Why My WordPress Website Includes Both http & https on Canonical URL

When managing a WordPress website, the stability of the website’s URLs is the most important determinant for both user experience and search engine optimization (SEO). If a search engine is presented with ambiguous HTTP and HTTPS canonical URLs, the website’s search engine rankings may be downgraded. This is a brief explanation of what causes this and how to treat it.

Understanding Canonical URLs

Http:/www.example.com/page and https:/www.example.com/page are alternative versions of the same page, with a difference in the protocol (http vs. https).

Why Both http and https Appear on Canonical URLs

• Incomplete Migration to HTTPS:
  • If, however, a web site, which was served previously under http and “jumped” to be served under https, but which did not undergo a full cookie update, the web site can still be visited using a URL serving under http.

• Mixed Content Issues:
  • Because the resources are loaded over http rather than https (e.g., by plugins or themes) the http canonical values may include both the values for the http protocol.

• Incorrect WordPress Settings:
  • The General area on the page of the WordPress login form includes the WordPress Address (URL\ Box and the Site Address (URL\ Box. Reason, however, can lead to mismatch, when the former is set to http and the latter to https.

• Plugin Conflicts:

SEO plugins (e.g., Yoast or All in One SEO) have a faulty canonical URL management floor with the potential for inaccuracy when canonical link outs are changed through a plugin task, as a plugin task can conflict with the treatment of such canonical URLs.

• Hardcoded URLs:

Hardcoded http URLs in the theme or a separate plugin can be wrongly exploited to reset the http params and produce mixed canonical URLs.

• Caching Issues:

There are also situations in which, even after the end of a migration http URLs may still be served, even though they may be stale, because of plugin use and/or server-side caching.

Why It Matters

If http and http are repeated in the canonical urls the following could occur: .

• Duplicate Content: Search engines can treat http http and https http as different sites and can have a bad impact for the SEO.
• Mixed Signals: This has the effect of creating alignment loss in the way in which search engines will determine to use which of the versions for the indication as a priority, and which negative can impact the ranking of your website.
• Security Warnings: There may be security warnings each time resources are loaded over http or on an https site.

How to Fix the Issue

• Update WordPress Settings:
  • Go to Settings > General in your WordPress dashboard.
  • Ensure both WordPress Address (URL) and Site Address (URL) start with https://
• Check Your .htaccess File:
  • Add rules to redirect all http traffic to https. Here’s a simple example:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

Make sure to back up your .htaccess file before making changes.

• Use a Plugin to Force HTTPS:
  • Install and activate a plugin like Really Simple SSL. The plugin can be used for automated mixed content detection and resolution.
• Update Hardcoded URLs:
  • Detect and substitute every hardcoded http URL/links inside theme files, plugins and database.
• Clear Caches:
  • If you’re using caching plugins such as W3 Total Cache or WP Super Cache, please flush all of the caches after any changes.
  • Also, clear any server-side caches if applicable.
• Review SEO Plugin Settings:
  • That the configuration of the SEO plugin is properly set up to process canonical URLs correctly over https.
• Check for Mixed Content:
  • Leveraging Why Not Padlock or browser developer tool for the identification and remediation of mixed content issues even with content remains served over HTTP.
• Update External Resources:
  • External resources (images, scripts, stylesheets) have to be loaded using SSL.

Conclusion

Regularized https canonical URLs play a key role in the security, usability, and performance of your WordPress site. By using the above steps, you ensure uniform use of HTTPS on your website and prevent any mixing of protocol errors. Scan the site from time to time, for example when system or site changes/updates are taking place, in order to make sure the site is running at its peak speed and security.