Canonical tag downgrades a secure page to an insecure http address
Your site loads pages securely over HTTPS (shown by the padlock in the browser), but a canonical tag, the code that tells search engines which address is the "real" version of a page, on this page points to the old insecure http:// version instead. This check flags any page where the canonical address uses http:// while the page itself is served over https://.
Why this matters
A canonical tag pointing at the insecure version splits the ranking signals search engines would otherwise concentrate on one address, and sends a mixed message about which version you actually want indexed. It can quietly undercut the SEO benefit of having moved to HTTPS in the first place.
How to fix it
Your developer should update the canonical tag's address so it starts with https:// to match the page it sits on. This is a small, low-risk code or CMS setting change that can usually be made and verified within an hour.
Turn website findings into an action plan
Create an account to start a Full Audit of your website, with supporting evidence and a prioritised action plan.
Start Full Audit