: Does Facebook Need both og:image and og:image:secure_url for HTTPS only site? Now that I updated many of my sites to be HTTPS only, redirecting HTTP requests as needed, I did notice that sharing

@Alves908

As I understand it, if your site is 100% SSL (and everything redirects to HTTPS, so there is essentially no plain HTTP) then you only need the og:image tag in which you specify the ... URL. Although, must admit, this is not particularly clear from the OGP documentation (or Facebook Docs) - which seems to imply (by example) that the og:image URL is HTTP only - this does not appear to be the case.

The og:image:secure_url tag is used to specify an alternative HTTPS URL ("alternative" being the word used in the OGP documentation). This only appears to be required when the site supports both HTTP and HTTPS - when HTTPS is indeed an "alternative".

However, there is no harm in specifying both og:image and og:image:secure_url and pointing them both at the same ... URL. WordPress appears to do this by default. However, as mentioned, if your site is only HTTPS then there does not appear to be a need to specify og:image:secure_url as well. Both methods validate OK in the Facebook Debugger. Both methods "work" in my testing. StackExchange (which is now 100% HTTPS) uses only the og:image tag (specifying an URL) - which validates and "works" OK.


Refreshing the Share Attachment does not change anything


Not really sure what you are referring to with regards to "Share Attachment"? But problems like this are often the result of (Facebook) caching. Within the Facebook Debugger, check the "Time Scraped" and hit the "Scrape Again" button if required.

However, there have been numerous queries raised in the past regarding the failure the display the image when URLs are shared. Some "fixes" include:


Specify a different image URL.
Specifying og:image:width and og:image:height tags.
Having to wait 10 minutes for the FB cache. (!?)
Image never appearing when the URL is first shared. (Because of the FB cache.)


These all appear to relate to the FB cache, so refreshing the request via FB debugger may be the required fix.

Reference: (however, whilst this question is a few years old, I think some answers may still be relevant)

stackoverflow.com/questions/8855361/fb-opengraph-ogimage-not-pulling-images-possibly-https

Vote Up Vote Down

@Nimeshi995

Mixed content does not apply within those tags therefore the SSL will still work correctly regardless if they are HTTPS or HTTP, however the whole point of SSL is for security and privacy for your users... so, why not gone the whole distance?

Vote Up Vote Down