Q: For my HTTPS migration, is rel=canonical enough or do I need real 301 redirects?

Q: For my HTTPS migration, is rel=canonical enough or do I need real 301 redirects?

Great question, and the answer surprises people: for HTTP to HTTPS, canonicals alone aren't enough.

Short answer: use 301 redirects from http to https. Treat canonical as a backup signal, not the main move.

Long answer:
A 301 is a directive — it forces every visitor and bot to the secure URL and passes signals cleanly. A canonical is a hint Google can ignore, and it leaves the insecure URL reachable, which risks duplicate content and mixed-signal confusion.

For HTTPS specifically, you also want HSTS (a header that tells browsers 'only ever use https here') once redirects are stable — it removes the redirect hop entirely for repeat visitors.

Keep canonicals too, pointing at the https version, but they back up the 301, not replace it.

Next step: enforce site-wide http→https 301s, confirm no mixed-content URLs, then add HSTS once you're confident.