As I understand it, if your site is 100% SSL (and everything redirects to HTTPS, so there is essentially no plain HTTP) then you only need the
og:image tag in which you specify the
https://... URL. Although, must admit, this is not particularly clear from the OGP documentation (or Facebook Docs) - which seems to imply (by example) that the
og:image URL is HTTP only - this does not appear to be the case.
og:image:secure_url tag is used to specify an alternative HTTPS URL ("alternative" being the word used in the OGP documentation). This only appears to be required when the site supports both HTTP and HTTPS - when HTTPS is indeed an "alternative".
However, there is no harm in specifying both
og:image:secure_url and pointing them both at the same
https://... URL. WordPress appears to do this by default. However, as mentioned, if your site is only HTTPS then there does not appear to be a need to specify
og:image:secure_url as well. Both methods validate OK in the Facebook Debugger. Both methods "work" in my testing. StackExchange (which is now 100% HTTPS) uses only the
og:image tag (specifying an
https:// URL) - which validates and "works" OK.
Refreshing the Share Attachment does not change anything
Not really sure what you are referring to with regards to "Share Attachment"? But problems like this are often the result of (Facebook) caching. Within the Facebook Debugger, check the "Time Scraped" and hit the "Scrape Again" button if required.
However, there have been numerous queries raised in the past regarding the failure to display the image when URLs are shared. Some "fixes" include:
- Specify a different image URL.
- Having to wait 10 minutes for the FB cache. (!?)
- Image never appearing when the URL is first shared. (Because of the FB cache.)
These all appear to relate to the FB cache, so refreshing the request via FB debugger may be the required fix.
Reference: (however, whilst this question is a few years old, I think some answers may still be relevant)