The same page is served on both http and https

What this means

For the same hostname, the http and the https address both return 200 on their own address rather than redirecting, and the two documents hash identically. Google treats them as two separate URLs holding one page, so links, engagement and freshness are divided between the copies, and the insecure copy is the one browsers flag as not secure. The comparison uses a sha256 of the first 200KB of each response body: where the hashes differ the check reports nothing, because different content per scheme is a different and rarer problem.

How to fix it

Pick https as the single canonical scheme and 301-redirect every http request to it at the server or CDN edge, then send an HSTS header so browsers stop issuing the plaintext request at all.

Fix effort

This check needs a developer fix: it turns on a routing, hosting or infrastructure decision that no automatic edit can make safely.

Authoritative source

https://developers.google.com/search/docs/crawling-indexing/https