HTTPS (HyperText Transfer Protocol Secure) is the encrypted version of HTTP that protects data sent between a browser and a web server using SSL/TLS certificates. Google confirmed HTTPS as a ranking signal in 2014. Chrome labels HTTP sites as "Not Secure," and modern browser features — service workers, geolocation, payment APIs — require HTTPS to function.
Every site should be on HTTPS — not because the ranking boost is enormous, but because HTTP sites show a "Not Secure" warning in Chrome, lose referral data in analytics, and cannot use half the modern web platform. The migration cost is low. The cost of staying on HTTP compounds over time.
What is HTTPS?
HTTPS stands for HyperText Transfer Protocol Secure. It is HTTP with an encryption layer added on top — specifically SSL (Secure Sockets Layer) or its modern successor TLS (Transport Layer Security). When a user loads an HTTPS site, the browser and server negotiate a secure connection before any data is exchanged. Everything sent in both directions — page content, form inputs, login credentials, payment details — is encrypted in transit.
The padlock icon in a browser address bar indicates an HTTPS connection is active. Chrome and Firefox show a "Not Secure" warning for HTTP sites, which visibly damages trust, particularly on any page with a form or login.
Google confirmed HTTPS as a ranking signal in August 2014 in a post on the Google Search Central Blog. While Google describes it as a "lightweight signal" — a tiebreaker rather than a dominant factor — the indirect effects on user trust, engagement metrics, and referral data accuracy make HTTPS essential for any competitive site.
Why HTTPS matters for SEO and user trust
- Confirmed ranking signal. Google uses HTTPS as a tiebreaker between otherwise equal pages. In competitive niches, this matters.
- Chrome's Not Secure warning. HTTP sites with text input fields get a visible "Not Secure" label in the address bar. This warning increases bounce rates and reduces conversion on forms and checkouts.
- Referral data accuracy. When a user navigates from an HTTPS site to an HTTP site, the referral header is stripped. That traffic appears as Direct in analytics, making attribution impossible. Staying on HTTPS preserves accurate source data.
- Modern browser features require HTTPS. Service workers (Progressive Web Apps), geolocation, push notifications, payment requests, and WebAuthn all require a secure origin. An HTTP site cannot use these APIs at all.
- User trust. Studies consistently show users are less likely to complete purchases or submit personal information on sites marked Not Secure. The visual signal matters even to non-technical users.
How HTTPS works — the TLS handshake
Every HTTPS connection begins with a TLS handshake before any page content loads. Four steps happen in roughly 1-2 round trips:
- Client hello. Browser sends supported TLS versions and cipher suites to the server.
- Server hello + certificate. Server responds with its choice of cipher suite and its SSL/TLS certificate, which proves identity and contains the public key.
- Session key generation. Browser verifies the certificate against a trusted Certificate Authority, then both sides generate matching session keys without transmitting them.
- Encrypted transfer begins. All subsequent data — in both directions — is encrypted with those session keys.
Browser → Server: ClientHello (TLS version, cipher list)
Server → Browser: ServerHello + Certificate
Browser → Server: Key exchange (encrypted with server public key)
Both sides → Encrypted session established
# All subsequent requests and responses are encrypted
HTTPS vs HTTP — key differences
| Factor | HTTP | HTTPS |
|---|---|---|
| Encryption | None | SSL/TLS encryption |
| Default port | 80 | 443 |
| Browser indicator | "Not Secure" warning | Padlock icon |
| Google ranking signal | No | Yes (since 2014) |
| Referral data preserved | Lost when linking to HTTPS | Preserved |
| Service workers, PWA | Not available | Available |
| Payment / geolocation APIs | Blocked by browsers | Available |
Common HTTPS implementation scenarios
1. Forcing HTTP to HTTPS with a server redirect
server {
listen 80;
server_name example.com www.example.com;
return 301 https://$host$request_uri;
}
2. Adding HSTS to force browsers to always use HTTPS
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
3. Mixed content — the most common post-migration problem
<img src="http://example.com/image.jpg"> # Browser blocks this
# Good — relative or HTTPS path
<img src="/images/image.jpg"> # Works correctly
HTTPS vs SSL certificate — what's the difference?
People often use HTTPS and SSL interchangeably, but they are different things. SSL (and its successor TLS) is the encryption protocol. HTTPS is HTTP running over that protocol. Think of it this way: TLS is the lock, HTTPS is the locked door.
HTTPS is
- The protocol (how data travels)
- What appears in browser address bars
- What Google confirms as a ranking signal
- The URL scheme (
https://) - What Chrome checks before showing the padlock
SSL/TLS certificate is
- The cryptographic credential proving identity
- Installed on the server, not in the URL
- Issued by a Certificate Authority
- What expires and needs renewal
- Free via Let's Encrypt or included by most hosts
7 HTTPS migration best practices
- Use 301 redirects, not 302. A permanent redirect from HTTP to HTTPS passes link equity to the HTTPS version. A 302 is temporary and keeps the HTTP URL in Google's index.
- Update all internal links to HTTPS. Even with redirects in place, internal links should point directly to the HTTPS URL to save crawl budget and avoid redirect hops.
- Fix canonical tags before and after migration. All canonical tags must reference the HTTPS version. Stale HTTP canonicals confuse Google about which URL to index.
- Deploy HSTS headers. HTTP Strict Transport Security tells browsers to always use HTTPS for your domain, preventing downgrade attacks and bypassing the redirect for returning visitors.
- Automate certificate renewal. Let's Encrypt certificates expire every 90 days. Use Certbot or your hosting panel's auto-renewal to prevent accidental expiry and the browser warnings that follow.
- Audit for mixed content after migration. Run the migrated site through Screaming Frog or Chrome DevTools to find any resources still loading over HTTP.
- Update Google Search Console and Analytics. Add the HTTPS property in Search Console. Update your Analytics property's default URL to HTTPS to avoid data splits.
After migrating to HTTPS, many sites forget to update their XML sitemap and robots.txt to reference HTTPS URLs. Google's crawler finds the sitemap, sees HTTP URLs, and gets confused about which version to index. Update both files immediately after migration and resubmit the sitemap in Search Console.
Common HTTPS mistakes to avoid
- Mixed content — HTTP resources on HTTPS pages. Browsers block them and warn users.
- Using 302 instead of 301 — temporary redirects keep the HTTP URL in Google's index.
- Forgetting to update canonical tags — stale HTTP canonicals undo the migration for search engines.
- Not deploying HSTS — leaves users vulnerable to downgrade attacks on public networks.
- Certificate expiry — browser warnings tank traffic instantly. Automate renewal.
- Not adding the HTTPS property to Search Console — HTTP and HTTPS are treated as separate properties; you lose visibility into indexing data.
Frequently asked questions
HTTPS is a confirmed ranking signal, but it is lightweight — it functions more as a tiebreaker than a primary ranking factor. The real value comes from user trust, referral data accuracy, and access to modern browser features that require secure origins.
The TLS handshake adds a small overhead, typically 1-2 round trips. Modern TLS 1.3 and optimisations like OCSP stapling and HTTP/2 mean HTTPS sites are often faster than HTTP counterparts. The security overhead is negligible on modern infrastructure.
Yes. Let's Encrypt offers free SSL/TLS certificates trusted by all major browsers. Most hosting providers include free certificates through Let's Encrypt or Cloudflare integrations. There is no reason to pay for a certificate on a standard website.
Browsers display security warnings marking the site as unsafe. Most users leave immediately, causing significant traffic and conversion drops until the certificate is renewed. Set up automatic renewal through Certbot or your hosting control panel.
Mixed content occurs when an HTTPS page loads resources (images, scripts, CSS) over HTTP. Browsers block these resources and display warnings. Fix it by updating all internal URLs to use HTTPS or relative paths, then verify with Chrome DevTools or Screaming Frog.
Related glossary terms
Sources
