Should you really remove HTTP from the sitemap when migrating to HTTPS?

Why does Google insist on having only HTTPS in the sitemap?

The XML sitemap is an intent signal sent to Google. By including HTTPS URLs, you clearly indicate which canonical version to index. Googlebot prioritizes crawling the URLs in this file, and pointing to HTTP while the site is migrating creates unnecessary ambiguity.

This confusion slows down crawling: Googlebot discovers the HTTP URL in the sitemap, crawls it, detects the 301 redirect to HTTPS, and then crawls the HTTPS version again. You're wasting crawl budget, delaying the full indexing of the new secure version.

Are 301 redirects enough to compensate for a poorly configured sitemap?

Google states that a sitemap pointing to HTTP does not pose a "major problem" if redirects are functioning. In practice, this is true: Googlebot follows the 301 and eventually indexes HTTPS. But this approach is suboptimal.

301 redirects temporarily dilute internal PageRank and slow down the transfer of signals. Some third-party crawlers or alternative engines manage redirect chains less effectively. So, technically it works, but you're leaving performance on the table.

What happens when mixing HTTP and HTTPS in the sitemap?

Google treats each URL individually. If 90% of the sitemap is in HTTPS and 10% remains in HTTP by error, the 10% HTTP URLs will be crawled, redirected, and then indexed as HTTPS. No disaster, but a waste of time and resources.

The real risk concerns large sites: on a site with 100,000 pages, a mixed sitemap can extend the migration by several weeks. Google may also interpret this mix as a sign of incomplete migration and temporarily keep the old version in the index.

• The XML sitemap must point exclusively to HTTPS URLs after migration.
• 301 redirects from HTTP to HTTPS are essential but do not compensate for a poorly configured sitemap.
• A mixed sitemap slows down crawling, consumes budget, and delays full indexing.
• Google will eventually index HTTPS even with an HTTP sitemap, but the transition will be slower and less efficient.
• On large sites, each day of confusion between HTTP and HTTPS can result in thousands of uncrawled pages.

Is this statement consistent with field observations?

Yes, absolutely. We regularly observe HTTPS migrations where the sitemap remains in HTTP out of negligence. In 100% of cases, Google eventually indexes HTTPS thanks to 301 redirects. However, the average complete indexing delay shifts from 2-3 weeks (clean sitemap) to 5-8 weeks (HTTP sitemap).

The term "major problem" used by Google is telling: it’s not blocking, but it’s far from optimal. On e-commerce sites with thousands of product listings, this latency translates to a temporary drop in organic traffic during the blurry transition period.

What nuances should be considered regarding this rule?

Google simplifies for the general public. In reality, three factors determine the impact of an HTTP sitemap on an HTTPS migration: the site size, the usual crawl frequency, and the quality of redirects.

A site with 50 pages and a daily crawl? The impact of an HTTP sitemap is negligible; Google will correct it in a few days. A site with 500,000 pages crawled every 15 days? That's another story. The last pages migrated may remain in HTTP in the index for months.

Another point: Google does not specify what it means by "redirects correctly". A 301 redirect to HTTPS is the minimum. But a 302 (temporary) redirect or a chain of redirects (HTTP → www HTTPS → non-www HTTPS) complicates everything. [To be verified]: Does Google tolerate redirect chains during HTTPS migrations without PageRank penalties? Officially yes, but unofficially observations vary.

In what cases does this rule not apply?

If you manage a site with multiple local versions (ccTLDs or international subdomains), the HTTPS migration must be synchronized across all domains simultaneously. A mixed sitemap on one local version while others are 100% HTTPS creates contradictory signals for hreflang.

Another edge case: sites with mixed content (HTTPS pages embedding HTTP resources). Google can index HTTPS but display a "not secure" warning in Chrome, degrading the click-through rate. The HTTPS sitemap does not resolve this issue — all internal resources must be audited.

What should be done during an HTTPS migration?

The first action is to update the XML sitemap before submitting the migration in Google Search Console. Replace all HTTP URLs with their HTTPS equivalents. Do not leave any residual HTTP URLs, even if they redirect correctly.

Next, submit the new HTTPS sitemap via Search Console and use the change of address tool to explicitly report the migration. Google will prioritize crawling the sitemap and understand that HTTPS is now the canonical version. For 4-6 weeks, monitor the coverage report to ensure that HTTP URLs gradually disappear from the index.

What mistakes should be avoided during the transition?

A classic mistake is leaving an old HTTP sitemap accessible at its historical URL. Google may continue to crawl it if the old robots.txt or backlinks still point to it. Remove or redirect the old sitemap to the new one in HTTPS.

Another trap is forgetting secondary sitemaps (images, videos, news). If your main sitemap is in HTTPS but the image sitemap remains in HTTP, you send contradictory signals. Update all sitemap files in a single coherent operation.

How can you check that the migration is being properly recognized?

Use the command site: in Google to compare the number of indexed URLs in HTTP versus HTTPS. In the days following the migration, you should see the HTTP results drop rapidly. If after 3 weeks massive HTTP URLs persist, your sitemap or redirects may be problematic.

Another check: analyze the server logs. If Googlebot continues to primarily crawl HTTP URLs several weeks after migration, your sitemap has likely not been properly updated or internal links still point to HTTP. Fix the source of the problem, not just its symptoms.

• Update all sitemaps (main, images, videos, news) to HTTPS before submitting the migration.
• Submit the new HTTPS sitemap via Google Search Console and use the change of address tool.
• Ensure that the old HTTP sitemap is removed or redirected in 301 to the new one.
• Check the Search Console coverage report weekly for a minimum of 6 weeks.
• Analyze server logs to confirm that Googlebot is correctly crawling HTTPS URLs.
• Audit internal linking to eliminate any links still pointing to HTTP.