HTTPS is the secure version of HTTP. It encrypts data between browser and server and is a light Google ranking signal.
HTTPS is the secure version of HTTP, the protocol browsers use to load web pages. It encrypts the data passing between a visitor’s browser and your server, so nobody in between can read or change it, and it’s a confirmed, if light, Google ranking signal.
The “S” stands for secure. It works through a TLS certificate (still often called an SSL certificate) installed on your server. When a site has one, the address starts with https:// and browsers show it as a secure connection.
For most sites this is settled: almost every page you visit already uses HTTPS. But we still find sites with mixed content, old HTTP links and messy redirects left over from a half-finished move, and those cost crawl budget and trust.
How HTTPS works
HTTPS works by setting up an encrypted connection before any page content is sent. The browser checks the site’s certificate to confirm it really is the domain it claims to be, then the two agree on keys to encrypt everything that follows.
That protects three things:
- Privacy. Form entries, logins and payment details can’t be read in transit.
- Integrity. Nobody on the network can inject ads or code into your pages.
- Authentication. Visitors know they’re on your site and not an imitation.
Why HTTPS matters for SEO
HTTPS matters for SEO because Google uses it as a ranking signal and because browsers warn people away from sites without it. Google announced HTTPS as a lightweight ranking signal in 2014. On its own it won’t lift a weak page above a strong one, but it can act as a tiebreaker between similar results.
The bigger effect is on people. Since Chrome 68 in July 2018, Chrome has labelled HTTP pages as “Not secure” in the address bar. A warning like that next to your brand name puts visitors off, and lower engagement and fewer enquiries follow.
There are practical reasons too. Modern browser features, including HTTP/2 in most browsers, only run over HTTPS, and HTTP/2 helps page speed. Referral data is also more reliable: when a visitor goes from an HTTPS site to an HTTP one, the referrer is usually stripped, so your analytics loses the source.
HTTP vs HTTPS at a glance
| HTTP | HTTPS | |
|---|---|---|
| Encryption | None, data travels as plain text | Encrypted with TLS |
| Browser label | “Not secure” in Chrome | Shown as a secure connection |
| Google ranking signal | No | Yes, a lightweight one |
| HTTP/2 support in browsers | No | Yes |
| Certificate needed | No | Yes, often free |
How to move a site to HTTPS
Moving to HTTPS is a site migration in miniature: every URL changes, so you need to tell browsers and Google where everything has gone. Plan it the same way you’d plan any website migration.
- Get a certificate. Most hosts include one, and Let’s Encrypt issues them free. A standard domain-validated certificate is enough for most sites.
- Install it and test the HTTPS version. Check that pages load over https:// before you redirect anything.
- Update internal links and resources. Change hard-coded http:// links, images, scripts and stylesheets to HTTPS. Anything left on HTTP causes mixed content warnings.
- Set up 301 redirects. Redirect every HTTP URL to its HTTPS equivalent, page to page, in a single hop. Don’t send everything to the homepage.
- Update canonicals, hreflang and sitemaps. All of them should point to the HTTPS URLs.
- Check robots.txt. Make sure the HTTPS version isn’t blocking anything the HTTP version allowed.
- Add the site to Search Console. A Domain property covers both protocols. Submit the HTTPS sitemap and watch the Page indexing report.
- Turn on HSTS once it’s stable. HTTP Strict Transport Security tells browsers to always use HTTPS for your domain. Start with a short max-age and increase it once you’re confident.
After the move, crawl the site to catch redirect chains, broken links and leftover HTTP references. Our guide to technical SEO covers the wider checks that sit around this.
Common HTTPS problems we find
The most common problem is a move that was never finished. These are the issues that turn up most often in audits:
- Mixed content, where an HTTPS page loads images or scripts over HTTP
- Redirect chains, such as HTTP to HTTPS to www to a trailing slash
- Canonical tags still pointing at HTTP URLs
- Both versions of the site resolving with a 200, which creates duplicates
- Expired certificates, which trigger full-page browser warnings
Each one is simple to fix once it’s spotted. If you’d like help checking yours, our technical SEO team can review the setup. Book a free strategy session and we’ll take a look.
Related reading: our guides to indexability and running a site crawl.
Common questions
Is HTTPS a Google ranking factor?
Yes. Google confirmed HTTPS as a ranking signal in 2014. It’s a light signal, so it won’t outrank better content on its own, but there’s no good reason for a site to be without it.
Will moving to HTTPS hurt my rankings?
A well-planned move with page-to-page 301 redirects shouldn’t cause lasting harm. You may see some movement for a few weeks while Google recrawls the site, and problems usually come from missed redirects or mixed content.
Is an SSL certificate the same as a TLS certificate?
In everyday use, yes. SSL is the older protocol and TLS replaced it, but the certificates are still widely called SSL certificates. Whatever the name, it’s the certificate that enables HTTPS.
Do I need to pay for an SSL certificate?
Usually not. Let’s Encrypt issues free certificates and most hosts install one for you. Paid certificates mainly add support or extra validation, which most sites don’t need.
