I have an issue that I can't figure out - can somebody please help. 

Last week while doing a Google search for a product on my website I entered the product manufacturer part number "11941-2" in Google search window. The result listing (1st page Google) (just tried it again today) revealed this funny url:

https://secure.wf-api.com/www.boatersmarinesupply.com/m7/43898--attwood-kayak-18-foot-braces-pair.html which isn't my product listing url but some secure, indexed url (the https://secure.wf-api.com) is associated with my host Websiteforge. THERE ARE NOW 2 MILLION OF THESE SECURE URLS FOR MY DIFFERENT PRODUCTS (I only sell 11,000 products!). Please do a Google search for "11941-2" and you get the listing below:

11941-2 Attwood Kayak 18" Foot Braces - PairVEHICLES & PARTS
...https://secure.wf-api.com/.../43898--attwood-kayak-18-foot-braces-p...Cached
Kayak 18" Foot Braces - Pair Part #: 11941-2 Ligthtweight design fits both sit in and sit on top style kayaks. Trigger lock design allow for easy adjustment. Tracks ...

When I clicked on the listing (last week) it went to my 404 page! I reported this to my web host "WebsiteForge.com" to ask what was up? They responded that they found an error that prevented the 301 redirect from working and think they fixed it. Now when you click the listing it is redirecting correctly to here: http://www.boatersmarinesupply.com/m7/43898--attwood-kayak-18-foot-braces-pair.html .

I asked why are my products being listed this way to begin with? They (websiteforge) responded: "We cannot tell where the links are being indexed from - we can tell that it's not from our system or the sitemap. Where ever they are coming from - any incoming secure URLs will be redirected to the correct, non-secure version" now. Still not answering what's creating these secure url listings and why my correct urls are not listing?

I'm totally confused! Why is this happening? And why aren't my products listing correctly?

Important: My Google "Webmaster tools" account is now showing 2 million of these indexed: secure.wf-api.com url listings rather than my correct product urls. I don't know what's causing this? where these are being created?, How there could be 2 million (since I only sell 11,000 products)?, Why my actual products are not being listed with my correct url? Is my webhost at fault? Where are these coming from? How is this hurting my SEO, bounce rate?, etc.

Can somebody please help me to figure all this out and tell me if this is hurting?

It is a bit odd Google Webmaster Tools would show you URLs for "secure.wf-api.com" unless you are listed as the owner of that domain.... But if somehow you have access to that in Google Webmaster Tools, then you can also see where it found the URLs. See "Diagnostics" - "Crawl Errors" (Maybe an external website is linking to lots of wrong URLs.)

If you think it is an internal website problem, you could try run e.g. A1 Website Analyzer (or a similar website and link checker tool) against it. You should probably stop it after half an hour (2 million URLs would otherwise take a very long time.) using A1WA you can see where all the URLs are used/linked/redirected from internally in your website.

Thanks for your help!  These are showing up in webmaster tools in the Links to your site not "Diagnostics crawl errors"

I see them here:
Links to your site:
  Domains Total links "wf-api.com" 1,826,990
They are somehow linked to my site categories: like this:
Marine Plumbing - links 9,959
/Boat Electrical_Accessories links - 9,758
http://www.boatersmarinesupply.com/ links -9,699
/Compact Digital Cameras links - 9,241
/Life Jacket_ links - 9,220
/Raymarine_Accessories links - 9,220
& many more.....

I selected the top one "Marine Plumbing" and this is a sample of what I get:

htt​ps:​//s​ecu​re.​wf-​api​.co​m/w​ww.​boa​ter​sma​rin​esu​ppl​y.c​om/​20m​7/a​ll-​pro​duc​ts/​ind​ust​ria​l-c​omm​erc​ial​.ht​ml?​i60​916​3:p​age​=51   Via this intermediate link:htt​ps:​//s​ecu​re.​wf-​api​.co​m/w​ww.​boa​ter​sma​rin​esu​ppl​y.c​om/​Mar​ine Plu​mbi​ng 

htt​ps:​//s​ecu​re.​wf-​api​.co​m/w​ww.​boa​ter​sma​rin​esu​ppl​y.c​om/​20m​7/a​ll-​pro​duc​ts/​plu​mbi​ng/​mar​ine​-pl​umb​ing​-sy​ste​ms.​htm​l?i​609​163​:pa​ge=​6   Via this intermediate link:htt​ps:​//s​ecu​re.​wf-​api​.co​m/w​ww.​boa​ter​sma​rin​esu​ppl​y.c​om/​Mar​ine Plu​mbi​ng 

htt​ps:​//s​ecu​re.​wf-​api​.co​m/w​ww.​boa​ter​sma​rin​esu​ppl​y.c​om/​Boa​t_L​igh​ts?​m7:​cat​=%2​FAl​l%2​0Ca​teg​ori​es%​2FL​IGH​TS%​20-​%20​SPO​T%2​F%2​FFL​OOD​%2F​%2F​UND​ERW​ATE​R&i​609​163​:pa​ge=​5    Via this intermediate link:htt​ps:​//s​ecu​re.​wf-​api​.co​m/w​ww.​boa​ter​sma​rin​esu​ppl​y.c​om/​Mar​ine Plu​mbi​ng 

htt​ps:​//s​ecu​re.​wf-​api​.co​m/w​ww.​boa​ter​sma​rin​esu​ppl​y.c​om/​m7/​105​10-​-xi​nte​x-m​s-2​-ga​sol​ine​-pr​opa​ne-​sen​sor​.ht​ml
Via this intermediate link:htt​ps:​//s​ecu​re.​wf-​api​.co​m/w​ww.​boa​ter​sma​rin​esu​ppl​y.c​om/​Mar​ine Plu​mbi​ng 

When I select the link they auto redirects to the "Via this intermediate link:" to my correct web page.

Any ideas who or what is doing this?  and why would all these be getting indexed? Is this cause the 303 redirect wasnt working?  Immagine 2 million indexed links from: htt​ps:​//s​ecu​re.​wf-​api​.co​m   By the way this is my webhosts domain!  But they're saying they are not creating these?  They say they don't know where from?  Really got me puzzled cause I don't know if this is hurting the thousands of hours of SEO I've done. 

Thanks again - I'll look forward to hearing - RM 

I would at first check that you have no links from your website pointing to the wrong domain. If you don't, then I think everything will go in order by itself assuming wp-api domain is no longer showing your content. (You can also check who-is owner of the domain in question. Could it possibly some kind of cache or content-hosting domain of some sort if not your webhost's?)