HTTP vs. HTTPS and Hostname Variations
Inside this lesson
- Why every site needs one preferred protocol and hostname
- The four homepage variations to test
- How to find mixed content and HTTP internal links
- How HSTS and certificates fit into the audit
Short answer
Your site should load on one protocol and hostname, usually HTTPS with or without www, and every other variation should 301 redirect to it in one hop. Audit by testing all four versions of key URLs, crawling the HTTP and alternate host versions, and checking for mixed content, HTTP internal links, and certificate errors.
Type these four into your browser and check where each lands:
http://example.ph
http://www.example.ph
https://example.ph
https://www.example.ph
All four should end at the same URL, in one redirect, with a padlock. On many small business sites, at least one of them loads its own copy, shows a certificate warning, or takes three hops.
What to check
- One preferred version returns 200. The other three 301 to it directly.
- Deep URLs behave the same, not just the homepage. Test a product and a blog post.
- The certificate is valid for every hostname, including the one being redirected.
- No mixed content: images, scripts, fonts, and iframes load over HTTPS.
- Internal links, canonicals, hreflang, and sitemaps use the preferred version.
- Stray hosts: staging, dev, old m. subdomains, or IP addresses serving the site.
How to audit at scale
- Crawl
http://and the non-preferred host as separate seeds and confirm every URL redirects. - Filter your main crawl for HTTP internal links and mixed content (Security tab in Screaming Frog).
- Search Google with
site:example.ph -inurl:wwworsite:staging.example.phto spot indexed alternates.
Practice: pass or fail?
Sort each item into the right group.
-
http://example.ph → 301 → https://www.example.ph
Answer: Pass.
-
https://example.ph loads its own 200 copy
Answer: Fail.
-
HTTPS page loads a logo from http://
Answer: Fail.
-
Canonicals use https://www on every page
Answer: Pass.
-
staging.example.ph is indexed in Google
Answer: Fail.
-
http://www → https://example → https://www (2 hops)
Answer: Fail.
Common mistakes
- Testing only the homepage. Deep URLs often use different rules.
- Redirecting HTTPS but leaving HTTP internal links.
- Indexed staging sites. Protect them with a password, not only robots.txt.
Your action
Next, you will audit trailing slashes and URL parameters.
Key terms
- HTTPS
- The secure version of HTTP, using an SSL/TLS certificate. A Google ranking signal and a browser trust requirement.
- Hostname
- The domain part of a URL, such as www.example.ph or example.ph.
- Mixed content
- An HTTPS page loading resources like images or scripts over HTTP, which browsers may block.
- HSTS
- A security header telling browsers to always use HTTPS for a domain.
Questions beginners ask
Should I use www or non-www?
Either works for SEO. Pick one, redirect the other, and use it everywhere: internal links, canonicals, sitemaps, and Search Console.
Do I need separate Search Console properties?
A Domain property covers all protocols and subdomains. It is the best choice for audits.
What if the SSL certificate does not cover www?
Visitors to that version get a security warning before the redirect. The certificate must cover every hostname you redirect from.
Are subdomains duplicates?
Only if they serve the same content. Staging, dev, or old m. mobile subdomains often leak duplicates and should be blocked or redirected.
Related lessons
Want someone to handle SEO for your business while you learn? The team at Remar Digital can help.