How bad is it to have duplicate content across http:// and https:// versions of the site?

[RG_SEO]

A lot of pages on our website are currently indexed on both their http:// and https:// URLs. I realise that this is a duplicate content problem, but how major an issue is this in practice?

Also, am I right in saying that the best solution would be to use rel canonical tags to highlight the https pages as the canonical versions?

[RG_SEO]

Thank you both - and sorry for not replying earlier. It sounds like we have some work to do

[Mobilio]

There isn't best solution in this case.

All you need is to prefer some http or https and to migrate everything to preferred protocol. This mean that you shoud:

1. Make 301 redirects
2. Fix all canonicals
3. Do site move in SearchConsole. This is tricky because you need to verify both properties there and move one of them to other.
4. Fix all internal links in pages to avoid 301 redirects
5. Fix all images/scripts and other content to avoid 301 redirect

In theory this is. As you can see "fix canonical" is just one small step there.

[DirkC]

The biggest problem with duplicate content (in most cases) is that you leave it up to Google (or search engines in general) to decide to which version they are going to send the traffic.

I assume that if you have a site in https you would want all visits to go to the https version. Rather than using a canonical url (which is merely a friendly request) I would 301 the http to the https version.

Dirk