Dealing with non-canonical http vs https?

[GOODSIR]

We're working on a complete rebuild of a client's site. The existing version of the site is in WordPress and I've noticed that the site is accessible via http and https. The new version of the site will have mostly or entirely different URLs.

It seems that both http and https versions of a page will resolve, but all of the rel-canonical tags I've seen point to the https version.

Sometimes image tags and stylesheets are https, sometimes they aren't.

There are both http and https pages in Google's index.

Having looked at other community posts about http/https, I've gathered the following:

• http/https is like two different domains.
• http and https versions need to be verified in Google Webmaster Tools separately. Set up the preferred domain properly.
• Rel-canonicals and internal links should have matching protocols.

My thought is that we will do a .htaccess that redirects old URLs regardless of the protocol to new pages at one protocol. I would probably let the .css and image files from the current site 404.

When we develop and launch the new site, does it make sense for everything to be forced to https? Are there any particular SEO issues that I should be aware of for a scenario like this?

Thanks!

[GOODSIR]

Thank you Michael.

[MichaelC-15022]

You're on the right track.  Force it all to https, and keep the rel=canonical pointing to https versions.

Check out this thread of questions to Google's John Mueller on this topic:

Make sure you test very thoroughly before launching the https-only version: you'll run into issues with things like images, CSS, Jscript referenced via http instead of relative or protocol-free referencing.  Same goes for your internal links: you don't want to throw away a ton of link juice (even if only 5% at a time) because of 301 redirects from http to https that you could have fixed :-).