --dry-run tests them. Let's Encrypt certificates last 90 days today and 45 days from February 2028, and Let's Encrypt no longer emails expiry reminders, so watch the date yourself.

Why does the www version of my site show a security error?

The certificate does not name that host. A certificate covers only the names listed in it, so example.com and www.example.com both need to be in it. Add the missing name, for example with Certbot's cert-name option, or point both DNS records at your site builder so it can issue one, then redirect one form to the other.

Should I add my site to the HSTS preload list?

Only when every subdomain works over HTTPS and will stay that way. The list requires a valid certificate, a redirect from HTTP on the same host and an HSTS header with a max-age of at least one year, includeSubDomains and preload. hstspreload.org warns that inclusion cannot easily be undone: removal takes months to reach Chrome users.

Sources

Every step above was checked against these documents on 29 October 2026. Vendors change their menus; if a step no longer matches, the vendor's page is the authority.

Start with a free scan of your site.

Two to five minutes, no account. You get your three most urgent findings, and the exact count of everything else.

Free, 2–5 minutes, no account needed.