Skip to content
SeenLens

Page not served over HTTPS: how to fix it

A page is not served over HTTPS when its final URL, after redirects, starts with http://. Browsers then show a not secure warning. The cause is a missing certificate or a missing redirect. Install a certificate and send every HTTP address to HTTPS with a 301 redirect. This takes 15 to 60 minutes.

By SeenLens · Last updated

Run the free 43-check scan on your page

What this check tests

SeenLens requests your URL, follows all redirects and looks at the scheme of the final URL. The check passes when the final URL starts with https://. It fails when it starts with http://. It does not test the certificate chain or mixed content.

How to confirm the problem

curl
curl -sIL -o /dev/null -w "final URL: %{url_effective}, redirects: %{num_redirects}\n" http://example.com/

A final URL that starts with http:// is the problem. If https://example.com/ fails with a certificate error, install the certificate first.

How to fix it

Do these two steps in order. Google's guide describes the same path: get a certificate, serve HTTPS, then redirect HTTP visitors with a 301 so search engines and browsers treat the HTTPS version as canonical.

Step 1: install a certificate

Many hosting providers issue and renew Let's Encrypt certificates for you, automatically or through a setting. If your host does not, run an ACME client such as Certbot on your server.

Step 2: redirect HTTP to HTTPS

Use one permanent redirect from each HTTP address to the final HTTPS URL.

Nginx
server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;
}
Apache
<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com
    Redirect permanent "/" "https://example.com/"
</VirtualHost>
  • Cloudflare: open SSL/TLS, Overview and confirm the encryption mode is not Off. Then open Edge Certificates and turn on Always Use HTTPS. It is available on all plans. Do not also redirect at the origin, because Cloudflare warns this can cause redirect loops.
  • Vercel: the redirect guide lists enforcing HTTPS with redirects as a best practice. Domain level redirects live in the Domains section of the dashboard.
  • WordPress: set WordPress Address and Site Address to the https:// URL under Settings, General, then add the redirect at the server or CDN.

Step 3: fix mixed content

An HTTPS page that loads images, scripts or styles over HTTP can show warnings, and some browsers block those resources. Change internal links to relative or HTTPS URLs. Update the canonical tag and the sitemap to HTTPS URLs.

How to verify the fix

  1. Run the curl command again. The final URL must start with https://, with one redirect.
  2. Open the page in a browser and check that the lock icon shows no warning.
  3. Run the SeenLens scan and confirm the https check passes.

Run the free SeenLens scan on your page

When can you ignore it?

Ignore it only for a page on a private network or a local test site. Public pages should always end on HTTPS. Once HTTPS is stable, you can add the Strict-Transport-Security header. Google warns that clients may hard fail if your TLS setup breaks later, so add it after the setup proves reliable.

Sources