Why does Google Index Http Urls?

Question

I have a free SSL certificate (brand new website), redirected all HTTP URLs to HTTPS. In my sitemap, all URLs are HTTPS. I added my sitemap to the Google search console. However, when I search my posts in Google, HTTP URLs appear in the results. Is this a bad situation for Seo? How can I prevent indexing HTTP URLs? Should I? I really don't know why do my pages appear as HTTP in the results.

Answer 1

I can't think of any reason besides these. It could also be bug on Google's end.

I'm assuming we've already ruled out automatic redirection per Max's question and your answer.

Directory & File Permissions are Not Set Properly

If your directory/file permissions are set up incorrectly it is possible that your whole file structure could be indexed. The redirects could be perfectly fine and this could happen if certain files/directories are accessible.

Permissions that would allow this would also present a large security vulnerability. For proof that this can happen please see this Google Support answer.

Do a site: search like MrWhite asked - if this is the case, it will be very obvious.

Also as MrWhite asked - make sure you've set up the property in Google Search Console. I recommend using the Domain Property option.

---

I use this command a lot after freshly installing WordPress on Ubuntu + Nginx/Apache.

chown -R www-data: /var/www/html
find /var/www/html -type d -exec chmod 750 {} \;
find /var/www/html -type f -exec chmod 640 {} \;

As root of course.

---

Ensure Canonical URLs are not HTTP

Within Search Console, use the URL inspection tool to check what your User Declared Canonical is. This it will show the status of the page when Google last crawled it.

If you see http update your canonical URLs to use https. If there is no User Declared Canonical, it means that you don't have them set - which you should then change, and go back to Search Console and request indexing to your root domain.