SiteAud!tLint Support

Critical Security

Page served over HTTP

Severity
Critical
Impact
High
Effort to fix
Medium
Issue code
not_https

Why it matters

Pages without HTTPS are flagged as not secure by browsers, and HTTPS is a ranking signal.

How to fix it

Serve the page over HTTPS and 301 redirect the HTTP version.

What this means

The page was crawled at an http:// address and answered with a 200 instead of redirecting to HTTPS. Visitors who land on it get no encryption, and Chrome and Edge mark the page Not secure in the address bar.

Why it matters for SEO

HTTPS is a confirmed, if lightweight, Google ranking signal. The larger problem is duplication: when the HTTP and HTTPS versions both load, Google sees two copies of every page and has to pick one, and links get split between them. Forms on an HTTP page also trigger a browser warning before anything is sent.

Common causes

  • No sitewide redirect. The certificate is installed and HTTPS works, but nothing sends HTTP requests to it.
  • A redirect that misses some paths. The rule covers the home page or one folder but not the rest.
  • Internal links still written as http://. The crawler follows them, so they reveal every page the redirect does not cover.
  • A CDN or proxy set to flexible SSL, which talks to your server over HTTP and can loop or fall back to HTTP.

How to fix it

  1. Add a single permanent (301 or 308) redirect from every http:// URL to the same path on https://. Do it at the server, host or CDN level, not page by page.
  2. Update internal links, canonical tags and the XML sitemap to https://, so crawlers never need the redirect.
  3. Once every page redirects, add an HSTS header so browsers stop requesting HTTP at all. See Missing HSTS header.

Verify the fix

Recrawl from the https:// start URL. Pages that were flagged should drop out, and any http:// internal links now show up as links to redirecting URLs until you update them. Then open a few old http:// addresses in a browser and confirm each lands on HTTPS in one hop. More than one hop is a redirect chain.

How it affects your score

Finding this issue on any page costs the Security score 8 points, plus up to 25 more depending on the share of crawled pages affected. As a critical issue type it also takes 3 points off overall site health (critical deductions stop at 15 points). Blocks indexing, breaks pages or loses traffic. Fix these first.

Find the affected URLs

Open Crawl > Issues and pick Page served over HTTP. Each affected URL is listed with its evidence, and Copy URLs or Export URLs hands the list to a developer. The issue also appears in the Action Plan, ranked by impact (high) and effort (medium), and in the issues CSV under the code not_https. After fixing, run a new audit and use Compare to confirm the URLs moved to fixed.