en
/login
Koval SEO

A secure page names an insecure address as the main one

In the reportHTTPS page canonicalizes to HTTP

https_page_canonical_to_http · Issue

Short answer

This appears when a page loaded over https:// names an http:// address as its canonical. It asks search engines to treat the insecure address as the main version, and Google lists this among the signals that work against its usual preference for HTTPS. Change the canonical to the https:// address.

Severity: High. Fix it soon: the canonical points search engines to an insecure address as the main version.

Why it matters

A canonical is a strong signal that the named address should become the main one. Google prefers HTTPS pages unless signals conflict, and one it lists is an HTTPS page with a rel="canonical" link to the HTTP page.

What to do

  1. Look at the finding: it shows each http:// canonical the page declares, and up to ten links on your site that point to the page.
  2. Change the canonical to the https:// address in your SEO plugin, theme or template, or in the Link header if your server sends one; a site address setting still on http:// often writes it on every page.

What we read

We read each crawled page that ends on an https:// address and answers 200 with complete HTML, up to 2 MiB, without running JavaScript. Its canonicals come from the <link rel="canonical"> in its head and the Link header; links that also carry hreflang, lang, media or type are ignored, and a relative address is resolved against <base href> or the page's own address.

A page is reported when any canonical it declares uses http://; if it declares several, each http:// one is listed. Pages marked noindex are checked too.

Example & evidence

Illustrative example — one page, not a live audit.

https://bakery.example/cakes/ answers 200, and its head contains:

<link rel="canonical" href="http://bakery.example/cakes/">

The page was loaded over https://, but its canonical uses http://, so the page is reported: Declared HTTP canonical target: http://bakery.example/cakes/.

A possible correction:

<link rel="canonical" href="https://bakery.example/cakes/">

Confirm & check again

Check for yourself: view the page source and find rel="canonical", then look for a Link response header with rel="canonical", for example with curl -I; every canonical should start with https://.

Check again: Full audit — run a new audit of the site. The finding closes when the page is crawled again as a complete HTML page with no http:// canonical, or now permanently redirects within your site. A page that is only a frame for scripts, or is not reached by the crawl, cannot be confirmed.

Limits & sources

The check does not tell which address Google chose as canonical, and it reports the page even when the http:// address redirects back to https://. Canonicals added by JavaScript or placed outside the head are not read.

Confidence: High because the canonical and the page's own address are read directly.

Sources

Editorial review: 29 September 2026