What Is HTTPS? Security, Trust, and Rankings

Aug 04, 2026 · SEO Glossary

You'd think HTTPS would be a solved problem by now. Certificates are free, hosts enable them in one click, and browsers have marked plain HTTP as "Not Secure" since 2018. And yet in audits I still regularly find sites serving both versions simultaneously, mixed-content warnings scaring users off checkout pages, and redirect chains from an HTTPS migration someone half-finished in 2021. Having a certificate and having HTTPS done properly are different things.

What is HTTPS? It's HTTP — the protocol browsers and servers use to exchange web pages — wrapped in TLS encryption. That wrapper guarantees three things: nobody between the user and the server can read the traffic (encryption), nobody can alter it in transit (integrity), and the user is talking to the real server, not an impostor (authentication). The padlock in the address bar is the visible receipt for all three.

What is HTTPS protecting you from, concretely?

The threats aren't theoretical. Without TLS, anyone on the same coffee-shop Wi-Fi can read every form your visitors submit — passwords, card numbers, contact details. Internet providers and rogue hotspots have been caught injecting ads and tracking scripts into plain HTTP pages, meaning users saw a version of your site you never published. And without authentication, a man-in-the-middle can impersonate your site wholesale. TLS closes all three doors at once, which is why browsers now treat unencrypted pages as the anomaly rather than the default.

A misconception worth killing: HTTPS secures the connection, not the website. A phishing site with a valid certificate is still a phishing site — the padlock says "this conversation is private," not "this business is honest." It also does nothing about vulnerabilities in your CMS or server. Encryption is the floor, not the ceiling.

The SEO side of the padlock

Google confirmed HTTPS as a ranking signal back in 2014 — a lightweight one, more tiebreaker than lever. The indirect effects are where the real SEO value sits:

• Browser trust warnings are conversion killers. Chrome flagging "Not Secure" next to your URL, or interrupting a form with a warning, sends visitors back to the results. Google notices when users bounce back.
• Referral data survives. Traffic from an HTTPS page to an HTTP page drops its referrer, so an HTTP site sees inflated "direct" traffic and can't attribute anything properly.
• Modern performance requires it. HTTP/2 and HTTP/3 — the multiplexed protocols that make pages noticeably faster — are only available over TLS in practice. So are browser features like geolocation and service workers. Staying on HTTP locks you out of speed gains that feed Core Web Vitals.

Where migrations actually go wrong

Switching a site to HTTPS is conceptually simple — install a certificate, redirect HTTP to HTTPS, update references. The failure modes live in the details, and I've cleaned up every one of these on real client sites:

1. Mixed content. The page loads over HTTPS but an image, script, or stylesheet still loads over HTTP. Browsers block the insecure resource or strip the padlock. Usually it's hardcoded http:// URLs buried in old database content — on one WordPress migration we found 3,400 of them in post bodies. A crawler finds these in minutes; clicking around does not.
2. Both versions alive. No redirect, so http:// and https:// both return 200 responses — and often www and non-www too, giving Google four copies of every page. The fix is a single 301 redirect from every variant to one canonical version.
3. Redirect chains. HTTP redirects to HTTPS, which redirects to www, which redirects to a trailing slash. Three hops on every legacy link. Each variant should reach the final URL in one hop.
4. Internal links stuck on HTTP. The redirects mask it, but every internal click pays a redirect penalty and sends crawlers on detours. Update the links themselves, don't lean on redirects forever.
5. The expired certificate. Free certificates renew every 90 days — automatically, until the automation silently breaks. An expired certificate takes your site down with a full-screen browser error. Monitoring expiry is the cheapest insurance in tech; a client once lost a weekend of Black Friday traffic to a renewal cron job that had been failing since June.

Checking your implementation right now

Three checks cover most of it. Visit your site with http:// typed explicitly and confirm exactly one redirect lands you on the HTTPS version. Browse your key pages watching for padlock breaks or console warnings about mixed content. Then verify at scale — a full-site crawl flags insecure resources, redirect chains, and HTTP links across every page at once, which matters because mixed content hides on exactly the pages nobody spot-checks. If you run WordPress, the migration-specific gotchas in our WordPress SEO guide are worth a pass too.

Small print that saves headaches

Certificates are free via Let's Encrypt, and paid certificates offer no ranking or encryption advantage — pay only if you need organization validation for compliance reasons. Set up HSTS once your redirects are verified, so browsers skip the insecure hop entirely on repeat visits. And when you migrate, keep the old HTTP property verified in Search Console alongside the new one — you'll want both datasets while Google processes the move, which typically settles within a few weeks for a clean migration.