HTTPS migration issues: the insecure URL that never quite retired

Redirect every HTTP URL in one hop

The HTTP host should 301 to the matching HTTPS URL, including path and the preferred www or non-www choice. A redirect that always lands on the homepage throws away the specific page people bookmarked.

Update the canonical, the sitemap, and internal links to HTTPS so the redirect is only for old references.

Clear mixed content on the templates that still call HTTP

Images, scripts, and stylesheets requested over HTTP will be blocked or will warn. A page that looks fine on a second load may still be fetching an old asset from a hardcoded HTTP URL.

Search the templates and the CMS for http:// and replace asset references. Then load key pages with the console open.

• One-hop 301 from HTTP to the same path on HTTPS.
• Canonicals and sitemap on HTTPS only.
• No leftover HTTP assets in templates.

Confirm the preferred host is the only host

HTTPS on both www and the apex, without a single preferred host, is still a duplicate. Pick one, redirect the other, and use that host in every canonical.

Inspect both an old HTTP URL and the preferred URL. The first should redirect once; the second should be a 200 with a matching canonical.

Will an HTTPS migration drop traffic?

A careful one-hop redirect to the same paths usually settles quickly. Traffic drops when redirects hit the homepage, chains pile up, or both hosts remain indexable.

Should HSTS be enabled during the move?

After the redirect works. HSTS tells browsers to stay on HTTPS. It does not replace the 301 that search needs to see.