Joomla site still loads over HTTP

If your site runs on HTTPS but its plain http:// address still loads the site instead of redirecting, search engines can crawl every page over HTTP as well. Each of those pages carries a canonical link to its HTTPS version, so an audit reports them all as Canonical from HTTP to HTTPS.

Why Joomla sites get it

A common .htaccess rule redirects example.com to https://www.example.com, but nothing matches http://www.example.com, so the server serves it as it is. You won’t see it yourself: browsers switch to HTTPS on their own, so the HTTP address seems not to exist. Audit crawlers don’t switch.

Fix it by hand

Either of these works. The first needs no server access.

1. In Joomla: go to System → Global Configuration → Server and set Force HTTPS to Entire Site. Joomla then redirects any HTTP request to HTTPS. Make sure HTTPS works on your site first, or you can lock yourself out of the administrator.
2. On the server: add one rule to .htaccess (Apache or LiteSpeed hosting) that sends every HTTP request, and the host you don’t use, to your chosen address in a single redirect. Put it straight after RewriteEngine On and replace example.com with your own domain:

   RewriteCond %{HTTPS} off [OR]
   RewriteCond %{HTTP_HOST} ^example\.com$ [NC]
   RewriteRule ^(.*)$ https://www.example.com/$1 [R=301,L]

   If your site is on the bare domain rather than www., use ^www\.example\.com$ in the second line and https://example.com/$1 in the third. If your site sits behind a proxy or CDN such as Cloudflare, use its “Always use HTTPS” setting instead.

To check, request the HTTP address without a browser, for example curl -I http://www.example.com/. It should answer 301 with a Location on https://.

Fix it with MetaGen

MetaGen’s HTTP to HTTPS redirect check requests your home page over HTTP, on both the www. and bare host, and warns when either loads instead of redirecting. Its button opens Global Configuration, where Force HTTPS is set.

MetaGen is free for Joomla 5 and 6. See all the SEO warnings MetaGen checks.