Links and lists still point to http:// addresses
In the reportHTTPS pages still reference http:// URLs in links, hreflang or sitemaps
lingering_http_references · Review item
This appears when your HTTPS site still has links, hreflang annotations or sitemap entries that point to http:// addresses on the same site. This check does not request those addresses, so it cannot tell whether they redirect to HTTPS. Update them to the https:// addresses.
Severity: Notice. This flags an HTTP reference, not the response it receives. Update the reference during normal maintenance and check redirects separately.
Why it matters
Google's guide to moving a site, which counts a change from HTTP to HTTPS as a move, advises changing internal links, hreflang annotations and sitemap entries to the new addresses, because redirects are slow for users.
What to do
- Look at the finding: it shows, for each kind of reference, up to 25 examples with the address as written and as resolved.
- Change internal links, hreflang annotations and
og:urltohttps://, in your templates and content. - Regenerate your sitemap with
https://addresses.
When to leave it as it is: if these references remain on pages you no longer maintain, you may defer cleanup after checking that the HTTP addresses redirect safely. This rule does not test their responses.
What we read
On each crawled HTTPS page we read, without running JavaScript, the <a href> and <area href> links, the hreflang <link> tags, an hreflang Link header, and og:url when it differs from the page's canonical only by http://. A page is reported when any of them points to http:// on your site's own host, with or without www.; other hosts and subdomains are ignored.
We also read the <loc> entries of your sitemaps, and http:// entries there are reported once for the whole site. A kind of reference that could not be read in full on a page, for example over 5,000 links, is marked as not checked there.
Example & evidence
Illustrative example — one link, not a live audit.
https://bakery.example/cakes/ contains:
<a href="http://bakery.example/order/">Order a cake</a>The link points to http:// on the site's own host, so the page is reported with the link.
<a href="https://bakery.example/order/">Order a cake</a>A possible correction: link to the HTTPS address, or use a relative one such as /order/.
Confirm & check again
Check for yourself: view a page's source and search for http:// followed by your domain.
Check again: Full audit — run a new audit of the site. A page's finding closes when the page is crawled again with every kind of reference readable and none points to http:// on your site. The site-wide sitemap finding closes when the audit has complete coverage of the sitemaps it collected and finds no internal http:// <loc> entry.
Limits & sources
The check reads declared references and resolves relative page references against their applicable base URL; it does not request the http:// addresses. It does not report canonical tags as lingering HTTP references; it consults the canonical only to classify og:url. It does not read other <link> tags, images or scripts, addresses inside CSS, JavaScript or structured data, or hreflang alternates inside sitemaps.
Confidence: High because the references are read directly from the HTML, the headers and the sitemaps.
Sources
- Google, How to move a site — counts a change from HTTP to HTTPS as a site move and advises updating internal links, hreflang annotations and sitemap entries to the new addresses, and says redirects are slow for users. Checked 28 September 2026.
Editorial review: 29 September 2026