Checks
HTTPS with HTTP redirect
Checks that the site is served entirely over HTTPS and that any HTTP request to it redirects to the HTTPS equivalent rather than serving content over plain HTTP.
What this check looks for
This site-wide check fails if any crawled page was served over plain http://, and fails if the site's seed URL itself isn't https://. Otherwise it passes, noting when it observed an actual HTTP-to-HTTPS redirect hop during the crawl (evidence that the redirect is correctly configured, not just that HTTPS happens to be reachable).
Why it matters
HTTPS has been a confirmed Google ranking signal for years, and serving even some pages over plain HTTP exposes visitors to man-in-the-middle risks and triggers "not secure" warnings in modern browsers that actively drive people away before they read a word of content. If the HTTP version of a URL doesn't redirect to HTTPS, both versions can be crawled and indexed as separate, duplicate URLs, splitting ranking signal between them. AI crawlers and answer engines increasingly treat HTTPS as a baseline trust signal too — a site reachable over unencrypted HTTP reads as less credible and, in stricter crawler configurations, may simply be skipped.
How to fix it
Serve every page over HTTPS and add a server-level redirect from HTTP:
# nginx example: redirect all HTTP traffic to HTTPS
server {
listen 80;
server_name www.acme.com;
return 301 https://www.acme.com$request_uri;
}Confirm the certificate covers every subdomain you serve, and check that no internal links or canonical tags still point at the http:// version after the redirect is in place.
See how your site scores on this check