HTTPS and SSL

HTTPS (Hypertext Transfer Protocol Secure) is the secure version of HTTP, the protocol used to send web pages to browsers. It encrypts data between the visitor and the website using an SSL/TLS certificate. You can tell a site uses HTTPS when its address starts with https:// and the browser shows a padlock.

Written by Paul Hoda, SEO consultant since 2005. Last updated 8 November 2026.

Why HTTPS matters for SEO

  • It is a confirmed ranking signal. Google announced HTTPS as a lightweight ranking factor in 2014 and includes it in its page experience signals. On its own it will not lift a weak page, but it can separate similar pages.
  • Browsers warn users about HTTP. Chrome and other browsers mark HTTP pages as “Not secure”, especially on forms, which damages trust and conversions.
  • Referral data is kept. When traffic passes from an HTTPS site to an HTTP site, referral information is stripped, so analytics become less accurate.
  • Modern features require it. Faster protocols such as HTTP/2 and HTTP/3, and many browser features, only work over HTTPS.
  • It protects your visitors from having form data, logins and payment details intercepted.

SSL vs TLS

SSL is the older name. Modern certificates actually use TLS (Transport Layer Security), but “SSL certificate” is still the common term. Free certificates from Let’s Encrypt are just as good for SEO as paid ones; paid certificates mainly add company validation and warranties.

How to move from HTTP to HTTPS

Switching to HTTPS is a small Website Migration, so plan it properly:

  1. Install a valid certificate covering every subdomain you use, including www.
  2. Update all internal links, images, scripts and stylesheets to HTTPS.
  3. Add site-wide 301 redirects from every HTTP URL to its HTTPS equivalent.
  4. Update canonical tags, Hreflang and structured data URLs.
  5. Update your XML Sitemap and submit it.
  6. Add the HTTPS property in Google Search Console (a domain property covers all versions).
  7. Update external profiles, ads and important backlinks where possible.
  8. Monitor traffic and indexing for several weeks.

Common HTTPS problems

  • Mixed content: an HTTPS page loading images or scripts over HTTP, which triggers browser warnings or blocks content.
  • Expired certificates, which show a full-page security warning and stop most visitors.
  • Redirect chains between http, https, www and non-www versions (see Redirect Chains).
  • Both versions accessible, creating Duplicate Content.
  • HSTS misconfiguration that makes recovery difficult if the certificate fails.

HSTS

HTTP Strict Transport Security (HSTS) tells browsers to always use HTTPS for your site, which improves security and saves a redirect for returning visitors. Enable it once you are confident HTTPS works everywhere, starting with a short max-age.

Checking your setup

Visit your site at all four combinations (http and https, with and without www) and confirm each lands on the same final URL in one redirect. Use an SSL checker to confirm the certificate chain, expiry date and protocol support, and set a reminder or automatic renewal so it never lapses.

Key Takeaways

  • HTTPS encrypts data and is a lightweight ranking signal.
  • Browsers warn visitors about insecure HTTP pages.
  • Free certificates work as well for SEO as paid ones.
  • Treat an HTTP to HTTPS move as a small migration with full 301 redirects.
  • Fix mixed content and set certificates to renew automatically.

Related Terms

Want to know where your site stands? Book a free SEO health check, or keep learning in the SEO Encyclopedia.