---
title: "Fix: Page Not Served Over HTTPS (HTTP to HTTPS)"
description: "A page that ends on http:// shows as not secure. Install a certificate, redirect HTTP to HTTPS with a 301 and fix mixed content on Nginx, Apache and more."
url: https://seenlens.com/fixes/serve-page-over-https
last_updated: 2026-11-06
---

# Page not served over HTTPS: how to fix it

A page is not served over HTTPS when its final URL, after redirects, starts with http://. Browsers then show a not secure warning. The cause is a missing certificate or a missing redirect. Install a certificate and send every HTTP address to HTTPS with a 301 redirect. This takes 15 to 60 minutes.

By SeenLens. Last updated: 2026-11-06

## What this check tests

SeenLens requests your URL, follows all redirects and looks at the scheme of the final URL. The check passes when the final URL starts with `https://`. It fails when it starts with `http://`. It does not test the certificate chain or mixed content.

## How to confirm the problem

```text
curl -sIL -o /dev/null -w "final URL: %{url_effective}, redirects: %{num_redirects}\n" http://example.com/
```

A final URL that starts with `http://` is the problem. If `https://example.com/` fails with a certificate error, install the certificate first.

## How to fix it

Do these two steps in order. Google's guide describes the same path: get a certificate, serve HTTPS, then redirect HTTP visitors with a 301 so search engines and browsers treat the HTTPS version as canonical.

### Step 1: install a certificate

Many hosting providers issue and renew Let's Encrypt certificates for you, automatically or through a setting. If your host does not, run an ACME client such as Certbot on your server.

### Step 2: redirect HTTP to HTTPS

Use one permanent redirect from each HTTP address to the final HTTPS URL.

```text
server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;
}
```

```text
<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com
    Redirect permanent "/" "https://example.com/"
</VirtualHost>
```

- **Cloudflare:** open SSL/TLS, Overview and confirm the encryption mode is not Off. Then open Edge Certificates and turn on Always Use HTTPS. It is available on all plans. Do not also redirect at the origin, because Cloudflare warns this can cause redirect loops.
- **Vercel:** the redirect guide lists enforcing HTTPS with redirects as a best practice. Domain level redirects live in the Domains section of the dashboard.
- **WordPress:** set WordPress Address and Site Address to the `https://` URL under Settings, General, then add the redirect at the server or CDN.

### Step 3: fix mixed content

An HTTPS page that loads images, scripts or styles over HTTP can show warnings, and some browsers block those resources. Change internal links to relative or HTTPS URLs. Update the canonical tag and the sitemap to HTTPS URLs.

## How to verify the fix

1. Run the curl command again. The final URL must start with `https://`, with one redirect.
2. Open the page in a browser and check that the lock icon shows no warning.
3. Run the SeenLens scan and confirm the https check passes.

[Run the free SeenLens scan on your page](https://seenlens.com/)

## When can you ignore it?

Ignore it only for a page on a private network or a local test site. Public pages should always end on HTTPS. Once HTTPS is stable, you can add the `Strict-Transport-Security` header. Google warns that clients may hard fail if your TLS setup breaks later, so add it after the setup proves reliable.

## Related checks

- [Crawlers cannot load the page](https://seenlens.com/fixes/ai-crawlers-cannot-load-page)
- [Add a canonical URL](https://seenlens.com/fixes/add-canonical-url)
- [Unknown URLs return 200](https://seenlens.com/fixes/soft-404-unknown-urls)
- [Is my website visible to AI?](https://seenlens.com/guides/is-my-website-visible-to-ai)

## Sources

- [web.dev: Enable HTTPS on your servers](https://web.dev/articles/enable-https) (certificate, 301 redirect, HSTS, mixed content, checked 2026-11-06)
- [Google Search Central: page experience](https://developers.google.com/search/docs/appearance/page-experience) (secure pages and the Search Console HTTPS report, checked 2026-11-06)
- [Cloudflare: Always Use HTTPS](https://developers.cloudflare.com/ssl/edge-certificates/additional-options/always-use-https/) (dashboard steps and redirect loop warning, checked 2026-11-06)
- [Let's Encrypt: getting started](https://letsencrypt.org/getting-started/) (host managed certificates or an ACME client, checked 2026-11-06)
- [nginx: return directive](https://nginx.org/en/docs/http/ngx_http_rewrite_module.html) and [Apache: mod_alias Redirect](https://httpd.apache.org/docs/2.4/mod/mod_alias.html) (redirect syntax, checked 2026-11-06)
- [Vercel: redirects](https://vercel.com/docs/redirects) (redirect guidance, updated 2026-09-18)