HTTPS and SEO: Does an SSL Certificate Improve Rankings?
Google has used HTTPS as a ranking signal since 2014, but it's a light one. Here's what HTTPS really does for SEO, and how to migrate without losing traffic.
Key takeaways
- Google announced HTTPS as a lightweight ranking signal in August 2014.
- The bigger benefits are trust, security and avoiding browser 'Not secure' warnings.
- Migrating to HTTPS needs 301 redirects, updated internal links and canonicals, and Search Console checks.
- Mixed content (HTTP resources on HTTPS pages) breaks the padlock and should be fixed.
In August 2014 Google announced it would use HTTPS as a ranking signal. Today nearly every serious website uses HTTPS, so the question is less “should I?” and more “is mine set up correctly?”
Does HTTPS improve rankings?
A little. Google described it as a lightweight signal affecting a small share of queries. HTTPS won’t lift a weak page above a stronger one. But it matters for other reasons:
- Browser warnings: Chrome and other browsers mark HTTP pages as “Not secure,” especially on forms, which hurts trust and conversions
- Security: HTTPS encrypts data between visitors and your site
- Modern features: many browser features and APIs require HTTPS
- Referral data: traffic from HTTPS sites to HTTP sites can lose referrer information
Checking your HTTPS setup
- Every page loads on
https://with a valid certificate http://and non-preferred versions (www or non-www) 301-redirect to the preferred HTTPS version- Internal links, canonicals and sitemaps use HTTPS URLs
- No mixed content (images, scripts or styles loaded over HTTP)
- The certificate renews automatically before it expires
Migrating from HTTP to HTTPS
- Install a certificate. Many hosts offer free certificates (such as Let’s Encrypt).
- Update internal links, canonical tags, hreflang tags and structured data to HTTPS.
- Add 301 redirects from every HTTP URL to its HTTPS equivalent, one hop each (avoid redirect chains).
- Update your sitemap and robots.txt sitemap reference.
- Add the HTTPS property in Search Console (a Domain property covers both) and submit the new sitemap.
- Fix mixed content warnings.
- Update external profiles: Google Business Profile, social profiles, ad destination URLs.
- Monitor indexing and traffic for a few weeks.
Mixed content
If an HTTPS page loads an image or script over HTTP, browsers may block it or remove the padlock. Use your browser’s developer console to find mixed content warnings, and update those resources to HTTPS.
HSTS
Once you’re fully on HTTPS, consider enabling HSTS (HTTP Strict Transport Security), which tells browsers to always use HTTPS. Only do this when you’re sure everything works on HTTPS.
HTTPS checks are part of our technical SEO audit.