How to Fix: HTTP redirects to HTTPS

HTTP redirects to HTTPS is a check in the Technical Foundation category, and it is high-priority because it sits under everything else. If the insecure version of your site still resolves, you have two copies of every page, a browser padlock that flickers, and a trust signal working against you. This is a ten-minute fix that prevents a whole category of quiet problems.

What is This Check About?

This check verifies that every insecure http:// request is permanently redirected to its secure https:// equivalent with a single 301. It is not enough to have an SSL certificate — the old HTTP URLs must actively forward to HTTPS, so there is exactly one canonical, secure version of each page and no way to land on the unencrypted one.

It fails when http:// URLs still load their own content instead of redirecting, when the redirect is a soft 302 instead of a permanent 301, or when redirects bounce through several hops before arriving at the right HTTPS page.

Why Does This Matter for SEO?

• HTTPS is a confirmed Google ranking signal, and browsers actively warn users away from pages served over plain HTTP
• Without a redirect, HTTP and HTTPS are two indexable versions of the same page — duplicate content that splits your signals
• A clean 301 consolidates all ranking authority onto the secure URL instead of leaking it across two versions
• The padlock is a trust cue for real users; a “Not secure” warning at the top of the browser costs you conversions before anyone reads a word

How to Check This Issue

1. Run an SEO audit with the SEO Roadmap tool to confirm HTTP is redirecting
2. Type http://yourdomain.com directly and confirm it lands on the https:// version
3. Use a redirect-checker (or your browser’s network tab) to confirm it is a single 301, not a 302 or a chain
4. Test http://www and http:// non-www variants — all of them should end on your one canonical HTTPS URL

How to Fix This in WordPress

Difficulty Level: EASY – This fix is straightforward and can typically be completed by anyone with basic WordPress knowledge.

Estimated Time: 10 min

Step 1: Confirm the certificate and the WordPress URLs

Make sure a valid SSL certificate is installed (most hosts now provide free Let’s Encrypt certificates). Then set both the WordPress Address and Site Address to the https:// versions under Settings → General. That alone fixes the internal side for most sites.

Step 2: Force the redirect at the server

The most robust place for the redirect is the server. On Apache, a few lines in .htaccess rewrite all HTTP to HTTPS; on Nginx, a return 301 block does the same. Many hosts also expose a “Force HTTPS” toggle in their control panel, which is the simplest route if you have it.

Step 3: Clean up mixed content

After forcing HTTPS, hunt down any assets still hard-coded to http:// — images, scripts, fonts — that trigger “mixed content” warnings and break the padlock. A plugin like Really Simple SSL handles both the redirect and the mixed-content rewriting, and is the pragmatic one-stop fix for a non-technical site owner.

Step 4: Verify and update Search Console

1. Clear your cache and re-test http:// to confirm a single clean 301
2. Make sure the HTTPS property is verified in Search Console and your sitemap uses HTTPS URLs
3. Re-run the SEO Roadmap audit to confirm the check passes

The detail that separates a good fix from a leaky one

Here is where I see this fix half-done, and why the half-done version quietly costs you. People force HTTPS and stop, without checking the redirect chain. But there are four front doors to most sites — http://, http://www, https://, and https://www — and the clean setup is that all of them arrive at your single canonical version in one hop. If a visitor to http://www bounces to https://www and then to https://, you have a redirect chain that wastes crawl budget and bleeds a little authority at each step. For extra credit once the redirect is solid, add an HSTS header so browsers skip the insecure request entirely on repeat visits. Ten minutes gets you secure; a couple more gets you secure and tidy, and tidy is what keeps the fix from leaking. Do it once, properly, and never think about it again.

Recommended Tools & Plugins

• Yoast SEO – Comprehensive SEO plugin with built-in checks
• Rank Math – Feature-rich SEO plugin with detailed analysis
• Google Search Console – Free tool to monitor your site’s search presence
• SEO Roadmap – Complete SEO audit and action plan tool

Common Mistakes to Avoid

• Installing a certificate but never forcing the HTTP-to-HTTPS redirect
• Using a temporary 302 instead of a permanent 301
• Leaving redirect chains across the www and non-www variants instead of one clean hop
• Ignoring mixed-content warnings that quietly break the padlock after the switch

Need More Help?

• Consulting with a WordPress developer or SEO specialist
• Checking the WordPress support forums for similar issues
• Reviewing your theme and plugin documentation
• Running a complete site audit with SEO Roadmap for a prioritized action plan

This guide is part of the SEO Roadmap knowledge base – your complete resource for WordPress SEO optimization.