Page not served over HTTPS, or certificate expired

What Is This Issue

This issue checks whether your website forces secure connections over HTTPS and has a valid, trusted SSL/TLS certificate installed.

What this issue checks

• Your site is accessible over HTTPS (not just HTTP)
• The SSL/TLS certificate is present, valid, and trusted by major browsers
• The certificate is not expired (or expiring within 14 days)
• The server uses modern TLS protocols (TLS 1.2 or higher)
• HTTP traffic automatically redirects to HTTPS

What is considered a passing implementation

A passing implementation means:

• Your site responds over HTTPS
• A valid SSL/TLS certificate from a trusted Certificate Authority is installed
• The certificate is not expired or about to expire (within 14 days)
• The server uses TLS 1.2 or TLS 1.3
• HTTP requests redirect to HTTPS

Real-world example

When a user visits http://example.com, they should be automatically redirected to https://example.com, and the browser should show a padlock icon indicating a secure connection. The certificate should be issued by a trusted Certificate Authority like Let’s Encrypt, DigiCert, or Sectigo.

Why Is This Important

HTTPS is fundamental to website security and SEO for several reasons:

Crawlability

If browsers block access due to certificate errors, search engine crawlers cannot access your pages, leading to deindexing.

Indexability

Similar to crawlability issues, if your HTTPS configuration is broken, search engines cannot properly index your pages.

Rankings

Google uses HTTPS as a ranking signal. Sites with secure connections get a slight ranking boost over equivalent HTTP sites.

User Experience

Modern browsers display “Not Secure” warnings for HTTP sites, which scares away visitors and increases bounce rates. When certificate validation fails, browsers show hard-blocking errors that prevent access entirely.

AI Search / AEO

AI-powered search engines and assistants prioritize secure sites, as they rely on HTTPS to verify content authenticity and protect user data during retrieval.

SEO Health Score Impact

Resolving this issue improves your overall SEO health score by ensuring your site is accessible, trustworthy, and compliant with modern web standards. A valid SSL certificate is the foundation of website security.

How XeoPix Detects This

XeoPix checks whether your website forces secure connections over HTTPS and has a valid, trusted SSL/TLS certificate.

Detection process

XeoPix follows these logical steps to identify HTTPS and SSL certificate issues:

1. Check HTTPS accessibility - XeoPix attempts to access your website over HTTPS to verify it’s available and responding.

2. Validate SSL/TLS certificate - If HTTPS is accessible, XeoPix checks the SSL/TLS certificate to confirm:

   • A certificate is present
   • The certificate is valid and trusted by major browsers
   • The certificate expiration date is valid (not expired or expiring within 14 days)
   • The certificate is issued by a trusted Certificate Authority

3. Verify TLS protocol version - XeoPix checks which TLS protocol version your server uses to ensure it meets modern security standards (TLS 1.2 or TLS 1.3).

4. Check HTTP to HTTPS redirect - XeoPix verifies that HTTP traffic automatically redirects to HTTPS, ensuring all visitors use secure connections.

When the issue is flagged

The issue is flagged when any of these conditions are met:

• Your site cannot be accessed over HTTPS
• No SSL certificate is detected
• The SSL certificate is invalid or untrusted
• The certificate expires within 14 days
• The server uses outdated TLS protocols (TLS 1.0, TLS 1.1, or SSLv3)
• HTTP traffic does not redirect to HTTPS

When the issue passes

The issue passes when:

• Your site is accessible over HTTPS
• A valid SSL/TLS certificate from a trusted Certificate Authority is installed
• The certificate is not expired or about to expire within 14 days
• The server uses TLS 1.2 or TLS 1.3
• HTTP requests automatically redirect to HTTPS

How To Fix

Follow these steps to enable HTTPS with a valid SSL certificate:

Step 1: Obtain a trusted SSL/TLS certificate

Obtain a trusted SSL/TLS certificate from a Certificate Authority (CA) such as:

• Let’s Encrypt (free)
• DigiCert
• Sectigo

Step 2: Install the certificate

Install the certificate on your web server, load balancer, or CDN according to your hosting provider’s instructions.

Step 3: Configure HTTP-to-HTTPS redirect

Ensure all HTTP traffic automatically redirects to HTTPS using a 301 or 302 status code.

Step 4: Enable automatic certificate renewal

Set up automatic certificate renewal to prevent expiration. For Let’s Encrypt, use Certbot or similar tools to automate renewal.

Step 5: Use modern TLS protocols

Enable modern TLS protocols (TLS 1.2 or TLS 1.3) and disable deprecated protocols like TLS 1.0, TLS 1.1, and SSLv3.

Step 6: Test your configuration

Test your configuration using SSL Labs  to verify the certificate is valid, trusted, and properly configured.

Step 7: Monitor certificate expiry

Set up alerts at least 30 days before expiration to ensure timely renewal.

What We Store

Storage Level

Page Level — This issue is evaluated for each individual URL.

Database Table / Prisma Model

PageSecurityHeader

Stored Fields

Detection Dependencies

• The following data sources are required to evaluate this issue:
• HTTP Response — SSL/TLS certificate information is extracted from the HTTPS connection
• SSL Certificate — The crawler validates certificate validity, issuer, and expiration dates

Examples

Example 1: Missing HTTPS

Problem: A website only serves content over HTTP, not HTTPS.

What fails:

http://example.com (no HTTPS available)

What passes:

https://example.com (HTTPS enabled with valid certificate)

Example 2: Expired Certificate

Problem: The SSL certificate has expired.

What fails:

Certificate expired on 2024-01-15

What passes:

Certificate valid until 2025-01-15

Example 3: No HTTP to HTTPS Redirect

Problem: HTTPS is available, but HTTP doesn’t redirect to HTTPS.

What fails:

http://example.com (serves content over HTTP)
https://example.com (serves content over HTTPS)

What passes:

http://example.com → 301 redirect → https://example.com

Unit Test

Test File

__tests__/seo-audit-checks/httpSecurityHeaders/issue-1-https-enabled-valid.test.js

Purpose

This unit test validates that the HTTPS and SSL certificate check correctly identifies pages that are not served over HTTPS or have an invalid, expired, or not-yet-valid SSL certificate.

Tested Function

runHttpSecurityHeaders() from toggleGroups/httpSecurityHeaders.js

Issue Information

• Issue Number: 1
• Issue Code: https_enabled_valid
• Toggle Group: httpSecurityHeaders

Test Scenarios

Positive Test Cases

Scenarios where the issue should be reported:

• Page is loaded over HTTP (not HTTPS) — SSL check is bypassed but HTTPS requirement fails
• HTTPS is enabled but certificate information cannot be retrieved (null values returned)
• HTTPS is enabled but certificate is expired (validUntil is in the past)
• HTTPS is enabled but certificate is not yet valid (validFrom is in the future)

Negative Test Cases

Scenarios where the issue should not be reported:

• HTTPS is enabled and certificate is valid (issuer present, validFrom ≤ now, validUntil ≥ now)

Boundary Cases

• Certificate with validFrom exactly equal to current date (should pass if validUntil ≥ now)
• Certificate with validUntil exactly equal to current date (should pass if validFrom ≤ now)

Edge Cases

• SSL module returns null for all certificate fields (issuer, validFrom, validUntil)

Expected Outcome

Pass

The issue is reported when the page URL does not start with https://, or when the SSL certificate issuer, validFrom, or validUntil is null/missing, or when the certificate date range does not include the current date.

Fail

The issue is not reported when the page uses HTTPS and the SSL certificate has a valid issuer, a validFrom date in the past (or now), and a validUntil date in the future (or now).

Validation

The unit test verifies:

• Correct detection of non-HTTPS pages
• Correct detection of missing/invalid SSL certificate information
• Correct detection of expired certificates
• Correct detection of not-yet-valid certificates
• No detection when HTTPS and certificate are fully valid
• The issue details message is populated correctly

Related Production Files

• toggleGroups/httpSecurityHeaders.js — contains the runHttpSecurityHeaders() function and extract() logic
• issueCodes.js — defines IssueCode.HTTPS_ENABLED_VALID
• utils/ssl.js — provides getCertificateInfo() used to retrieve SSL certificate data

Coverage Summary

• Covers the full HTTPS and SSL certificate validation logic
• Tests both HTTP and HTTPS URL scenarios
• Tests valid, expired, future, and null certificate states
• Validates the issue detection message string

References

• W3C Secure Contexts  — W3C
• Google Search Central: HTTPS as a ranking signal  — Google Search Central
• MDN Web Docs: HTTPS  — MDN