Canonical tag downgrades a secure page to an insecure http address

Your site loads pages securely over HTTPS (shown by the padlock in the browser), but a canonical tag, the code that tells search engines which address is the "real" version of a page, on this page points to the old insecure http:// version instead. This check flags any page where the canonical address uses http:// while the page itself is served over https://. A canonical tag pointing at the insecure version splits the ranking signals search engines would otherwise concentrate on one address, and sends a mixed message about which version you actually want indexed. It can quietly undercut the SEO benefit of having moved to HTTPS in the first place. Your developer should update the canonical tag's address so it starts with https:// to match the page it sits on. This is a small, low-risk code or CMS setting change that can usually be made and verified within an hour.