Search for my web site returns HTTPS results

Question

My home page is set to Google and Google adds ?gws_rd=ssl to it. When I type search term form my site into search box Google returns bunch of indexes (different pages within my site) that starts with HTTPS. Obviously when user clicks on any of those it will get disturbing warning that site is not secure.

Now when my home page is set to https://google.com and I type my search terms into search box Google returns proper results.

My site has about 20 pages and all of them are simple HTML pages:

All of them contain a href to each others using relative path.

Now one my pages links to https://othersite.example.com and it is references trough the other 20 pages using absolute path.

What should I do to solve this search results. Should I use canonical in the head of the document for each of the 20 pages?

By using Google Search https... I learned that couple Facebook pages (posts) refer to my site wrongly by using HTTPS instead of HTTP. Could these couple links referencing HTTPS be the cause of this?

Answer 1

Could these couple links referencing HTTPS be the cause of this?
The answer is yes

This may not be the only reason why your website is indexed with https and not http. For example maybe your sitemap contain forgotten https links, or maybe there are some internal links with https.

How to fix this
Make a quick check so you replace any forgotten internal https links with http, check your sitemap files and add a 301 redirection from https to http to all urls.

After you add the 301 redirection, everyone that visits your website using the https will be redirected to http.

Because of 301 (permanent redirection), Google will remove the https links and replace them with http links. Please note that this may take some days or more, as Googlebot has to recrawl your website a couple of times (after you have add the 301 redirection), in order to change the links.

How to add 301 redirecion
You can add the 301 redirection header either in code or on webserver's configuration.

Answer 2

Google recommends you use canonical URLs for content

These two URLs are different and in the absence of any information, Google will make a best guess as to the canonical version.

http://www.domain.com

and

https://www.domain.com

Set HTTP as The Canonical URL

Since Google has already indexed pages as HTTPS, I recommend you use a 301 redirect for all HTTPS pages.

Options +FollowSymLinks
RewriteEngine on
RewriteCond %{SERVER_PORT} !^80
RewriteRule ^(.*) http://www.domain.com/ [R=301,L]

Replace www.domain.com with your canonical domain name.

If placed in the top level directory of your site, this will make your entire site HTTP only. If you have directories that require HTTPS, then you will need a more complicated ruleset to exempt those directories from the redirect above.

For example, you may have contact forms that need to be HTTPS. In this case you would exempt them from the rules above and then add rules to force them to be HTTPS.

Self-Signed Certificates

I recommend that you replace the self-signed SSL certificate with a paid one. It may take some time for Google to update their links. If you do not do this, then site visitors will get an SSL warning message in their browsers.

If you purchase a certificate, then they will not get a warning and the redirect code will send them to the non-HTTPS version of the site.

Relative Paths

With relative paths, once a URL is loaded with HTTPS, then all other links will also be HTTPS. This can be highly problematic for bots, site map generators and other tools.

So you should not only choose between a canonical domain (www.domain.com vs. domain.com) but also if your site should be exclusively HTTP or HTTPS.