# What is HTTPS?

> HTTPS is HTTP sent over an encrypted TLS connection, which protects data in transit and proves to browsers that they reached the genuine site.

URL: https://yes-seo.com/glossary/https

**HTTPS** (Hypertext Transfer Protocol Secure) is ordinary HTTP carried over an encrypted TLS connection. It gives every visit three guarantees: *encryption* (nobody on the network can read the traffic), *integrity* (nobody can alter it in transit, for example to inject ads or malware) and *authentication* (the browser has verified, through an [SSL certificate](https://yes-seo.com/glossary/ssl-certificate), that it’s talking to the real domain). The `https` URI scheme is defined in [RFC 9110](https://www.rfc-editor.org/rfc/rfc9110#name-https-uri-scheme).

## Why HTTPS matters for SEO

- **A ranking signal.** Google [announced HTTPS as a ranking signal in 2014](https://developers.google.com/search/blog/2014/08/https-as-ranking-signal). It’s a light signal, but it is part of Google’s page experience considerations.

- **Canonical preference.** When the same page is available over both HTTP and HTTPS, Google generally prefers the HTTPS URL as canonical.

- **Browser warnings.** Chrome and other browsers label HTTP pages “Not secure”, and forms on HTTP pages trigger stronger warnings. Visitors notice.

- **Modern features.** HTTP/2 and HTTP/3 in browsers, service workers, geolocation and many other APIs require a secure context, so HTTP sites are slower and more limited by design.

- **Referral data.** When an HTTPS site links to an HTTP page, browsers strip the referrer by default, so HTTP sites lose attribution data.

## Migrating from HTTP to HTTPS

Installing a certificate is the easy part. A clean migration needs every signal to agree:

- Serve every page over HTTPS with a valid certificate covering all hostnames you use.

- Redirect every HTTP URL to its HTTPS equivalent with a single [301 redirect](https://yes-seo.com/glossary/redirect-301) — same path, not the home page.

- Update canonical tags, hreflang annotations, internal links and sitemaps to HTTPS URLs.

- Fix mixed content: images, scripts or stylesheets still loaded over `http://`.

- Add [HSTS (HTTP Strict Transport Security)](https://yes-seo.com/glossary/hsts) once everything works, so browsers stop trying HTTP at all.

A typical Nginx redirect block:

```
server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://www.example.com$request_uri;
}
```

## Common mistakes

- **Mixed content.** Browsers block scripts and other active content loaded over HTTP from an HTTPS page, which can silently break menus, forms or analytics. See [MDN on mixed content](https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_content).

- **Redirecting everything to the home page** instead of mapping each URL to its HTTPS counterpart.

- **Chained redirects**, such as HTTP → HTTPS → www → trailing slash. Combine them into one hop.

- **Certificates that don’t cover every hostname**, so `www` works but the bare domain throws an error.

- **Forgetting renewals**, leaving visitors facing a full-page certificate warning.

## How to check

The [SSL Checker](https://yes-seo.com/ssl-checker) shows the certificate issuer, validity dates and days left, covered domains, TLS version and whether HTTP redirects to HTTPS. Pair it with the [Security Headers Checker](https://yes-seo.com/security-headers-checker) to confirm HSTS and the other protective headers are in place.

## Frequently asked questions

### Is HTTPS a Google ranking factor?

Yes, but a lightweight one. Google confirmed HTTPS as a ranking signal in 2014. Its bigger effects are indirect: user trust, no browser warnings and a clear canonical version of every URL.

### Will switching to HTTPS hurt my rankings?

A properly executed migration, with one-to-one 301 redirects and updated canonicals, internal links and sitemaps, should not cause lasting losses. Short fluctuations while Google recrawls are normal.