HTTPS for SEO

TL;DR — HTTPSHTTPS is the encrypted version of HTTP — it uses TLS to authenticate the server and protect data in transit between a browser and a website. Google announced it as a lightweight ranking signal in 2014 and today conditionally prefers HTTPS pages as canonical; Chrome marks plain HTTP pages 'Not Secure.' is the secure, encrypted version of HTTP — the lock icon in your browser. Google gives HTTPS pages a tiny ranking nudge, but the real reasons to switch are that Chrome labels plain HTTP sites “Not Secure,” and HTTPS is now just what the web expects. Moving over is safe if you do it right: redirectA redirect sends browsers and crawlers from a requested URL to a different one. An HTTP redirect specifically is a 3xx status code paired with a Location header; meta refresh and JavaScript redirects achieve a similar navigation without being a 3xx response themselves. Permanent redirects (301/308) are Google's signal the target should be canonical; temporary ones (302/303/307) aren't. every old http:// URL to its https:// version and don’t break anything along the way.

What HTTPS is

When you load a website, your browser talks to a server. With plain HTTP, that conversation happens in the open — anyone on the network in between (your ISP, the coffee-shop Wi-Fi, an attacker) can read it or tamper with it. HTTPS is the same conversation, encrypted. The “S” stands for “Secure.” You get it by installing a TLS certificateAn SSL/TLS certificate is the file a server presents during the TLS handshake to prove who controls the domain (to a level that depends on the validation type) and to supply the public key that encrypts the connection. It's what makes https:// possible — but Google's ranking signal only checks the URL scheme, not which certificate issued it. (people still call it an “SSL certificate”) on your server.

You can see whether a page uses it in the address bar: a URL starting with https:// and usually a padlock icon. A plain http:// page in Chrome shows a “Not Secure” label instead.

HTTPS only covers the connection itself — it doesn’t vouch for what’s on the page. The padlock means the data in transit is encrypted; it says nothing about whether the site’s content is trustworthy, whether a form on the page is legitimate, or whether the business behind it is real. Phishing sites can and do run on valid HTTPS certificates.

Does HTTPS help SEO?

A little, historically. Google confirmed back in 2014 that it uses HTTPS as a ranking signal — but it’s a very small one, and Google’s own team described it as a tiebreaker at the time: if two pages are otherwise equal, the secure one might edge ahead. It is not going to lift a weak page over a strong one, and Google’s current guidance doesn’t restate a direct ranking boost from HTTPS today. Anyone promising big ranking gains “just from adding SSL” is overselling it.

The reasons that actually matter:

• Chrome says “Not Secure.” Since 2018, every HTTP page gets that warning. That scares off visitors regardless of what Google thinks.
• It’s the baseline now. An estimated 9 in 10 websites already use HTTPS (W3Techs, 2026). Being the holdout looks broken.
• Modern features need it. Lots of browser capabilities (and faster connections via HTTP/2HTTP/2 and HTTP/3 are the modern versions of the HTTP protocol. HTTP/2 multiplexes many requests over one TCP connection; HTTP/3 swaps TCP for QUIC (over UDP) so a dropped packet only stalls the one stream it belongs to, not every stream (streams still share the connection's congestion control). Neither is a Google ranking factor — the SEO payoff is indirect, through faster real-user page speed.) simply won’t work without HTTPS.

Will switching hurt my rankings?

Not if you do it carefully. Moving from HTTP to HTTPS is a kind of site migrationA site migration is any significant change to a website's URL structure, domain, platform, protocol, or hosting that can affect how search engines crawl, index, and rank it. The risk scales with how much you change at once., and the golden rule is the same as any migration: redirect every old URL to its new secure version with a 301 redirectA 301 redirect is the HTTP status code for a permanent move: it tells browsers and search engines a URL has moved for good, and it's the strongest signal for consolidating a page's ranking signals onto the new URL. Google says permanent redirects don't cause a loss in PageRank.. Done right, you keep your rankings. Done sloppily — missing redirects, broken links to images and scripts — you can lose traffic. The move itself is safe; the mistakes around it are what hurt. Evidence for this claim Google recommends permanent server-side redirects during site moves and says HTTP-to-HTTPS moves do not use the Change of Address tool. Scope: Google's site-move guide supports redirect and Search Console handling; it does not guarantee that a migration with implementation errors retains traffic. Confidence: high · Verified: 2026-07-14 Google Search Central: Site moves with URL changes

Want the full picture — how much the signal really weighs, the step-by-step migration, mixed contentMixed content is when a page served over HTTPS loads a sub-resource — a script, stylesheet, image, iframe, or similar — over insecure HTTP. Browsers' current taxonomy is upgradable versus blockable; active mixed content (scripts, styles, iframes) is blocked, and passive mixed content (images, audio, video) is warned about or increasingly auto-upgraded, with exceptions like CORS-enabled images and srcset/picture candidates that are blockable, not upgradable., and HSTSHSTS (HTTP Strict Transport Security) is a response header that tells browsers to always connect to your site over HTTPS — even when a user types or clicks an http:// link — closing the insecure-first-request gap that a plain 301 redirect leaves open.? Switch to the Advanced tab.

TL;DR — Google’s current page-experience guidance says aspects beyond Core Web VitalsWeb Vitals is Google's initiative (launched May 2020) for unified page-experience quality signals. Core Web Vitals — LCP, INP, and CLS — are the subset used in ranking; the rest (TTFB, FCP, TBT, Speed Index) are diagnostic, not ranking factors. “don’t directly help your website rank higher” — so don’t promise a present-day ranking boost from HTTPSHTTPS is the encrypted version of HTTP — it uses TLS to authenticate the server and protect data in transit between a browser and a website. Google announced it as a lightweight ranking signal in 2014 and today conditionally prefers HTTPS pages as canonical; Chrome marks plain HTTP pages 'Not Secure.'. What’s confirmed is historical: Google announced HTTPS as a “very lightweight” ranking signal in August 2014 (fewer than 1% of queries), and Gary Illyes characterized it as a tiebreaker in 2015 — dated commentary, not a documented current mechanic. Separately, Google’s canonicalizationHow search engines pick one canonical URL among duplicates and consolidate signals onto it. guidance does actively prefer HTTPS pages as canonical over their HTTP equivalents today — but only conditionally: an invalid certificate, insecure dependencies, an HTTPS→HTTP redirectA redirect sends browsers and crawlers from a requested URL to a different one. An HTTP redirect specifically is a 3xx status code paired with a Location header; meta refresh and JavaScript redirects achieve a similar navigation without being a 3xx response themselves. Permanent redirects (301/308) are Google's signal the target should be canonical; temporary ones (302/303/307) aren't., or a stray HTTP canonical tagA rel=\"canonical\" annotation — in the HTML <head> or an HTTP Link header — that tells search engines which URL is the preferred version of duplicate or near-duplicate content. can flip that preference, and HSTSHSTS (HTTP Strict Transport Security) is a response header that tells browsers to always connect to your site over HTTPS — even when a user types or clicks an http:// link — closing the insecure-first-request gap that a plain 301 redirect leaves open. can’t override it. The real case for HTTPS is Chrome’s “Not Secure” label, HTTP/2HTTP/2 and HTTP/3 are the modern versions of the HTTP protocol. HTTP/2 multiplexes many requests over one TCP connection; HTTP/3 swaps TCP for QUIC (over UDP) so a dropped packet only stalls the one stream it belongs to, not every stream (streams still share the connection's congestion control). Neither is a Google ranking factor — the SEO payoff is indirect, through faster real-user page speed. (in every major browser), modern browser APIs, and the fact that it’s now table stakes — not a growth lever. Migrating is a site migrationA site migration is any significant change to a website's URL structure, domain, platform, protocol, or hosting that can affect how search engines crawl, index, and rank it. The risk scales with how much you change at once.: 301 every URL (301s don’t lose PageRankPageRank is Google's original recursive link-graph algorithm: a page's score depends on the scores of the pages linking to it, and in the published model each page's score is split across its outbound links (the simplified version: links are weighted votes). Google says it's evolved since launch but still part of its core ranking systems.), fix active and passive mixed contentMixed content is when a page served over HTTPS loads a sub-resource — a script, stylesheet, image, iframe, or similar — over insecure HTTP. Browsers' current taxonomy is upgradable versus blockable; active mixed content (scripts, styles, iframes) is blocked, and passive mixed content (images, audio, video) is warned about or increasingly auto-upgraded, with exceptions like CORS-enabled images and srcset/picture candidates that are blockable, not upgradable., update canonicals/sitemapsA sitemap is a file that lists the pages, images, videos, and other files on your site so search engines can discover them. It helps discovery, but submitting a sitemap doesn't guarantee crawling or indexing./internal linksAn internal link is a hyperlink from one page on a website to another page on the same website. Internal links help search engines discover your pages and pass ranking signals (PageRank and anchor-text context) between them., and re-verify Search ConsoleGoogle's free tool for monitoring crawling, indexing, and search performance. — no Change of Address toolA setting in Google Search Console that tells Google you've moved your whole site to a new domain or subdomain. It's a supporting signal for a domain migration — the 301 redirects do the real work of transferring rankings. for a protocol switch. HSTS and its 307 internal redirect are a browser-layer protection on top of, not a replacement for, your server-side 301s.

Does Google currently promise a ranking boost from HTTPS?

Start with what Google says today, not in 2014. Its current page experience documentation states that beyond Core Web VitalsGoogle's three real-user UX metrics — LCP (loading), INP (responsiveness), and CLS (visual stability) — used by Google's ranking systems, with no official weight attached, measured on field data., page experience aspects — HTTPS is listed among them — “don’t directly help your website rank higher in search results.” That’s the most current, direct guidance available, and it does not support promising a present-tense ranking boost from being on HTTPS.

The 2014 signal and the “tiebreaker” framing — historical, not current mechanics

What is confirmed is history: Google announced HTTPS as a ranking signal on August 6, 2014, and was unusually candid about how little it weighed at launch. The original wording: it’s a “very lightweight signal—affecting fewer than 1% of global queries, and carrying less weight than other signals such as high-quality content.” The post added that Google “may decide to strengthen it” over time to encourage adoption — “strengthen,” not the “boost” the SEO press often paraphrased it as. Evidence for this claim Google announced HTTPS as a very lightweight ranking signal affecting fewer than one percent of global queries at launch. Scope: Google's 2014 announcement establishes the signal and its weight at launch; it does not quantify the signal's current weight. Confidence: high · Verified: 2026-07-14 Google Search Central: HTTPS as a ranking signal

A year later, in September 2015, Gary Illyes characterized the signal as a tiebreaker: “it acts more like a tiebreaker. For example, if all quality signals are equal for two results, then the one that is on HTTPS would get … or may get … the extra boost.” The same year he was blunt about priorities: “you should switch to HTTPS for users, not as a ranking signal.” John Mueller’s framing from the same period — don’t expect any visible ranking change from the switch alone — points the same way.

Treat “tiebreaker” as Illyes’s dated, representative color from 2015–2016, not as something Google currently documents as an active ranking mechanic — the page-experience wording above is the more conservative, present-tense source. So the honest, dated answer to “does HTTPS help SEO?” is: Google confirmed a minor signal in 2014, a Googler characterized it as a tiebreaker in 2015, and current guidance doesn’t restate that tiebreaker mechanic directly. If you’re choosing where to spend effort, HTTPS is a hygiene item, not a growth lever — regardless of exactly how the historical signal is weighted today.

Google’s HTTPS canonical preference — conditional, not scheme-only

Separate from the 2014 ranking signal is a canonicalizationHow search engines pick one canonical URL among duplicates and consolidate signals onto it. preference Google documents today: “Google prefers HTTPS pages over equivalent HTTP pages as canonical, except when there are issues or conflicting signals such as” an invalid SSL certificate, insecure dependencies (other than images), an HTTPS page that redirects users to or through an HTTP page, or an HTTPS page with a rel="canonical" pointing at the HTTP version.

This is the nuance almost every other guide misses, and it cuts against a common oversimplification (including Illyes’s 2016 line that the ranking signal is “basically looking at the first five characters in front of the URL”) — that shorthand describes the 2014 ranking signal, not this canonicalization decision. Google’s own guidance is explicit that a bad certificate or a downgrade redirect overrides the HTTPS preference: “Avoid bad TLS/SSL certificates and HTTPS-to-HTTP redirects because they cause Google to prefer HTTP very strongly.” And HSTS can’t fix it: “Implementing HSTS cannot override this strong preference.”

The practical consequence: an expired or misconfigured certificate isn’t just a UX problem — it can also push Google toward indexingStoring a crawled page in the search index so it can appear in results. Crawled is not the same as indexed — Google selects what to keep, and indexing isn't guaranteed. your HTTP page instead of the HTTPS one you want ranked. For the certificate failure types and how to diagnose them, see SSL/TLS certificatesAn SSL/TLS certificate is the file a server presents during the TLS handshake to prove who controls the domain (to a level that depends on the validation type) and to supply the public key that encrypts the connection. It's what makes https:// possible — but Google's ranking signal only checks the URL scheme, not which certificate issued it.; for reading Search Console’s dedicated report on this exact decision, see the HTTPS reportA Google Search Console report showing how many of your indexed URLs are served over HTTPS vs HTTP — and, for the HTTP ones, why the secure version isn't being used. It's a diagnostic sample, not a full crawl inventory..

Why HTTPS actually matters

Strip away the ranking question and the case for HTTPS is overwhelming — with one caveat worth stating up front: HTTPS secures the transport channel between browser and server. It doesn’t audit your application code, vouch for your endpoints, or guarantee user intent — a hacked HTTPS site, a phishing form served over HTTPS, and a data breach after decryption are all still possible. HTTPS is necessary hygiene, not a security guarantee for everything downstream of the connection.

With that scoped, the practical case:

• Chrome’s “Not Secure” warning. Since Chrome 68 (July 2018), Chrome marks all HTTP pages “not secure.” That label sits in the address bar in front of real visitors — a far bigger conversion problem than any ranking nudge.
• It’s the practical prerequisite for HTTP/2 (and HTTP/3). No mainstream browser ships HTTP/2 over plain HTTP — every major browser only negotiates it over TLS, even though the HTTP/2 specification itself doesn’t mandate encryption. As Google’s own docs note, “in some cases, TLS can improve performance, mostly as a result of making HTTP/2 possible.” That’s a qualified “can,” not a guarantee — TLS overhead, server configuration, and connection reuse all still matter — but HTTP/2 multiplexing and header compressionCompression (HTTP content encoding) shrinks text-based responses — HTML, CSS, JS, JSON, SVG, XML sitemaps — before they're sent over the network, using an algorithm like Gzip, Brotli, or Zstd, so the browser or crawler downloads fewer bytes. It's not a ranking factor, but it speeds up page loads and helps pages stay under crawler fetch limits. often make an HTTPS+HTTP/2 site faster than plain HTTP/1.1, the opposite of the old “TLS adds latency” worry.
• Modern browser features need it. Service workers, the geolocation/camera/mic APIs, and progressive web apps generally require a secure context (check the specific feature and browser for exceptions like localhost). Google: “HTTPS is required for many new browser features, especially those required for progressive web apps.”
• Referral data and “dark traffic” — by default, not universally. Browsers running a modern default Referrer-Policy (strict-origin-when-cross-origin) drop the Referer header entirely when a link goes from an HTTPS page to an HTTP destination — a same-scheme or upgrade navigation still sends at least the origin. So if you’re still on HTTP, traffic you send out (and inbound attribution) can get mangled into “direct” by default — but a site’s own Referrer-Policy header can override that default in either direction, so don’t treat it as an absolute rule when auditing someone else’s analytics gap.
• It’s table stakes. An estimated ~89% of sites are on HTTPS (W3Techs, 2026 — treat as a directional estimate, not an exact current count). The SEO story isn’t the gain from switching — it’s the risk of being the visible holdout.

Migrating HTTP → HTTPS

TIP Trace the protocol path instead of stopping at the first redirect

This result shows an HTTPS URL whose redirect chain ends on HTTP. A permanent status alone is not enough when the final scheme reverses the migration.

Use my Redirect Checker on representative URLs to confirm each old HTTP address reaches its matching HTTPS page directly and stays secure. Redirect Checker Free

1. Test old HTTP URLs and current HTTPS URLs from every major route family.
2. Require a direct permanent redirect to the matching HTTPS destination with no downgrade, loop, or broken final response.
3. Crawl the complete inventory after launch and keep the redirects operating long term.

Tap to enlarge

An HTTP→HTTPS move is a site migrationA site migration is any significant change to a website's URL structure, domain, platform, protocol, or hosting that can affect how search engines crawl, index, and rank it. The risk scales with how much you change at once., and it deserves the same discipline. The good news, straight from Google’s site move guidance: “301 and other permanent redirects don’t cause a loss in PageRankPageRank is Google's original recursive link-graph algorithm: a page's score depends on the scores of the pages linking to it, and in the published model each page's score is split across its outbound links (the simplified version: links are weighted votes). Google says it's evolved since launch but still part of its core ranking systems..” The old fear that switching costs you link equity is a myth — the risk is entirely in execution, not the protocol switch itself: missing 301s, mixed contentMixed content is when a page served over HTTPS loads a sub-resource — a script, stylesheet, image, iframe, or similar — over insecure HTTP. Browsers' current taxonomy is upgradable versus blockable; active mixed content (scripts, styles, iframes) is blocked, and passive mixed content (images, audio, video) is warned about or increasingly auto-upgraded, with exceptions like CORS-enabled images and srcset/picture candidates that are blockable, not upgradable., stale canonicals, and an unverified HTTPS property in Search Console are what actually cost traffic.

The core discipline in one paragraph: benchmark the live HTTP site first (crawl, rankings, Search Console export, backlink profile), get a TLS certificate (a free Let’s Encrypt DV cert carries the same signal as a paid OV/EV one), 301-redirect every HTTP URL to its HTTPS equivalent one-to-one, make HTTPS canonical everywhere (internal linksAn internal link is a hyperlink from one page on a website to another page on the same website. Internal links help search engines discover your pages and pass ranking signals (PageRank and anchor-text context) between them., sitemapA sitemap is a file that lists the pages, images, videos, and other files on your site so search engines can discover them. It helps discovery, but submitting a sitemap doesn't guarantee crawling or indexing., hreflangHreflang is an annotation (in HTML, HTTP headers, or XML sitemaps) that tells search engines which language and optional region a page targets, and which alternate versions exist. It only works when every page in the cluster references all the others. — don’t rely on redirects to paper over stale internal links), fix mixed content before you flip, re-verify all four Search Console properties (no Change of Address tool needed for a protocol switch), and keep the redirects live for at least a year. Expect temporary ranking fluctuation — a dip that recovers is the move settling; one that sticks means something broke.

That’s the risk map, not the runbook. For the step-by-step sequence, staging rehearsal, redirect-mapping-at-scale, rollback plan, and the full migration checklist, see HTTP to HTTPS migrationAn HTTP to HTTPS migration is the process of moving every URL on a site from the insecure http:// scheme to the encrypted https:// scheme — installing a TLS certificate and 301-redirecting each old URL to its secure equivalent. Done correctly, it doesn't lose rankings or PageRank. — this page stays a concise overview so it doesn’t drift out of sync with that deeper guide.

Mixed content

TIP Check whether the secure page still requests insecure resources

This finding confirms an HTTP subresource in fetched source. It is a page-level observation, not proof that the rest of the site is clean.

Run important HTTPS pages through my Website Safety Checker for quick confirmation, then use a crawler and CSP reports for complete coverage. Website Safety Checker Free

1. Start with templates whose scripts, styles, images, or embeds changed during the migration.
2. Replace insecure source references and verify the resource really supports HTTPS.
3. Rerun the page, crawl the site, and monitor conditional third-party resources.

Tap to enlarge

Mixed content is when an HTTPS page loads a sub-resource over HTTP. It comes in two flavors, and the distinction drives your priorities:

• Active mixed content — scripts, stylesheets, iframesHTML element that displays one webpage inside another — how embeds work., XMLHttpRequest. Browsers block these outright, because a tampered script can rewrite the whole page. This is what actually breaks your site after a migration, so fix it first.
• Passive mixed content — images, audio, video. Browsers usually still display it but downgrade the security indicator and warn.

Find it by crawlingCrawling is how search engines use automated bots (like Googlebot and Bingbot) to discover URLs and download pages. A page has to be crawlable to be indexed, but crawling on its own isn't a ranking factor. the HTTPS site (Ahrefs Site Audit, Screaming Frog), watching Chrome DevTools’ console, or collecting CSP reports. The cleanest proactive fix is the Content-Security-Policy: upgrade-insecure-requests header, which tells the browser to silently rewrite http:// sub-resource requests to https:// before it makes them — a useful safety net during and after the migration. Note that ordinary anchor links to HTTP pages don’t count as mixed content; they just navigate.

HSTS (and why it isn’t a replacement for your 301s)

HSTS — HTTP Strict Transport Security — is a response header (Strict-Transport-Security) that tells browsers to always use HTTPS for your domain, even if a user types or clicks an http:// link. It closes the “first request problem”: with only a 301 in place, that very first request from a new visitor still goes out over HTTP before the redirect fires, which is the window an SSL-stripping attacker wants. As Google’s docs put it, HSTS lets you “avoid the cost of the 301 redirectA 301 redirect is the HTTP status code for a permanent move: it tells browsers and search engines a URL has moved for good, and it's the strongest signal for consolidating a page's ranking signals onto the new URL. Google says permanent redirects don't cause a loss in PageRank.” for returning visitors and “defeats attacks like SSL Stripping.”

Two things SEOs should keep straight:

• HSTS does not replace your server-side 301s. When a browser honors HSTS it performs an internal 307 redirectA 307 (\"Temporary Redirect\") is a temporary redirect that, unlike a 302, is guaranteed by the HTTP spec to preserve the original request method and body — so a POST stays a POST. For SEO, Google treats it as equivalent to a 302. Browsers/tools also sometimes represent an HSTS-driven internal scheme upgrade as a 307, though the server never actually sent it and RFC 6797 doesn't require that specific code. to HTTPS — but that happens inside the browser, where crawlersA crawler — also called a spider or bot — is an automated program that fetches web pages, extracts their links, and queues new URLs to visit. Search engines use crawlers to discover and download content for their index. never see it. Search engines still need your real, server-side 301 to understand the move and carry link equity. You need both.
• HSTS preload is close to permanent. You can submit your domain to the browser-baked preload list (requiring max-age of at least one year, includeSubDomains, and preload), which closes the gap even for first-time visitors. But getting off the preload list is slow and painful. Google warns: “Don’t enable HSTS until you’re certain your site operation is robust enough to avoid ever deploying HTTPS with certificate validation errors.” Treat preload as a one-way door.

Common myths

• “HTTPS is a big current ranking boost.” No — 2014’s “very lightweight,” fewer-than-1%-of-queries signal and 2015’s “tiebreaker” framing are dated commentary; current guidance says page-experience aspects beyond Core Web Vitals “don’t directly help you rank higher.”
• “Switching will tank my rankings.” Not if redirects are done right; 301s don’t lose PageRank. Botched migrations hurt, the protocol switch doesn’t.
• “You need the Change of Address tool.” Not for HTTP→HTTPS — only for domain changes.
• “An expired cert only breaks the UX, not anything SEO-related.” No — a bad certificate is one of the named conditions that can flip Google’s HTTPS canonical preference toward your HTTP page, on top of breaking the page for users.
• “HTTPS only matters for checkout pages.” No — Chrome flags every HTTP page, and modern APIs generally require a secure context.
• “TLS makes sites slower.” Usually the reverse in practice, because HTTPS unlocks HTTP/2 — though TLS “can” help performance, not guarantees it.

Migrating HTTP→HTTPS sits inside the broader discipline of site migrationsA site migration is any significant change to a website's URL structure, domain, platform, protocol, or hosting that can affect how search engines crawl, index, and rank it. The risk scales with how much you change at once. — if you’re also changing domain or platform at the same time, read that first, because stacked migrations multiply the risk.

AI summary

A condensed take on the Advanced version:

• Current Google guidance doesn’t promise a ranking boost. The page-experience doc says aspects beyond Core Web VitalsGoogle's three real-user UX metrics — LCP (loading), INP (responsiveness), and CLS (visual stability) — used by Google's ranking systems, with no official weight attached, measured on field data. “don’t directly help your website rank higher” — HTTPSHTTPS is the encrypted version of HTTP — it uses TLS to authenticate the server and protect data in transit between a browser and a website. Google announced it as a lightweight ranking signal in 2014 and today conditionally prefers HTTPS pages as canonical; Chrome marks plain HTTP pages 'Not Secure.' is listed among them.
• The 2014 signal and 2015 “tiebreaker” framing are historical. “Very lightweight,” fewer than 1% of queries (2014); Illyes’s tiebreaker line (2015) — dated commentary, not a restated current mechanic. Don’t treat HTTPS as a growth lever regardless.
• Google’s HTTPS canonical preference is separate — and conditional. Google currently prefers HTTPS pages as canonical, except when there’s an invalid certificate, insecure non-image dependencies, an HTTPS→HTTP redirectA redirect sends browsers and crawlers from a requested URL to a different one. An HTTP redirect specifically is a 3xx status code paired with a Location header; meta refresh and JavaScript redirects achieve a similar navigation without being a 3xx response themselves. Permanent redirects (301/308) are Google's signal the target should be canonical; temporary ones (302/303/307) aren't., or a stray HTTP canonical tagA rel=\"canonical\" annotation — in the HTML <head> or an HTTP Link header — that tells search engines which URL is the preferred version of duplicate or near-duplicate content. — and HSTSHSTS (HTTP Strict Transport Security) is a response header that tells browsers to always connect to your site over HTTPS — even when a user types or clicks an http:// link — closing the insecure-first-request gap that a plain 301 redirect leaves open. can’t override that. A bad cert is a canonicalizationHow search engines pick one canonical URL among duplicates and consolidate signals onto it. risk, not just a UX one.
• HTTPS secures transport only — not application logic, endpoints, or user intent; a phishing page can run on valid HTTPS.
• The real reasons to be on HTTPS: Chrome’s “Not Secure” label on all HTTP pages (since July 2018), HTTP/2HTTP/2 and HTTP/3 are the modern versions of the HTTP protocol. HTTP/2 multiplexes many requests over one TCP connection; HTTP/3 swaps TCP for QUIC (over UDP) so a dropped packet only stalls the one stream it belongs to, not every stream (streams still share the connection's congestion control). Neither is a Google ranking factor — the SEO payoff is indirect, through faster real-user page speed. in every major browser (often faster than HTTP/1.1, though TLS “can” help performance, not guarantees it), secure-context browser features/PWAs, default (but overridable) referral-data behavior, and being an estimated ~89%-of-the-web table stakes.
• Migration = a site migrationA site migration is any significant change to a website's URL structure, domain, platform, protocol, or hosting that can affect how search engines crawl, index, and rank it. The risk scales with how much you change at once., in overview here. 301 every URL one-to-one (301s don’t lose PageRankPageRank is Google's original recursive link-graph algorithm: a page's score depends on the scores of the pages linking to it, and in the published model each page's score is split across its outbound links (the simplified version: links are weighted votes). Google says it's evolved since launch but still part of its core ranking systems.), make HTTPS canonical, update internal links/sitemapsA sitemap is a file that lists the pages, images, videos, and other files on your site so search engines can discover them. It helps discovery, but submitting a sitemap doesn't guarantee crawling or indexing./hreflangHreflang is an annotation (in HTML, HTTP headers, or XML sitemaps) that tells search engines which language and optional region a page targets, and which alternate versions exist. It only works when every page in the cluster references all the others., fix mixed contentMixed content is when a page served over HTTPS loads a sub-resource — a script, stylesheet, image, iframe, or similar — over insecure HTTP. Browsers' current taxonomy is upgradable versus blockable; active mixed content (scripts, styles, iframes) is blocked, and passive mixed content (images, audio, video) is warned about or increasingly auto-upgraded, with exceptions like CORS-enabled images and srcset/picture candidates that are blockable, not upgradable., re-verify in GSC (HTTP and HTTPS are separate properties), keep redirects ≥1 year, no Change of Address toolA setting in Google Search Console that tells Google you've moved your whole site to a new domain or subdomain. It's a supporting signal for a domain migration — the 301 redirects do the real work of transferring rankings. for a protocol switch — full execution steps live on the dedicated migration page.
• Mixed content: active (scripts/iframesHTML element that displays one webpage inside another — how embeds work.) is blocked — fix first; passive (images) warns. upgrade-insecure-requests CSP is the proactive net.
• HSTS closes the first-request gap but uses a browser-only 307 crawlersA crawler — also called a spider or bot — is an automated program that fetches web pages, extracts their links, and queues new URLs to visit. Search engines use crawlers to discover and download content for their index. never see — it’s on top of, not instead of, server-side 301s. Preload is near-permanent; don’t rush it.

Official documentation

Primary-source documentation from the search engines and browser teams.

Google

• HTTPS as a ranking signal (2014 announcement) — the original “very lightweight signal” post.
• Enable HTTPS on your servers (web.dev) — certificates, 301s, canonicals, HSTSHSTS (HTTP Strict Transport Security) is a response header that tells browsers to always connect to your site over HTTPS — even when a user types or clicks an http:// link — closing the insecure-first-request gap that a plain 301 redirect leaves open., and cookies.
• Why HTTPS matters (web.dev) — the security and browser-feature case.
• Fixing mixed content (web.dev) — active vs. passive mixed contentMixed content is when a page served over HTTPS loads a sub-resource — a script, stylesheet, image, iframe, or similar — over insecure HTTP. Browsers' current taxonomy is upgradable versus blockable; active mixed content (scripts, styles, iframes) is blocked, and passive mixed content (images, audio, video) is warned about or increasingly auto-upgraded, with exceptions like CORS-enabled images and srcset/picture candidates that are blockable, not upgradable. and upgrade-insecure-requests.
• Site moves with URL changes — the migration playbook (redirectsA redirect sends browsers and crawlers from a requested URL to a different one. An HTTP redirect specifically is a 3xx status code paired with a Location header; meta refresh and JavaScript redirects achieve a similar navigation without being a 3xx response themselves. Permanent redirects (301/308) are Google's signal the target should be canonical; temporary ones (302/303/307) aren't., no Change of Address toolA setting in Google Search Console that tells Google you've moved your whole site to a new domain or subdomain. It's a supporting signal for a domain migration — the 301 redirects do the real work of transferring rankings. for HTTPSHTTPS is the encrypted version of HTTP — it uses TLS to authenticate the server and protect data in transit between a browser and a website. Google announced it as a lightweight ranking signal in 2014 and today conditionally prefers HTTPS pages as canonical; Chrome marks plain HTTP pages 'Not Secure.').
• Understanding page experience — where HTTPS sits in the page-experience framing; the current source for “don’t expect a direct ranking boost.”
• How to specify a canonical URL — the current, conditional HTTPS-vs-HTTP canonical preference and the exceptions (bad certs, insecure dependencies, downgrade redirects) that override it.

Chrome / Chromium

• Moving towards a more secure web (2016) — the start of the “Not Secure” rollout.
• A secure web is here to stay (2018) — Chrome 68 marking all HTTP “not secure.”

Bing / Microsoft

• Bing Webmaster Guidelines — general guidelines; confirm current HTTPS wording in-browser.

Quotes from the source

On-the-record statements from Google. Each link is a deep link that jumps to the quoted passage on the source page.

Google — the 2014 ranking-signal announcement

• “We’re starting to use HTTPSHTTPS is the encrypted version of HTTP — it uses TLS to authenticate the server and protect data in transit between a browser and a website. Google announced it as a lightweight ranking signal in 2014 and today conditionally prefers HTTPS pages as canonical; Chrome marks plain HTTP pages 'Not Secure.' as a ranking signal. For now it’s only a very lightweight signal—affecting fewer than 1% of global queries, and carrying less weight than other signals such as high-quality content.” — Zineb Ait Bahajji & Gary Illyes, Google. Jump to quote
• “But over time, we may decide to strengthen it, because we’d like to encourage all website owners to switch from HTTP to HTTPS.” — same post. Jump to quote

Gary Illyes — tiebreaker framing

• “With the HTTPS ranking boost, it acts more like a tiebreaker. For example, if all quality signals are equal for two results, then the one that is on HTTPS would get … or may get … the extra boost that is needed to trump the other result.” — Gary Illyes, Google (via Search Engine Land). Read the coverage
• “You should switch to HTTPS for users, not as a ranking signal.” — Gary Illyes, SMX East 2015 (via Search Engine Land). Read the coverage
• “Basically looking at the first five characters in front of the URL, and if it’s HTTPS … it will get a minimal boost.” — Gary Illyes, 2016 (via Search Engine Land). Read the coverage

Google — HTTPS canonical preference (current guidance)

• “Google prefers HTTPS pages over equivalent HTTP pages as canonical, except when there are issues or conflicting signals such as the following.” — Google Search Central. Jump to quote
• “Avoid bad TLS/SSL certificatesAn SSL/TLS certificate is the file a server presents during the TLS handshake to prove who controls the domain (to a level that depends on the validation type) and to supply the public key that encrypts the connection. It's what makes https:// possible — but Google's ranking signal only checks the URL scheme, not which certificate issued it. and HTTPS-to-HTTP redirectsA redirect sends browsers and crawlers from a requested URL to a different one. An HTTP redirect specifically is a 3xx status code paired with a Location header; meta refresh and JavaScript redirects achieve a similar navigation without being a 3xx response themselves. Permanent redirects (301/308) are Google's signal the target should be canonical; temporary ones (302/303/307) aren't. because they cause Google to prefer HTTP very strongly.” — Google Search Central. Jump to quote
• “Implementing HSTSHSTS (HTTP Strict Transport Security) is a response header that tells browsers to always connect to your site over HTTPS — even when a user types or clicks an http:// link — closing the insecure-first-request gap that a plain 301 redirect leaves open. cannot override this strong preference.” — Google Search Central. Jump to quote

Google — migration & HSTS guidance

• “301 and other permanent redirectsA 301 redirect is the HTTP status code for a permanent move: it tells browsers and search engines a URL has moved for good, and it's the strongest signal for consolidating a page's ranking signals onto the new URL. Google says permanent redirects don't cause a loss in PageRank. don’t cause a loss in PageRankPageRank is Google's original recursive link-graph algorithm: a page's score depends on the scores of the pages linking to it, and in the published model each page's score is split across its outbound links (the simplified version: links are weighted votes). Google says it's evolved since launch but still part of its core ranking systems..” — Google Search Central. Jump to quote
• “If you’re moving your site from HTTP to HTTPS, you don’t need to use the Change of Address tool.” — Google Search Central. Jump to quote
• “Don’t enable HSTS until you’re certain your site operation is robust enough to avoid ever deploying HTTPS with certificate validation errors.” — web.dev (Google). Jump to quote
• “In some cases, TLS can improve performance, mostly as a result of making HTTP/2HTTP/2 and HTTP/3 are the modern versions of the HTTP protocol. HTTP/2 multiplexes many requests over one TCP connection; HTTP/3 swaps TCP for QUIC (over UDP) so a dropped packet only stalls the one stream it belongs to, not every stream (streams still share the connection's congestion control). Neither is a Google ranking factor — the SEO payoff is indirect, through faster real-user page speed. possible.” — web.dev (Google). Jump to quote

Chrome — the “Not Secure” rollout

• “Beginning in July 2018 with the release of Chrome 68, Chrome will mark all HTTP sites as ‘not secure’.” — Emily Schechter, Chrome Security (Chromium Blog). Jump to quote

HTTP → HTTPS migration checklist

A condensed pre-flight version — for the full execution checklist, staging rehearsal, and rollback plan, see HTTP to HTTPS migrationAn HTTP to HTTPS migration is the process of moving every URL on a site from the insecure http:// scheme to the encrypted https:// scheme — installing a TLS certificate and 301-redirecting each old URL to its secure equivalent. Done correctly, it doesn't lose rankings or PageRank..

Before

• Full crawl of the live HTTP site saved (every 200 + every existing redirectA redirect sends browsers and crawlers from a requested URL to a different one. An HTTP redirect specifically is a 3xx status code paired with a Location header; meta refresh and JavaScript redirects achieve a similar navigation without being a 3xx response themselves. Permanent redirects (301/308) are Google's signal the target should be canonical; temporary ones (302/303/307) aren't.).
• Rankings snapshot, Search ConsoleA free Google service that reports how a site performs in Google Search and surfaces problems with how Google crawls, indexes, and serves it. It's first-party data straight from Google — but you don't need it to appear in results. export, and backlink profile archived.
• TLS certificateAn SSL/TLS certificate is the file a server presents during the TLS handshake to prove who controls the domain (to a level that depends on the validation type) and to supply the public key that encrypts the connection. It's what makes https:// possible — but Google's ranking signal only checks the URL scheme, not which certificate issued it. obtained and tested (a free DV cert is fine for the signal).

The switch

• Every HTTP URL 301-redirects, server-side and one-to-one, to its HTTPSHTTPS is the encrypted version of HTTP — it uses TLS to authenticate the server and protect data in transit between a browser and a website. Google announced it as a lightweight ranking signal in 2014 and today conditionally prefers HTTPS pages as canonical; Chrome marks plain HTTP pages 'Not Secure.' twin.
• No redirect chainsA → B → C instead of A → C. Each hop loses link equity and adds latency. (old → final HTTPS URL directly).
• No bulk redirects to the homepage for unmatched URLs.
• Each page self-references rel="canonical" to its HTTPS URL.
• Internal linksAn internal link is a hyperlink from one page on a website to another page on the same website. Internal links help search engines discover your pages and pass ranking signals (PageRank and anchor-text context) between them., XML sitemapsAn XML sitemap is a UTF-8 file listing the canonical URLs on your site (with optional lastmod) so search engines can discover and prioritize them. It's a discovery and diagnostic aid, not a guarantee of indexing — and Google ignores its priority and changefreq tags., and hreflangHreflang is an annotation (in HTML, HTTP headers, or XML sitemaps) that tells search engines which language and optional region a page targets, and which alternate versions exist. It only works when every page in the cluster references all the others. updated to HTTPS (not left to redirects).
• Active mixed contentMixed content is when a page served over HTTPS loads a sub-resource — a script, stylesheet, image, iframe, or similar — over insecure HTTP. Browsers' current taxonomy is upgradable versus blockable; active mixed content (scripts, styles, iframes) is blocked, and passive mixed content (images, audio, video) is warned about or increasingly auto-upgraded, with exceptions like CORS-enabled images and srcset/picture candidates that are blockable, not upgradable. (scripts, styles, iframesHTML element that displays one webpage inside another — how embeds work.) fixed — these get blocked.
• Passive mixed contentMixed content is when a page served over HTTPS loads a sub-resource — a script, stylesheet, image, iframe, or similar — over insecure HTTP. Browsers' current taxonomy is upgradable versus blockable; active mixed content (scripts, styles, iframes) is blocked, and passive mixed content (images, audio, video) is warned about or increasingly auto-upgraded, with exceptions like CORS-enabled images and srcset/picture candidates that are blockable, not upgradable. (images, media) fixed; upgrade-insecure-requests CSP set.

Search ConsoleGoogle's free tool for monitoring crawling, indexing, and search performance. & after

• HTTPS property verified in GSC (or a Domain property covering all variants).
• New HTTPS sitemapA sitemap is a file that lists the pages, images, videos, and other files on your site so search engines can discover them. It helps discovery, but submitting a sitemap doesn't guarantee crawling or indexing. submitted.
• Change of Address toolA setting in Google Search Console that tells Google you've moved your whole site to a new domain or subdomain. It's a supporting signal for a domain migration — the 301 redirects do the real work of transferring rankings. not used (only for domain moves).
• Disavow file (if any) reviewed for HTTP URLs.
• Redirects kept at least 1 year — ideally for the life of the site.
• IndexingStoring a crawled page in the search index so it can appear in results. Crawled is not the same as indexed — Google selects what to keep, and indexing isn't guaranteed. + Crawl Stats monitored; a dip that doesn’t recover = something broke.

The mental models

1. HTTPSHTTPS is the encrypted version of HTTP — it uses TLS to authenticate the server and protect data in transit between a browser and a website. Google announced it as a lightweight ranking signal in 2014 and today conditionally prefers HTTPS pages as canonical; Chrome marks plain HTTP pages 'Not Secure.' is hygiene, not a growth lever. “Very lightweight,” fewer than 1% of queries, a tiebreaker. Spend your ranking effort on content and links; do HTTPS because the web requires it, then move on.

2. Separate the 2014 ranking signal from the current canonical preference. The 2014 ranking signal is historically scheme-based — Illyes’s “first five characters” line describes it, and it’s dated commentary, not current documented mechanics. Google’s current HTTPS canonical preference is different and conditional: a bad certificate, insecure dependencies, or a downgrade redirectA redirect sends browsers and crawlers from a requested URL to a different one. An HTTP redirect specifically is a 3xx status code paired with a Location header; meta refresh and JavaScript redirects achieve a similar navigation without being a 3xx response themselves. Permanent redirects (301/308) are Google's signal the target should be canonical; temporary ones (302/303/307) aren't. can flip Google toward indexingStoring a crawled page in the search index so it can appear in results. Crawled is not the same as indexed — Google selects what to keep, and indexing isn't guaranteed. your HTTP page instead. So a broken cert isn’t just a UX emergency — it can also cost you the HTTPS canonical.

3. A migration is carried by 301s — everything else is a supporting signal. Redirects (which don’t lose PageRankPageRank is Google's original recursive link-graph algorithm: a page's score depends on the scores of the pages linking to it, and in the published model each page's score is split across its outbound links (the simplified version: links are weighted votes). Google says it's evolved since launch but still part of its core ranking systems.) do the real work of moving rankings. Canonicals, sitemapsA sitemap is a file that lists the pages, images, videos, and other files on your site so search engines can discover them. It helps discovery, but submitting a sitemap doesn't guarantee crawling or indexing., internal-link updates, and GSCA free Google service that reports how a site performs in Google Search and surfaces problems with how Google crawls, indexes, and serves it. It's first-party data straight from Google — but you don't need it to appear in results. re-verification just help Google process the move faster and more cleanly.

4. Two layers of “force HTTPS,” and you need both. Server-side 301 is for crawlersA crawler — also called a spider or bot — is an automated program that fetches web pages, extracts their links, and queues new URLs to visit. Search engines use crawlers to discover and download content for their index. and link equity. HSTSHSTS (HTTP Strict Transport Security) is a response header that tells browsers to always connect to your site over HTTPS — even when a user types or clicks an http:// link — closing the insecure-first-request gap that a plain 301 redirect leaves open. (a browser-only 307) is for returning human visitors and SSL-stripping protection. They solve different problems — HSTS is never a substitute for the 301.

5. Mixed contentMixed content is when a page served over HTTPS loads a sub-resource — a script, stylesheet, image, iframe, or similar — over insecure HTTP. Browsers' current taxonomy is upgradable versus blockable; active mixed content (scripts, styles, iframes) is blocked, and passive mixed content (images, audio, video) is warned about or increasingly auto-upgraded, with exceptions like CORS-enabled images and srcset/picture candidates that are blockable, not upgradable.: triage by what the browser does. Active (scripts/styles/iframesHTML element that displays one webpage inside another — how embeds work.) is blocked → fixing it is functional, do it first. Passive (images/media) only warns → fix it next. upgrade-insecure-requests is the safety net for whatever you miss.

HTTPS for SEO — cheat sheet

The ranking reality

Redirect & migration facts

Mixed contentMixed content is when a page served over HTTPS loads a sub-resource — a script, stylesheet, image, iframe, or similar — over insecure HTTP. Browsers' current taxonomy is upgradable versus blockable; active mixed content (scripts, styles, iframes) is blocked, and passive mixed content (images, audio, video) is warned about or increasingly auto-upgraded, with exceptions like CORS-enabled images and srcset/picture candidates that are blockable, not upgradable. & HSTSHSTS (HTTP Strict Transport Security) is a response header that tells browsers to always connect to your site over HTTPS — even when a user types or clicks an http:// link — closing the insecure-first-request gap that a plain 301 redirect leaves open.

Force HTTPS and set HSTS

Examples for the two most common stacks. Test on staging first — an HSTSHSTS (HTTP Strict Transport Security) is a response header that tells browsers to always connect to your site over HTTPS — even when a user types or clicks an http:// link — closing the insecure-first-request gap that a plain 301 redirect leaves open. header is sticky, and a botched redirect loopA redirect loop is a chain of redirects that circles back on itself instead of ever reaching a live page — URL A redirects to B and B redirects back to A (or a longer cycle). No page ever returns a 200, so browsers show ERR_TOO_MANY_REDIRECTS and crawlers can't index anything. locks people out.

Apache (.htaccess)

# 301 every HTTP request to HTTPS
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

# HSTS — only add once you're confident HTTPS is solid
<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>

Nginx

# Redirect HTTP → HTTPS
server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

# On the HTTPS server block, add HSTS
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Add ; preload to the HSTS header only when you intend to submit to hstspreload.org — it’s close to irreversible.

Find mixed content from the command line

Crawl your HTTPSHTTPS is the encrypted version of HTTP — it uses TLS to authenticate the server and protect data in transit between a browser and a website. Google announced it as a lightweight ranking signal in 2014 and today conditionally prefers HTTPS pages as canonical; Chrome marks plain HTTP pages 'Not Secure.' pages and grep for any http:// sub-resources left in the HTML.

macOS / Linux

# Pull a page and flag insecure script/img/link/iframe sources
curl -s https://example.com/ \
  | grep -Eo '(src|href)="http://[^"]+"' \
  | sort -u

Windows (PowerShell)

# Same idea in PowerShell
(Invoke-WebRequest -Uri "https://example.com/").Content `
  | Select-String -Pattern '(src|href)="http://[^"]+"' -AllMatches `
  | ForEach-Object { $_.Matches.Value } | Sort-Object -Unique

For a whole-site sweep, a crawlerA crawler — also called a spider or bot — is an automated program that fetches web pages, extracts their links, and queues new URLs to visit. Search engines use crawlers to discover and download content for their index. (Ahrefs Site Audit, Screaming Frog) or Chrome DevTools’ console is faster than scripting page by page.

Resources worth your time

My speaking

• Better Safe Than Sorry with HTTPS — SMX East 2016 (SlideShare) — my deep-dive on TLS, common HTTPSHTTPS is the encrypted version of HTTP — it uses TLS to authenticate the server and protect data in transit between a browser and a website. Google announced it as a lightweight ranking signal in 2014 and today conditionally prefers HTTPS pages as canonical; Chrome marks plain HTTP pages 'Not Secure.' implementation failures, and the migration gotchas. (Standing disclaimer applies: it’s my understanding of these systems, and the adoption stats in it are from 2016.)

My related writing

• The Beginner’s Guide to Technical SEO — where HTTPS fits in the bigger picture.

From others (official)

• Google’s Enable HTTPS on your servers and Fixing mixed content — the most useful concentrated set of implementation docs.
• hstspreload.org — check eligibility before you commit to preloadResource hints are <link> elements (or equivalent HTTP Link headers) that tell the browser to do network work — DNS lookups, connection setup, or fetching a resource — earlier than it would discover the need on its own. The main ones are dns-prefetch, preconnect, preload, modulepreload, and prefetch..
• SSL Labs Server Test — grade your TLS configuration.

From around the industry

• HTTPS as a Ranking Factor — Search Engine Journal — SEJ’s breakdown of the signal, its real weight, and why it remains a tiebreaker rather than a lever.
• Google’s Gary Illyes: HTTPS May Break Ties Between Two Equal Search Results (Search Engine Land) — the original coverage of Illyes’s “tiebreaker” framing.
• Google Starts Giving Ranking Boost to Secure HTTPS/SSL Sites (Search Engine Land) — the 2014 announcement coverage and early industry reaction.
• HSTS — What It Is and How to Use It (Kinsta) — practical implementation guide covering the preload list risks and lock-in warnings.
• Let’s Encrypt — free, automated DV certificate authority; widely used for sites where you just need the https:// scheme without paying for OV/EV.
• HTTPS Is Easy (Troy Hunt) — short video series demystifying TLS setup for those starting from scratch.

Stats worth citing

• HTTPSHTTPS is the encrypted version of HTTP — it uses TLS to authenticate the server and protect data in transit between a browser and a website. Google announced it as a lightweight ranking signal in 2014 and today conditionally prefers HTTPS pages as canonical; Chrome marks plain HTTP pages 'Not Secure.' is “a very lightweight signal—affecting fewer than 1% of global queries.” Google’s own framing of the ranking weight at the 2014 launch — a historical figure, still the best number for right-sizing expectations, but not a restatement of current mechanics. Source
• All HTTP pages marked “Not Secure” since Chrome 68 (July 2018). The single most visible practical reason to switch. Source
• ~89% of websites now use HTTPS. It’s table stakes — the SEO risk is being the holdout, not the gain from switching (W3Techs, 2026; confirm the current figure).
• 301 redirectsA 301 redirect is the HTTP status code for a permanent move: it tells browsers and search engines a URL has moved for good, and it's the strongest signal for consolidating a page's ranking signals onto the new URL. Google says permanent redirects don't cause a loss in PageRank. don’t lose PageRankPageRank is Google's original recursive link-graph algorithm: a page's score depends on the scores of the pages linking to it, and in the published model each page's score is split across its outbound links (the simplified version: links are weighted votes). Google says it's evolved since launch but still part of its core ranking systems.. Google’s flat statement, which kills the “switching costs link equity” myth. Source

Test yourself: HTTPS for SEO

Five quick questions on HTTPSHTTPS is the encrypted version of HTTP — it uses TLS to authenticate the server and protect data in transit between a browser and a website. Google announced it as a lightweight ranking signal in 2014 and today conditionally prefers HTTPS pages as canonical; Chrome marks plain HTTP pages 'Not Secure.' for SEO. Pick an answer for each, then check.

HTTPS

HTTPS is the encrypted version of HTTP — it uses TLS to authenticate the server and protect data in transit between a browser and a website. Google announced it as a lightweight ranking signal in 2014 and today conditionally prefers HTTPS pages as canonical; Chrome marks plain HTTP pages 'Not Secure.'

Related: Site Migration, Canonicalization, Change of Address tool

HTTPS

HTTPS (HyperText Transfer Protocol Secure) is HTTP wrapped in encryption. It uses TLS — Transport Layer Security, the successor to SSL, though almost everyone still says “SSL certificateAn SSL/TLS certificate is the file a server presents during the TLS handshake to prove who controls the domain (to a level that depends on the validation type) and to supply the public key that encrypts the connection. It's what makes https:// possible — but Google's ranking signal only checks the URL scheme, not which certificate issued it.” — to do three things: authenticate that you’re really talking to the server you think you are, guarantee the data wasn’t tampered with in transit, and encrypt it so nobody on the network in between can read it. You can spot it by the https:// scheme in the address bar.

For SEO specifically, two things matter, and it’s worth keeping them separate. First, Google announced HTTPS as a positive ranking signal in August 2014 — a deliberately small one it called a “very lightweight signal,” and Gary Illyes described it as a tiebreaker between otherwise-equal results in 2015. Both are historical, dated statements; Google’s current page-experience guidance doesn’t restate a direct present-day ranking boost from HTTPS. Second, and separately, Google’s current canonicalizationHow search engines pick one canonical URL among duplicates and consolidate signals onto it. guidance says it prefers HTTPS pages over equivalent HTTP pages as canonical — but only conditionally: an invalid certificate, insecure non-image dependencies, or a redirectA redirect sends browsers and crawlers from a requested URL to a different one. An HTTP redirect specifically is a 3xx status code paired with a Location header; meta refresh and JavaScript redirects achieve a similar navigation without being a 3xx response themselves. Permanent redirects (301/308) are Google's signal the target should be canonical; temporary ones (302/303/307) aren't. that sends users back to HTTP can flip that preference toward the HTTP version, and HSTSHSTS (HTTP Strict Transport Security) is a response header that tells browsers to always connect to your site over HTTPS — even when a user types or clicks an http:// link — closing the insecure-first-request gap that a plain 301 redirect leaves open. can’t override it. So a broken certificate isn’t just a UX problem that scares off users with a browser warning — it can also cost you the HTTPS canonical.

The bigger reasons to be on HTTPS in practice aren’t about ranking at all: Chrome has marked every plain-HTTP page “Not Secure” since July 2018, HTTPS is required for HTTP/2HTTP/2 and HTTP/3 are the modern versions of the HTTP protocol. HTTP/2 multiplexes many requests over one TCP connection; HTTP/3 swaps TCP for QUIC (over UDP) so a dropped packet only stalls the one stream it belongs to, not every stream (streams still share the connection's congestion control). Neither is a Google ranking factor — the SEO payoff is indirect, through faster real-user page speed. and most modern browser APIs (service workers, geolocation, the camera/mic), and it’s simply the baseline the web now expects. Migrating HTTP→HTTPS is a site migrationA site migration is any significant change to a website's URL structure, domain, platform, protocol, or hosting that can affect how search engines crawl, index, and rank it. The risk scales with how much you change at once. — you carry rankings across with 301 redirectsA 301 redirect is the HTTP status code for a permanent move: it tells browsers and search engines a URL has moved for good, and it's the strongest signal for consolidating a page's ranking signals onto the new URL. Google says permanent redirects don't cause a loss in PageRank. (which don’t lose PageRankPageRank is Google's original recursive link-graph algorithm: a page's score depends on the scores of the pages linking to it, and in the published model each page's score is split across its outbound links (the simplified version: links are weighted votes). Google says it's evolved since launch but still part of its core ranking systems.), and you don’t need the Change of Address toolA setting in Google Search Console that tells Google you've moved your whole site to a new domain or subdomain. It's a supporting signal for a domain migration — the 301 redirects do the real work of transferring rankings. for a protocol switch.

Related: Site Migration, Canonicalization, Change of Address tool

Changelog