HTTPS Migration

An HTTPS migration is the process of moving a website from insecure HTTP URLs to encrypted HTTPS URLs, using an SSL/TLS certificate. Done properly, every old URL redirects to its secure version, so visitors, links and search rankings carry across with little or no disruption.

Written by Paul Hoda, SEO consultant since 2005. Last updated 8 November 2026.

What HTTPS migration involves

HTTPS encrypts the connection between a browser and your server, protecting data in transit. Our guide to HTTPS and SSL covers how certificates work.

Moving to HTTPS changes every URL on the site, because http://example.com/page and https://example.com/page are different addresses to a search engine. That makes it a form of website migration, even though the content stays the same.

Why it matters for SEO

  • Google announced HTTPS as a lightweight ranking signal in 2014, and later made it part of its page experience signals.
  • Chrome labels HTTP pages as “Not secure”, which puts visitors off, especially on forms and checkouts.
  • Many modern browser features, and HTTP/2 in most browsers, require HTTPS.
  • When both versions exist, Google generally prefers to index the HTTPS version.

Today almost all sites on the first page of results use HTTPS, so the question is no longer whether to migrate, but how to do it cleanly.

How to migrate to HTTPS

  1. Install a certificate. Many hosts offer free certificates. Make sure it covers both www and non-www versions.
  2. Crawl the HTTP site first. Keep a full list of URLs to check redirects against later.
  3. Update internal references. Change internal links, images, scripts and stylesheets to HTTPS to avoid mixed content warnings.
  4. Add redirects. Set a site-wide 301 redirect from each HTTP URL to the same HTTPS URL.
  5. Update signals. Point every canonical tag, hreflang annotation and structured data URL to HTTPS.
  6. Submit a new sitemap. Publish an XML sitemap listing only HTTPS URLs.
  7. Set up Search Console. Use a domain property in Google Search Console, or add the HTTPS property, and monitor indexing. Google’s Change of Address tool is not needed for a protocol change.
  8. Consider HSTS. Once everything works, an HSTS header tells browsers to always use HTTPS.

How to check it worked

  • Crawl the old HTTP URL list and confirm each one returns a single 301 to the correct HTTPS page.
  • Check browser developer tools for mixed content errors.
  • Watch the Page indexing report as HTTPS URLs replace HTTP ones over the following weeks.
  • Confirm analytics, tag managers and ad accounts use the new URLs.

Common mistakes

  • Redirecting everything to the homepage instead of the matching page.
  • Creating redirect chains, such as HTTP to HTTPS to www to a trailing slash.
  • Leaving canonical tags pointing at HTTP versions.
  • Using 302 redirects, which signal a temporary move.
  • Letting the certificate expire, which triggers full-page browser warnings.
  • Forgetting to update important external links you control, such as social profiles and your Google Business Profile.

Further reading: Google’s guide to site moves with URL changes.

Key Takeaways

  • Moving to HTTPS changes every URL, so treat it as a migration.
  • Redirect each HTTP URL to its exact HTTPS equivalent with a 301.
  • Update internal links, canonicals and sitemaps to HTTPS.
  • Fix mixed content so browsers show the page as secure.
  • Avoid redirect chains and keep the certificate renewed.

Related Terms

Curious how this applies to your website? Request a free SEO check-up, or keep learning in the SEO Encyclopedia.