Will installing SSL certificate cause duplicate content penalty?

Question

I'm running a VPS server and for so many years, I've been using http:// for my main website. In fact, to even avoid www and non-www issue, duplicate content issues, etc. in search engines, I even have the below code in my .htaccess currently:

RewriteEngine On
Options +FollowSymlinks
RewriteBase /
RewriteCond %{HTTP_HOST} !^www.example.com$ [NC]
RewriteCond %{REQUEST_URI} !^/[0-9]+\..+\.cpaneldcv$
RewriteCond %{REQUEST_URI} !^/[A-F0-9]{32}\.txt(?:\ Comodo\ DCV)?$
RewriteRule ^(.*)$ http://www.example.com/$1 [L,R=301]

Aside from the above, I use absolute path showing http:// for internal links to deter content scrapers.

Now, recently, due to an update in WHM/cPanel, and because Comodo/cPanel is now issuing free SSL certificates, and AutoSSL is enabled by default, I noticed that I can now access the https:// version of my site. That is, if I type https:// manually, the browser will state it is secure. For one, that is a good thing, since I'm planning to migrate to https:// in the future and I believe my site is ready for that I believe. But I don't plan to do the migration now, since that would be a very time consuming process.

Given my conditions above, if I just leave AutoSSL enabled by default and the free Cpanel certificate installed in my domain name, will this cause duplicate content issues for many search engines since I believe they see http and https as different sites? Because I'm not very sure if major search engines are smart enough to think that although the https:// version of my site is apparently accessible, my links are still all http:// . What is your suggestion?

Answer 1

You will run into duplicate content issues sooner or later. It is just a matter of time.

You have two choices, three actually, but really just two.

1] Redirect HTTP to HTTPS or HTTPS to HTTP. I recommend HTTP to HTTPS since you seem to have what you need, however I understand not taking the leap. HTTPS adds an additional Trust factor. However, not wanting to take the leap today, which is perfectly understandable, you can just make sure that there is a redirect from HTTPS to HTTP.

2] Add a canonical tag in each page that points to the same page using either HTTP or HTTPS. Since you seem to prefer HTTP for now I suggest pointing to HTTP.

3] Do nothing. I do not recommend option 3. [insert cheesy grin]

Of the options, option 1 is the easiest. Redirecting HTTPS to HTTP for now will solve the problem quickly.

Here is a Q&A on just your scenario: https://stackoverflow.com/questions/12999910/https-to-http-redirect-using-htaccess

Answer 2

SSL is of utmost importance to implement now. As of January 1st 2017, chrome will begin telling users that the site they are visiting is not secure if an SSL certificate is not installed (source: https://security.googleblog.com/2016/09/moving-towards-more-secure-web.html)

Secondly, Site's with SSL will receive a rank boost upon switching to https.

Adding a canonical tag would not be a solution, as this is not how canonical tags were meant to be interpreted. Canonicals are seen only as suggestions to search engines, and may or may not be acknowledged. Additionally, canonicals are meant to show a search engine the "main" page that another page intends to represent, when content is similar enough than the page that you want indexed in search engines. This only helps to avoid duplicate content issues.

This is what you should do. Be sure to chose either the www version of your site, or non-www version. You can denote this within Google Webmaster Central, as well as using the .htaccess file. Secondarily, use the .htaccess file to redirect http to https. Hope that this helps.