Ask ten SEOs whether HTTPS matters and you’ll get answers ranging from “it’s essential” to “it barely registers.” Both camps are quoting the same Google announcement and reading it differently. The useful version of this answer starts with what Google actually said, then explains why the ranking question turned out to be the least important part.
This expands Step 6 of the technical SEO strategies guide on GrowWithSakib, and sits alongside the foundations in what technical SEO actually is on GrowWithSakib.
What HTTPS and SSL Actually Are
When your browser talks to a website over plain HTTP, the conversation travels in readable text. Anyone positioned in between – a public Wi-Fi operator, an internet provider, an attacker on the same network – can read it and, more worryingly, change it before it reaches you.
HTTPS is the same protocol wrapped in encryption, using a certificate installed on your server. The certificate does two jobs: it proves the site is who it claims to be, and it encrypts everything in transit so it can’t be read or tampered with. People still say “SSL certificate” out of habit, though the modern protocol is really TLS – the terms are used interchangeably.
Is HTTPS a Ranking Factor? Google’s Actual Words
So switching to HTTPS will not move you from page five to page one. What it does is remove a negative – and today HTTPS also forms part of Google’s broader page experience signals alongside Core Web Vitals and mobile-friendliness, which are covered in the Core Web Vitals guide on GrowWithSakib.
Why HTTPS Actually Matters (The Part That Isn’t About Rankings)
If the ranking signal is genuinely light, why is this non-negotiable? Three reasons, none of them algorithmic.
1. Chrome Tells Your Visitors You’re Not Secure
Chrome began flagging HTTP pages that collect passwords or card details as “Not Secure” in 2017, then extended that label to all HTTP pages in 2018. A visitor doesn’t need to understand certificates to understand a browser warning next to your domain – and the damage lands on trust and conversions long before it touches rankings.
2. From October 2026, Chrome Warns Before Loading HTTP At All
3. You Lose Your Referral Data
When a visitor moves from an HTTPS site to an HTTP one, the referral information is stripped. In your analytics, traffic that genuinely came from another site lands in “direct” – so you lose the ability to see which sites actually send you visitors.
How Widespread Is HTTPS Now?
Do You Need an Expensive Certificate?
No. This is the most persistent myth in the topic. A free Domain Validation certificate from Let’s Encrypt carries exactly the same ranking signal as a costly Extended Validation certificate. Google checks whether the connection is secure and the certificate valid – not what you paid.
| Certificate Type | What It Validates | When It Makes Sense |
|---|---|---|
| Domain Validation (DV) | You control the domain | Almost every site. Free via Let’s Encrypt; auto-renews |
| Organisation Validation (OV) | The domain plus a verified organisation | Businesses wanting visible vetting in cert details |
| Extended Validation (EV) | Rigorous legal verification of the entity | Finance and enterprise. No SEO advantage over DV |
| Wildcard | One certificate covering all subdomains | Sites running many subdomains |
Most hosts now issue and renew Let’s Encrypt certificates automatically, and Cloudflare’s free tier includes SSL – covered among the options in the best technical SEO tools guide on GrowWithSakib.
How to Verify Your SSL Is Actually Healthy
A padlock in the address bar means the basics work. It doesn’t mean the configuration is sound. The free Qualys SSL Labs Server Test grades your setup from A+ to F and tells you exactly what’s weak:
- Your overall grade – aim for A or A+. Anything below B usually points at outdated protocol support or a chain problem.
- Certificate validity and expiry – an expired certificate produces a full-page browser warning, which is the single most damaging site failure on this list.
- The certificate chain – a missing intermediate certificate can work in one browser and fail in another, which makes it maddening to diagnose from your own machine.
- Protocol support – modern TLS enabled, obsolete versions disabled.
Mixed Content: The Most Common HTTPS Problem
Mixed content happens when a page served over HTTPS loads resources – images, scripts, stylesheets, fonts – over plain HTTP. The page is only as secure as its weakest request, so the browser downgrades or blocks it. There are two kinds, and they behave differently:
| Type | What It Is | What Browsers Do |
|---|---|---|
| Passive mixed content | Images, video, audio over HTTP | Often auto-upgraded or shown with a downgraded padlock |
| Active mixed content | Scripts, stylesheets, iframes over HTTP | Blocked outright – which can visibly break the page |
Active mixed content is the dangerous one: a blocked stylesheet or script can leave a page unstyled or non-functional. The fix is to update every reference to HTTPS:
| # WRONG – insecure resource on a secure page <img src=”http://example.com/logo.png”> <script src=”http://example.com/app.js”></script> # RIGHT – matching protocol <img src=”https://example.com/logo.png”> <script src=”https://example.com/app.js”></script> # BETTER – relative paths for your own assets <img src=”/images/logo.png”> |
Find them by opening your browser console (it lists every mixed content warning), or by crawling the site. On WordPress, a search-and-replace across the database catches hard-coded HTTP URLs in old posts – the usual hiding place.
Migrating from HTTP to HTTPS Without Losing Traffic
A migration is a URL change for every page on your site, so treat it like one. This sequence keeps your rankings intact:
- Install and verify the certificate, then confirm the HTTPS version of the site loads correctly before changing anything else.
- 301-redirect every HTTP URL to its exact HTTPS equivalent – a single hop, page to matching page, never everything to the homepage.
- Update all internal links, canonical tags, and hreflang to point at HTTPS URLs directly, so nothing relies on the redirect.
- Fix mixed content across templates and the database, then confirm a clean padlock on a sample of pages.
- Update your XML sitemap to list only HTTPS URLs, and update the Sitemap line in robots.txt.
- Add the HTTPS property in Google Search Console (an HTTP property will not report on HTTPS URLs), and submit the updated sitemap.
- Enable HSTS once you’re confident everything works, then monitor crawl errors and indexing for several weeks.
For the first few weeks after a migration, watch the Page Indexing report closely – redirect chains and stray 404s surface there first, and the process is covered in how to fix crawl errors in Google Search Console on GrowWithSakib. Once the migration is stable, HSTS (HTTP Strict Transport Security) tells browsers to only ever connect to your site over HTTPS, removing the initial insecure request entirely:
| # HSTS header – add only when HTTPS is fully working Strict-Transport-Security: max-age=31536000; includeSubDomains |
Add this last. Browsers cache the instruction for the duration you specify, so enabling it before your HTTPS setup is solid can lock visitors out of a broken site for a year.
Common HTTPS and SSL Mistakes
| Mistake | Why It Hurts | Do This Instead |
|---|---|---|
| Leaving both HTTP and HTTPS live | Google sees a full duplicate site | 301 every HTTP URL to its HTTPS match |
| Canonicals still naming HTTP URLs | Tells Google the insecure version is master | Update canonicals to HTTPS |
| Sitemap listing HTTP URLs | Wastes crawl budget; contradicts canonicals | List final HTTPS URLs only |
| Redirecting everything to the homepage | Destroys page-level equity; looks like soft 404s | Redirect page to matching page |
| Ignoring mixed content | Active mixed content is blocked and breaks pages | Update every resource reference to HTTPS |
| Buying an EV certificate for SEO | No ranking advantage over free DV | Use Let’s Encrypt unless you need vetting |
| Enabling HSTS too early | Browsers cache it – can lock users out for a year | Add HSTS last, once HTTPS is proven |
| Forgetting the Search Console property | HTTP and HTTPS are separate properties | Add and verify the HTTPS property |
Frequently Asked Questions
Is HTTPS really a Google ranking factor?
Yes, confirmed since August 2014 – but the weight is modest and Google said so plainly. Its announcement described HTTPS as “only a very lightweight signal – affecting fewer than 1% of global queries, and carrying less weight than other signals such as high-quality content.” Google’s Gary Illyes later characterised it as something that can break a tie between two otherwise equal results. So HTTPS won’t lift a page from obscurity, but it removes a negative and forms part of Google’s broader page experience signals alongside Core Web Vitals and mobile-friendliness.
How much will switching to HTTPS improve my rankings?
On its own, very little – and any guide promising dramatic gains is overselling. HTTPS functions as a tiebreaker rather than a lever, affecting under 1% of queries by Google’s own 2014 description. The meaningful benefits are indirect: removing Chrome’s “Not Secure” warning improves trust and conversions, and preserving referral data restores visibility in your analytics. Treat HTTPS as a baseline requirement you must meet rather than an optimisation that will move you up the results page.
What is mixed content and how do I fix it?
Mixed content occurs when a page served over HTTPS loads resources – images, scripts, stylesheets or fonts – over insecure HTTP. There are two types: passive mixed content (images, video, audio) is often auto-upgraded or shown with a downgraded padlock, while active mixed content (scripts, stylesheets, iframes) is blocked outright and can visibly break your page. Fix it by updating every resource reference from http:// to https://, or better, using relative paths for your own assets. Your browser console lists every instance.
Do I need to pay for an SSL certificate for SEO?
No. A free Domain Validation certificate from Let’s Encrypt carries exactly the same ranking signal as an expensive Extended Validation certificate, because Google checks whether the connection is secure and the certificate valid, not what you paid for it. Most hosting providers now issue and auto-renew Let’s Encrypt certificates at no cost, and Cloudflare’s free tier includes SSL. Paid OV and EV certificates offer additional organisational vetting that some finance and enterprise sites want, but they provide no SEO advantage whatsoever.
How do I migrate from HTTP to HTTPS without losing rankings?
Treat it as a URL change for every page. Install and verify the certificate first, then 301-redirect every HTTP URL to its exact HTTPS equivalent in a single hop – page to matching page, never everything to the homepage. Update internal links, canonical tags and hreflang to HTTPS directly, fix mixed content, update your XML sitemap and the robots.txt sitemap line, then add the HTTPS property in Google Search Console since HTTP and HTTPS are tracked separately. Enable HSTS last, once everything is proven working.
What is Chrome’s 2026 HTTPS change?
Google has announced that from Chrome 154, releasing in October 2026, the “Always Use Secure Connections” setting becomes the default for all users. Chrome will attempt every connection over HTTPS and ask for confirmation before visiting any public site that doesn’t support it. The rollout began in April 2026 with Chrome 147 for Enhanced Safe Browsing users. The practical effect is that HTTP sites stop being merely flagged as insecure and become sites visitors must actively choose to proceed to, making HTTPS an access requirement rather than an SEO consideration.
How do I check if my SSL certificate is set up correctly?
Use the free Qualys SSL Labs Server Test, which grades your configuration from A+ to F and identifies specific weaknesses. Aim for an A or A+. Check four things in particular: your overall grade, certificate validity and expiry date, the certificate chain (a missing intermediate certificate can work in your browser while failing for visitors), and protocol support with modern TLS enabled and obsolete versions disabled. Crucially, never judge your SSL from your own browser alone, since cached data can hide problems that visitors experience.
Should I use HSTS on my website?
Yes, but only once your HTTPS setup is fully working and stable. HSTS, or HTTP Strict Transport Security, is a header that tells browsers to connect to your site only over HTTPS, eliminating the initial insecure request. The reason to wait is that browsers cache the instruction for the duration you specify, commonly a year, so enabling it before everything works properly can effectively lock visitors out of a broken site with no easy way to reverse it. Add it as the final step of a migration, not the first.
Key Takeaways
- HTTPS has been a confirmed Google ranking factor since August 2014 – but Google called it ‘only a very lightweight signal’, affecting fewer than 1% of global queries.
- Gary Illyes described its practical role as a tiebreaker between two otherwise equal results. It removes a negative rather than acting as a lever.
- Rankings were never the real reason. Chrome has flagged HTTP pages as ‘Not Secure’ since 2018, and that trust damage hits conversions long before rankings.
- From Chrome 154 in October 2026, secure connections become the default, with a warning before any HTTP page loads – making HTTPS an access requirement.
- Adoption is now 95-99% of pages in Chrome on Windows, Android, Mac and ChromeOS. HTTPS is table stakes; lacking it puts you in a shrinking suspect minority.
- A free Let’s Encrypt DV certificate carries exactly the same ranking signal as an expensive EV certificate. Paying more buys vetting, not SEO.
- Fix mixed content: active mixed content (scripts, stylesheets, iframes) is blocked outright and can visibly break pages.
- Migrating means single-hop 301s to matching pages, HTTPS canonicals, an HTTPS sitemap, a new Search Console property – and HSTS added last, never first.
