Pages Not Served over HTTPS: What to Check

Quick answer

NOTABIS reports https-unavailable when the final URL measured for a page uses HTTP rather than HTTPS. If an HTTPS request redirects down to HTTP, the final URL is still insecure and the finding is relevant. Serve public pages over HTTPS, redirect HTTP to the HTTPS equivalent, and verify every important resource and canonical URL after the change.

What the issue means

HTTPS encrypts the connection and authenticates the site through TLS. The check concerns the scheme of the URL actually measured, including the result after redirects. A site can have a valid certificate and still expose some routes, assets, or canonical links over HTTP.

Why it matters for SEO

HTTPS protects users and prevents intermediaries from modifying page traffic. Search systems can crawl HTTP, but insecure delivery can create browser warnings, mixed-content failures, weaker trust, and inconsistent URL signals. Moving to HTTPS is a site migration and security task, not a guaranteed ranking change.

How NOTABIS detects it

During page analysis, NOTABIS stores the final URL and checks whether its parsed scheme is https. When it is not, the page receives the high-severity https-unavailable finding. The rule does not validate certificate chains, TLS versions, HSTS policy, every subresource, or whether an HTTP redirect is permanent; those concerns need separate checks.

How to check it yourself

1. Request both http:// and https:// versions of important URLs.
2. Record each redirect, final URL, status, and Location header.
3. Inspect the certificate and TLS errors in a browser or TLS diagnostic tool.
4. Search source, CSS, scripts, images, canonicals, sitemaps, and internal links for HTTP URLs.
5. Confirm that authenticated, regional, and legacy routes follow the same migration policy.

How to fix it

Install and renew a valid certificate, configure the application and proxy to serve the intended host over HTTPS, and redirect equivalent HTTP URLs directly to HTTPS. Update internal links, canonicals, sitemaps, asset URLs, and deployment configuration. Add HSTS only after HTTPS is reliable for the complete scope you intend to protect, then re-test redirects and resources.

When this is intentional or does not need fixing

An internal development environment or a deliberately isolated HTTP endpoint may be outside a public site's migration scope. Do not expose user credentials or public content over HTTP merely because one route is difficult to migrate; document the boundary and plan the secure replacement.

Related issues

Read mixed content, HSTS headers, canonical URLs and redirects, and redirected pages. Google’s site-move guidance covers HTTPS migrations and redirect preparation. HTTP status codes explains how to inspect the migration responses.

Run a NOTABIS audit

Run a NOTABIS SEO audit against the public HTTPS origin to find pages whose measured final URL remains on HTTP.