Skip to Content
Page SEO BasicsIssue 3

Canonical URL pointing at HTTP instead of HTTPS

What Is This Issue

This issue checks whether pages served over HTTPS (secure) have canonical tags that also use HTTPS, not HTTP.

When a page loads securely via HTTPS, its canonical tag should point to an HTTPS URL. For this check to pass:

  • Pages served over HTTPS must have canonical tags pointing to HTTPS URLs
  • The canonical URL scheme (http or https) must match the scheme of the page being served
  • Canonical tags should not point to HTTP versions of HTTPS pages

Example: If your page is served at https://example.com/page, the canonical tag should be <link rel="canonical" href="https://example.com/page">, not <link rel="canonical" href="http://example.com/page">.

Why Is This Important

Canonical protocol consistency is important for:

  • Rankings: Search engines may split ranking signals between HTTP and HTTPS versions if canonical tags are inconsistent
  • Indexability: Mixed protocol signals can confuse search engines about which version is preferred
  • Duplicate content: HTTP and HTTPS versions of the same page can be treated as duplicates if not properly consolidated

When HTTPS pages have HTTP canonical tags, search engines may:

  • Receive conflicting signals about the preferred protocol
  • Split link equity between HTTP and HTTPS variants
  • Choose the non-preferred (HTTP) version as canonical
  • Reduce trust signals associated with HTTPS

Resolving this issue improves your SEO health score by ensuring search engines consistently see the secure HTTPS version as the preferred URL.

How XeoPix Detects This

XeoPix identifies HTTPS/HTTP canonical mismatches through these steps:

  1. Fetches the page: XeoPix requests the URL and follows redirects to get the final URL.

  2. Checks the protocol: The system identifies whether the final URL uses HTTPS or HTTP.

  3. Extracts the canonical: XeoPix parses the HTML and extracts the canonical URL from the <link rel="canonical"> tag.

  4. Compares protocols: The system checks whether:

    • The page is served over HTTPS
    • The canonical URL uses HTTP instead of HTTPS
    • The canonical scheme matches the page scheme

  5. Flags mismatches: XeoPix triggers issues when:

    • An HTTPS page has a canonical tag pointing to an HTTP URL
    • The canonical URL scheme doesn’t match the page scheme
    • The canonical scheme is missing or invalid

The detection uses only HTTP response data and raw HTML—no JavaScript execution is used.

How To Fix

  1. Check your canonical tags: Crawl your HTTPS pages to identify any that have canonical tags pointing to HTTP URLs.

  2. Update canonical generation: Ensure your CMS or framework generates canonical URLs with HTTPS when the page is served over HTTPS.

  3. Use protocol-relative URLs: Consider using protocol-relative canonical URLs (starting with //) that automatically match the serving protocol.

  4. Update hardcoded URLs: If canonical URLs are hardcoded in templates, update them to use HTTPS.

  5. Verify redirects: Make sure HTTP URLs redirect to HTTPS, and that canonical tags reflect the final HTTPS destination.

  6. Test your changes: Recrawl your HTTPS pages to confirm all canonical tags now point to HTTPS URLs.

What We Store

Storage Level

Page Level

Database Table / Prisma Model

PageSeoBasicsData

Stored Fields

FieldTypeDescription
canonicalUrlString?The canonical URL of the page

Detection Dependencies

  • HTML Document
  • HTTP Response Headers

Examples

Example 1: Correct HTTPS canonical

Scenario: A page served over HTTPS with matching canonical tag.

Passes because:

  • Page is served via HTTPS
  • Canonical tag also uses HTTPS
  • Protocols are consistent
<!-- URL: https://example.com/page -->
<link rel="canonical" href="https://example.com/page" />

Example 2: HTTPS page with HTTP canonical

Scenario: A secure page with insecure canonical tag.

Fails because:

  • Page loads via HTTPS
  • Canonical tag points to HTTP version
  • Protocol mismatch confuses search engines
<!-- URL: https://example.com/page -->
<link rel="canonical" href="http://example.com/page" />

Corrected version:

<link rel="canonical" href="https://example.com/page" />

Example 3: Mixed protocol after redirect

Scenario: HTTP redirects to HTTPS but canonical points to HTTP.

Fails because:

  • HTTP URL redirects to HTTPS
  • But canonical still points to HTTP version
  • Canonical should reflect final destination
<!-- http://example.com/page redirects to https://example.com/page -->
<link rel="canonical" href="http://example.com/page" />

Corrected version:

<link rel="canonical" href="https://example.com/page" />

Unit Test

Test File

__tests__/seo-audit-checks/pageSeoBasics/issue-43-canonical-points-https.test.js

Purpose

Validates that the SEO audit correctly detects canonical URLs that point to HTTP instead of HTTPS on HTTPS-served pages.

Tested Function

runPageSeoBasics() from toggleGroups/pageSeoBasics.js

Issue Information

  • Issue Number: 173
  • Issue Code: CANONICAL_POINTS_HTTPS (canonical_points_https)
  • Toggle Group: pageSeoBasics

Test Scenarios

Positive Test Cases

  1. Canonical uses HTTPS — Canonical URL uses https://. No issue should be reported.
  2. No canonical tag — Page has no <link rel="canonical"> tag. No issue should be reported.
  3. Protocol-relative URL — Canonical uses a protocol-relative URL (//example.com/page). No issue should be reported.

Negative Test Cases

  1. Canonical uses HTTP — Canonical URL uses http:// instead of https://. The issue should be reported with details.canonicalUrl containing the HTTP URL.
  2. HTTP with non-standard port — Canonical uses http:// with a non-standard port (:8080). The issue should be reported.

Boundary Cases

None.

Edge Cases

  1. Protocol-relative URL — Canonical URLs starting with // are not flagged as HTTP.
  2. HTTP with non-standard port — Even with a port number, HTTP canonical URLs are still detected.
  3. Empty HTML — The function handles empty HTML input without crashing.

Expected Outcome

Pass

The issue is not reported when the canonical URL uses HTTPS, is protocol-relative, or is absent.

Fail

The issue is reported when the canonical URL starts with http://.

Validation

  • Verifies correct issue detection for HTTP canonical URLs
  • Verifies no issue is reported for HTTPS canonical URLs
  • Verifies no issue is reported when no canonical tag exists
  • Verifies protocol-relative URLs are not flagged
  • Verifies the details.canonicalUrl contains the HTTP URL
  • Verifies HTTP with non-standard port is still detected
  • Verifies empty HTML does not cause a crash
  • toggleGroups/pageSeoBasics.js
  • issueCodes.js
  • utils/issues.js

Coverage Summary

  • Covers HTTPS canonical URL (pass)
  • Covers no canonical tag (pass)
  • Covers protocol-relative canonical URL (pass)
  • Covers HTTP canonical URL (fail)
  • Covers HTTP canonical URL with non-standard port (fail)
  • Covers empty HTML error handling (no crash)

References

Last updated on
Issue 2Issue 4