What is HTTPS?

HTTPS (Hypertext Transfer Protocol Secure) is ordinary HTTP carried over an encrypted TLS connection. It gives every visit three guarantees: encryption (nobody on the network can read the traffic), integrity (nobody can alter it in transit, for example to inject ads or malware) and authentication (the browser has verified, through an SSL certificate, that it’s talking to the real domain). The https URI scheme is defined in RFC 9110.

Why HTTPS matters for SEO

• A ranking signal. Google announced HTTPS as a ranking signal in 2014. It’s a light signal, but it is part of Google’s page experience considerations.
• Canonical preference. When the same page is available over both HTTP and HTTPS, Google generally prefers the HTTPS URL as canonical.
• Browser warnings. Chrome and other browsers label HTTP pages “Not secure”, and forms on HTTP pages trigger stronger warnings. Visitors notice.
• Modern features. HTTP/2 and HTTP/3 in browsers, service workers, geolocation and many other APIs require a secure context, so HTTP sites are slower and more limited by design.
• Referral data. When an HTTPS site links to an HTTP page, browsers strip the referrer by default, so HTTP sites lose attribution data.

Migrating from HTTP to HTTPS

Installing a certificate is the easy part. A clean migration needs every signal to agree:

1. Serve every page over HTTPS with a valid certificate covering all hostnames you use.
2. Redirect every HTTP URL to its HTTPS equivalent with a single 301 redirect — same path, not the home page.
3. Update canonical tags, hreflang annotations, internal links and sitemaps to HTTPS URLs.
4. Fix mixed content: images, scripts or stylesheets still loaded over http://.
5. Add HSTS (HTTP Strict Transport Security) once everything works, so browsers stop trying HTTP at all.

A typical Nginx redirect block:

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://www.example.com$request_uri;
}

Common mistakes

• Mixed content. Browsers block scripts and other active content loaded over HTTP from an HTTPS page, which can silently break menus, forms or analytics. See MDN on mixed content.
• Redirecting everything to the home page instead of mapping each URL to its HTTPS counterpart.
• Chained redirects, such as HTTP → HTTPS → www → trailing slash. Combine them into one hop.
• Certificates that don’t cover every hostname, so www works but the bare domain throws an error.
• Forgetting renewals, leaving visitors facing a full-page certificate warning.

How to check

The SSL Checker shows the certificate issuer, validity dates and days left, covered domains, TLS version and whether HTTP redirects to HTTPS. Pair it with the Security Headers Checker to confirm HSTS and the other protective headers are in place.

Frequently asked questions