HTTPS and SEO: Why It Matters and How to Switch Safely

If your site still loads over plain HTTP, or you’re nervous that moving to HTTPS will wreck your rankings, this guide is for you. The short answer: HTTPS and SEO are linked, but not in the way most people think. HTTPS gives only a small ranking boost. The bigger reasons to switch are trust, browser warnings and clean data.

The good news is that switching is safe when you do it in the right order. A move from HTTP to HTTPS is one of the easiest site moves you can make, because your URLs stay the same apart from one letter. Below I explain why it matters and the exact steps I follow to switch without losing traffic.

What HTTPS Is, in Plain Words

HTTPS is the secure version of HTTP, the system browsers use to load web pages. The “S” means the connection between the visitor and your server is encrypted using TLS (Transport Layer Security, the modern name for what most people still call SSL).

Encryption means nobody in between, such as someone on the same public Wi-Fi, can read or change what is sent. That covers form entries, logins and payment details. It also stops networks from injecting ads or scripts into your pages.

To run HTTPS, your server needs a TLS certificate. This is a small file that proves your site is who it says it is. Many hosts now give you one for free.

Does HTTPS Affect SEO?

Yes, but the direct effect is small. Google announced HTTPS as a ranking signal in August 2014. At the time it called it a “lightweight” signal that affected fewer than 1% of global queries, with less weight than signals like high-quality content.

Google has since folded HTTPS into its wider idea of page experience. In its page experience guidance, one of the questions it asks site owners is whether pages are served in a secure way. But nobody should expect a jump in rankings just from adding a certificate.

In my experience, HTTPS works more like a tie-breaker than a booster. If two pages are equally good, the secure one may have a slight edge. If your content is weaker, HTTPS will not save it.

Google Prefers HTTPS URLs When It Has a Choice

This is the part many guides skip. When the same page is available on both HTTP and HTTPS, Google sees them as duplicates and has to pick one to show. Since December 2015, Google has said it prefers the HTTPS version by default, as long as that version meets certain conditions:

• It doesn’t load insecure HTTP resources such as scripts or images.
• It isn’t blocked by robots.txt.
• It doesn’t redirect users to or through an HTTP page.
• Its canonical tag (a line of code that tells Google which version of a page is the main one) doesn’t point to the HTTP URL.
• It doesn’t have a noindex tag.
• It doesn’t link to HTTP URLs on the same site.
• The sitemap lists the HTTPS URL, or at least doesn’t list the HTTP one.
• The server has a valid certificate.

I use this list as a checklist after every migration. If even one of these sends a mixed signal, Google may keep showing the old HTTP URL for longer than you’d like.

Why HTTPS Matters Beyond Rankings

The ranking boost is the weakest reason to switch. These are the reasons I actually care about.

The “Not Secure” Warning

Since 2018, Chrome has marked every HTTP page as “Not secure” in the address bar. Other major browsers show similar warnings, and they are stronger on pages with forms.

That label costs you trust. A visitor who sees it on a contact or checkout page may simply leave. This is not a ranking factor, but fewer enquiries and sales is the outcome you care about anyway.

Cleaner Referral Data

When someone clicks from an HTTPS site to an HTTP site, browsers usually don’t pass on where the visit came from. In your analytics, that traffic shows up as “direct” instead of as a referral.

So if your site is still on HTTP, you are probably undercounting the visits that other sites send you. Moving to HTTPS fixes that for links from secure sites, which is now most of the web.

Modern Features Need It

Many browser features only work on secure pages. These include HTTP/2 in browsers (a faster way of loading files), service workers, geolocation and many payment tools. Some tracking and ad tools also expect HTTPS. Staying on HTTP slowly closes doors.

Which Certificate Do You Need?

For most sites, a free domain-validated (DV) certificate is enough. It proves you control the domain, and it encrypts the connection just as well as a paid one.

• Domain validated (DV): quick and often free, for example from Let’s Encrypt through your host. Fine for blogs, business sites and most online shops.
• Organisation validated (OV) and extended validation (EV): the issuer also checks the company behind the site. Some larger businesses use them for policy reasons.

In my experience, the type of certificate makes no difference to rankings. I’d spend the money on content instead, unless your company rules say otherwise.

One thing does matter: renewal. Free certificates often last about 90 days and are meant to renew automatically. Check that auto-renewal is switched on. An expired certificate shows visitors a full-page warning, which is far worse than the “Not secure” label.

How to Switch From HTTP to HTTPS Without Losing Rankings

Google treats a move from HTTP to HTTPS as a site move with URL changes. You don’t need to do anything special to announce it. You just need clean redirects and consistent signals. Google’s own guide to site moves with URL changes covers the general rules, and this is how I apply them to HTTPS.

Before the Move

1. Take a full backup. Back up files and the database so you can roll back if something breaks.
2. Crawl the current site. Use a crawler to save a list of every HTTP URL, plus your top pages from Search Console. This list is how you’ll check redirects later.
3. Decide www or non-www now. If you want to change this too, do it in the same move so each old URL redirects in one step. I don’t recommend changing the URL paths or the design at the same time, because it makes problems hard to trace.
4. Install the certificate and test HTTPS. Load your main templates over HTTPS before you redirect anything. Check the home page, a category page, a post or product page, and any forms.

Update the Site Itself

5. Change internal links to HTTPS. Update links in menus, content, footers and templates. On WordPress, change the site URL settings, then run a careful search-and-replace on the database. Redirects will catch missed links, but every internal redirect is a wasted hop.
6. Update canonical tags. Each page should have a canonical tag that points to its own HTTPS URL. A leftover HTTP canonical is one of the most common reasons Google keeps the old version.
7. Fix mixed content. Mixed content is when an HTTPS page loads files such as images, scripts or fonts over HTTP. Browsers block many of these files, which can break layouts or features. Google’s web.dev team has a clear explanation of mixed content and why browsers block it.
8. Update everything else that holds URLs. This includes hreflang tags, structured data, Open Graph tags, image links in your CDN, and any hard-coded URLs in scripts or theme files.

Turn on the Redirects

9. Add permanent 301 redirects from HTTP to HTTPS. Use server-side redirects, page to matching page. http://example.com/shoes/ should go to https://example.com/shoes/, not to the home page.
10. Remove redirect chains. If an old page already redirected somewhere, point it straight to the final HTTPS URL. Also check that your old redirect rules don’t send people back to HTTP.
11. Check robots.txt and the sitemap. Make sure the HTTPS robots.txt doesn’t block anything important. Then generate a sitemap that lists only HTTPS URLs.

Here is a simple example of a redirect on an Apache server using the .htaccess file. Your host may have a one-click setting that does the same thing, which I’d use first.

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

On Nginx, the same idea is a server block for port 80 that returns a 301 to the HTTPS address. If you use a CDN such as Cloudflare, check its settings too, so the CDN and your server don’t fight and create a redirect loop.

Set Up Search Console

12. Make sure Search Console covers HTTPS. A Domain property already covers both HTTP and HTTPS. If you use a URL-prefix property, add a new one for the HTTPS version and keep the old one for comparison.
13. Submit the new sitemap. Submit the HTTPS sitemap so Google finds the new URLs quickly.
14. Move your disavow file if you have one. If you uploaded a disavow file to the HTTP URL-prefix property, upload it to the HTTPS property as well. Most sites don’t have one, and that’s fine.

You don’t need the Change of Address tool. Google says it isn’t meant for HTTP to HTTPS moves. It is for moving to a new domain.

What to Check After the Switch

The first few days after a migration are when I catch most problems. This is the order I check things in.

Test the Redirects

Run your saved list of old HTTP URLs through a crawler or redirect checker. Each one should return a single 301 to its matching HTTPS URL, which should then return a 200 (OK) status.

You can also test one URL in a terminal:

curl -I http://example.com/shoes/

Look for 301 and a Location line with the HTTPS address. If you see a 302, a chain of several hops, or the home page as the target, fix it.

Check How Google Sees Key Pages

Use the URL Inspection tool in Search Console on your most important pages. Look at the Google-selected canonical. Over the following weeks, it should change from the HTTP URL to the HTTPS one.

If Google keeps choosing the HTTP version, go back to the conditions earlier in this article. Usually one of them is still sending a mixed signal, such as an old canonical tag or HTTP links in the menu.

Watch the Reports

• Page indexing report: expect HTTP URLs to move into “Page with redirect”, while HTTPS URLs get indexed.
• Performance report: compare clicks and impressions for the old and new versions. With a Domain property, filter by page URL to see the shift.
• Analytics: check that tracking still fires on HTTPS pages and that the site URL in your analytics settings is up to date.

How Long It Takes to Settle

Google says rankings can go up and down for a while during a site move, while it recrawls and processes the new URLs. For a small or medium site moving from HTTP to HTTPS, that usually means a few weeks. Larger sites can take longer.

In my experience, a clean HTTPS migration causes very little movement. When I see a real, lasting drop, there is almost always a technical cause: broken redirects, a blocked robots.txt or HTTPS pages that don’t load properly.

Common HTTPS Migration Mistakes

These are the mistakes I usually see, roughly in order of how often they come up.

• Redirecting everything to the home page. This throws away the link value and relevance of each old page. Always redirect page to matching page.
• Using 302 instead of 301 redirects. A 302 tells Google the move is temporary. Google may work it out over time, but a 301 sends the clearer signal.
• Leaving the HTTP version live. If both versions load without a redirect, you have two copies of every page competing with each other.
• Forgetting old staging rules. A noindex tag or a “Disallow: /” line from testing can block the whole HTTPS site. If you’re unsure how these rules work, my robots.txt guide explains them.
• Keeping redirects for only a few months. Google recommends keeping site move redirects for at least a year. I keep HTTP to HTTPS redirects forever, because they cost nothing.
• Ignoring links you control. Your social profiles, Google Business Profile, email signatures and directory listings still point to HTTP. Update the ones you can.

Update Your Most Valuable Backlinks

Redirects pass signals from old links, so you don’t need to chase every backlink. But for your best links, such as partners, suppliers and industry bodies, it’s worth asking for an update to the HTTPS URL. It saves a redirect hop and keeps things tidy. A backlink audit is a good way to find which links are worth the email.

HSTS: The Extra Step After HTTPS Works

HSTS (HTTP Strict Transport Security) is a header that tells browsers to always use HTTPS for your site, even if someone types or clicks an HTTP link. It closes the small gap before the redirect happens, and it saves that first redirect for returning visitors.

A basic header looks like this:

Strict-Transport-Security: max-age=31536000; includeSubDomains

Be careful with it. Once a browser has seen the header, it will refuse HTTP for your site until max-age runs out. If any subdomain still needs HTTP, includeSubDomains will break it.

My habit is to add HSTS only after the site has run cleanly on HTTPS for a few weeks. I start with a short max-age, such as a day, and increase it once I’m sure nothing breaks. HSTS preloading (adding your domain to a list built into browsers) is even harder to undo, so I’d only do it on sites where every subdomain is fully on HTTPS.

Is It Ever Fine to Stay on HTTP?

Honestly, no, not for a public site in 2025. Certificates are free, most hosts set them up in a few clicks, and the browser warnings alone make HTTP a poor choice.

The only time I’d wait is when you’re in the middle of a bigger change, like a redesign or a platform move. In that case, plan HTTPS into the same project rather than doing two moves a month apart. Each move means a period of recrawling, so combining them keeps the settling period to one.

Conclusion: HTTPS and SEO, Kept in Proportion

HTTPS and SEO go together, but HTTPS is not a magic ranking lever. It is a small signal, a clear preference when Google picks between duplicate URLs, and a basic trust signal for visitors. Treat it as a must-have foundation, not a growth tactic.

If you switch carefully, with page-to-page 301 redirects, updated canonicals and internal links, no mixed content and a fresh sitemap, the move is usually uneventful. Once it’s done, a good next step is to work through my SEO checklist for 2025 to find the next technical issue worth fixing.