http serves the page instead of redirecting to https

What this means

The http address returns the page directly on its own address while the https equivalent also returns 200, so nothing forwards visitors to the secure version. Anyone who reaches the http URL from an old link, a bookmark or a typed address stays on an unencrypted connection, and search engines keep the http URL in the index as a competing copy of the https one. This check does not compare the two response bodies, so unlike the duplicate-serving check it also fires where the two schemes serve related but not identical pages.

How to fix it

Add a server- or edge-level 301 from http to the matching https URL for every path, and follow it with an HSTS header so repeat visitors never issue the plaintext request again.

Fix effort

This check needs a developer fix: it turns on a routing, hosting or infrastructure decision that no automatic edit can make safely.

Authoritative source

https://developers.google.com/search/docs/crawling-indexing/https