Issue 173

This issue checks whether pages served over HTTPS (secure) have canonical tags that also use HTTPS, not HTTP.

When a page loads securely via HTTPS, its canonical tag should point to an HTTPS URL. For this check to pass:

• Pages served over HTTPS must have canonical tags pointing to HTTPS URLs
• The canonical URL scheme (http or https) must match the scheme of the page being served
• Canonical tags should not point to HTTP versions of HTTPS pages

Example: If your page is served at https://example.com/page, the canonical tag should be <link rel="canonical" href="https://example.com/page">, not <link rel="canonical" href="http://example.com/page">.

Canonical protocol consistency is important for:

• Rankings: Search engines may split ranking signals between HTTP and HTTPS versions if canonical tags are inconsistent
• Indexability: Mixed protocol signals can confuse search engines about which version is preferred
• Duplicate content: HTTP and HTTPS versions of the same page can be treated as duplicates if not properly consolidated

When HTTPS pages have HTTP canonical tags, search engines may:

• Receive conflicting signals about the preferred protocol
• Split link equity between HTTP and HTTPS variants
• Choose the non-preferred (HTTP) version as canonical
• Reduce trust signals associated with HTTPS

Resolving this issue improves your SEO health score by ensuring search engines consistently see the secure HTTPS version as the preferred URL.

1. Check your canonical tags: Crawl your HTTPS pages to identify any that have canonical tags pointing to HTTP URLs.

2. Update canonical generation: Ensure your CMS or framework generates canonical URLs with HTTPS when the page is served over HTTPS.

3. Use protocol-relative URLs: Consider using protocol-relative canonical URLs (starting with //) that automatically match the serving protocol.

4. Update hardcoded URLs: If canonical URLs are hardcoded in templates, update them to use HTTPS.

5. Verify redirects: Make sure HTTP URLs redirect to HTTPS, and that canonical tags reflect the final HTTPS destination.

6. Test your changes: Recrawl your HTTPS pages to confirm all canonical tags now point to HTTPS URLs.

Example 1: Correct HTTPS canonical

Scenario: A page served over HTTPS with matching canonical tag.

Passes because:

• Page is served via HTTPS
• Canonical tag also uses HTTPS
• Protocols are consistent

<!-- URL: https://example.com/page -->
<link rel="canonical" href="https://example.com/page" />

Example 2: HTTPS page with HTTP canonical

Scenario: A secure page with insecure canonical tag.

Fails because:

• Page loads via HTTPS
• Canonical tag points to HTTP version
• Protocol mismatch confuses search engines

<!-- URL: https://example.com/page -->
<link rel="canonical" href="http://example.com/page" />

Corrected version:

<link rel="canonical" href="https://example.com/page" />

Example 3: Mixed protocol after redirect

Scenario: HTTP redirects to HTTPS but canonical points to HTTP.

Fails because:

• HTTP URL redirects to HTTPS
• But canonical still points to HTTP version
• Canonical should reflect final destination

<!-- http://example.com/page redirects to https://example.com/page -->
<link rel="canonical" href="http://example.com/page" />

Corrected version:

<link rel="canonical" href="https://example.com/page" />

PixyScan identifies HTTPS/HTTP canonical mismatches through these steps:

1. Fetches the page: PixyScan requests the URL and follows redirects to get the final URL.

2. Checks the protocol: The system identifies whether the final URL uses HTTPS or HTTP.

3. Extracts the canonical: PixyScan parses the HTML and extracts the canonical URL from the <link rel="canonical"> tag.

4. Compares protocols: The system checks whether:

   • The page is served over HTTPS
   • The canonical URL uses HTTP instead of HTTPS
   • The canonical scheme matches the page scheme

5. Flags mismatches: PixyScan triggers issues when:

   • An HTTPS page has a canonical tag pointing to an HTTP URL
   • The canonical URL scheme doesn't match the page scheme
   • The canonical scheme is missing or invalid

The detection uses only HTTP response data and raw HTML—no JavaScript execution is used.