Visitors aren’t reliably getting the secure version of your website. Browsers mark plain-HTTP pages “Not secure”, which puts people off, and Google favours secure pages.
What it means
“Website isn’t on HTTPS” means it answers over plain HTTP but not over HTTPS at all. “HTTP doesn’t redirect to HTTPS” means it has a certificate, but http:// addresses still show the website instead of sending visitors to https://.
What triggers it
SSL certificate monitoring loads the home page over HTTP and HTTPS once a week, and daily while a problem lasts. Either problem raises a High issue, and owners and admins are emailed about it each week until it’s fixed.
Common causes
- No certificate is installed, or it was lost in a hosting move.
- The redirect from HTTP to HTTPS was never set up, or was lost in a server, plugin or configuration change.
- A CDN such as Cloudflare without its “Always Use HTTPS” setting turned on.
How to fix it
- If there’s no certificate, install one; most hosts and Cloudflare offer a free one that renews itself.
- Add a permanent (301) redirect from HTTP to HTTPS in your hosting panel, server configuration or CDN settings.
- Type http:// and your domain into a browser: you should end up on the https:// address.
When it clears
It clears at the next check that finds HTTPS working and HTTP redirecting to it. While the problem lasts the check runs daily, so a fix is noticed within a day.