By SitemapFixer Team
Updated October 2026

HTTP URLs in an HTTPS Sitemap: Fixing Mixed Protocols and Hosts

Find sitemap URLs that redirectCheck My Sitemap

Short answer: after a move to HTTPS (or to www, or a new domain), many sitemaps keep listing the old http:// addresses. The sitemap protocol says every URL must use the same protocol and host as the sitemap file. Old URLs that redirect also aren’t the pages you want indexed. Rebuild the sitemap so it lists only the final https:// URLs on your one preferred host, then resubmit it.

Looking for the browser’s “mixed content” warning (an https page loading http images or scripts)? That is fixed in your page code, not your sitemap.

What goes wrong

  • Rule break: an https:// sitemap listing http:// URLs, or example.com URLs in a sitemap on www.example.com, mixes protocols or hosts. Search Console can report such URLs as “URL not allowed”. See Invalid URL and URL not allowed.
  • Redirects instead of pages: each old URL redirects, so in the Page indexing report (filtered to “All submitted pages”) they pile up as Page with redirect.
  • Mixed canonical signals: the sitemap names the http version while the redirect and the canonical tag name the https version. Google prefers HTTPS as canonical when both exist, but you’re asking it to resolve a conflict you created.

How to find the old URLs

# every sitemap URL not on your exact https host
curl -s https://www.example.com/sitemap.xml | grep -o '<loc>[^<]*' | sed 's/<loc>//' \
  | grep -v '^https://www\.example\.com/'

# also check what robots.txt points to
curl -s https://www.example.com/robots.txt | grep -i '^sitemap:'

The robots.txt line matters too: a Sitemap: http://... line still sends crawlers to the old address.

How to fix it

  1. Fix the source setting. In WordPress, set both “WordPress Address” and “Site Address” under Settings → General to the https URL. In other CMSs and frameworks, update the base or site URL setting.
  2. Rebuild the sitemap (or let the plugin regenerate it) and confirm every <loc> starts with your exact https host.
  3. Update robots.txt so the Sitemap: line uses the https URL.
  4. Keep the redirects from every http URL to its https version, and make canonical tags use https.
  5. Submit the https sitemap in the Search Console property for the https site, and check the submitted-pages view of the Page indexing report.

The free sitemap checker tests 30 URLs from your sitemap and lists any that redirect, with the target, so leftover http entries show up straight away.

Frequently asked questions

Can a sitemap list both http and https URLs?

No. The sitemap protocol says every URL must use the same protocol and host as the sitemap file. An https sitemap should list only https URLs on the same host.

My http URLs redirect to https. Isn’t that enough?

The redirect protects visitors, but the sitemap still asks Google to crawl URLs that only redirect. List the final https URLs instead.

Is this the same as the browser’s "mixed content" warning?

No. Browser mixed content means an https page loads images or scripts over http. That is fixed in the page code, not the sitemap. This page is about the URLs listed in your sitemap.

Where do the old http URLs come from?

Usually from a CMS whose site address setting still says http, a static sitemap file that was never rebuilt after the move, or a hard-coded base URL in custom code.

Find redirecting URLs left in your sitemap
Free - reads your sitemap and tests 30 URLs live
Check My Sitemap Free

Related guides