freecourses.digital
Lesson progress: 0 of 3 activities done
All lessons in Technical SEO Auditing Lesson 5.3 of 84

HTTP vs. HTTPS and Hostname Variations

Inside this lesson

  • Why every site needs one preferred protocol and hostname
  • The four homepage variations to test
  • How to find mixed content and HTTP internal links
  • How HSTS and certificates fit into the audit

Short answer

Your site should load on one protocol and hostname, usually HTTPS with or without www, and every other variation should 301 redirect to it in one hop. Audit by testing all four versions of key URLs, crawling the HTTP and alternate host versions, and checking for mixed content, HTTP internal links, and certificate errors.

Type these four into your browser and check where each lands:

http://example.ph
http://www.example.ph
https://example.ph
https://www.example.ph

All four should end at the same URL, in one redirect, with a padlock. On many small business sites, at least one of them loads its own copy, shows a certificate warning, or takes three hops.

What to check

  1. One preferred version returns 200. The other three 301 to it directly.
  2. Deep URLs behave the same, not just the homepage. Test a product and a blog post.
  3. The certificate is valid for every hostname, including the one being redirected.
  4. No mixed content: images, scripts, fonts, and iframes load over HTTPS.
  5. Internal links, canonicals, hreflang, and sitemaps use the preferred version.
  6. Stray hosts: staging, dev, old m. subdomains, or IP addresses serving the site.

How to audit at scale

  • Crawl http:// and the non-preferred host as separate seeds and confirm every URL redirects.
  • Filter your main crawl for HTTP internal links and mixed content (Security tab in Screaming Frog).
  • Search Google with site:example.ph -inurl:www or site:staging.example.ph to spot indexed alternates.

Practice: pass or fail?

Sort each item into the right group.

  • http://example.ph → 301 → https://www.example.ph

  • https://example.ph loads its own 200 copy

  • HTTPS page loads a logo from http://

  • Canonicals use https://www on every page

  • staging.example.ph is indexed in Google

  • http://www → https://example → https://www (2 hops)

Common mistakes

  • Testing only the homepage. Deep URLs often use different rules.
  • Redirecting HTTPS but leaving HTTP internal links.
  • Indexed staging sites. Protect them with a password, not only robots.txt.
1. How many of the four protocol and host versions should return 200?
2. What is mixed content?
3. Best way to keep a staging site out of Google?

Your action

Next, you will audit trailing slashes and URL parameters.

Key terms

HTTPS
The secure version of HTTP, using an SSL/TLS certificate. A Google ranking signal and a browser trust requirement.
Hostname
The domain part of a URL, such as www.example.ph or example.ph.
Mixed content
An HTTPS page loading resources like images or scripts over HTTP, which browsers may block.
HSTS
A security header telling browsers to always use HTTPS for a domain.

Questions beginners ask

Should I use www or non-www?

Either works for SEO. Pick one, redirect the other, and use it everywhere: internal links, canonicals, sitemaps, and Search Console.

Do I need separate Search Console properties?

A Domain property covers all protocols and subdomains. It is the best choice for audits.

What if the SSL certificate does not cover www?

Visitors to that version get a security warning before the redirect. The certificate must cover every hostname you redirect from.

Are subdomains duplicates?

Only if they serve the same content. Staging, dev, or old m. mobile subdomains often leak duplicates and should be blocked or redirected.

Related lessons

Want someone to handle SEO for your business while you learn? The team at Remar Digital can help.