HTTPS and SEO: Ranking Impact, Safe Migration and Common Errors

HTTPS SEO is mostly a solved question in 2026: according to the HTTP Archive Web Almanac 2024, 95.6% of mobile home pages are now served over HTTPS. The remaining questions are practical: how much the protocol weighs in rankings, how to move an older site without losing traffic, and which configuration errors still cost positions. This guide answers them with Google's own documentation.

What is HTTPS and how does it work?

HTTPS (Hypertext Transfer Protocol Secure) is HTTP sent through an encrypted TLS connection. The server presents a TLS certificate (still often called an SSL certificate) issued by a certificate authority; the browser checks it, then encrypts everything exchanged with the site. The certificate is tied to your domain names, which are resolved through the DNS, and it can be served by your host or by a CDN placed in front of your site.

Certificates come in three validation levels: domain validation (DV), organization validation (OV) and extended validation (EV). For SEO, the level makes no difference: Google checks that the connection is valid, not which type of certificate secures it. A DV certificate, free and issued in minutes, is enough for most sites; OV and EV add a check of the company behind the domain, which some banks or large companies require for their own reasons.

Does HTTPS affect SEO rankings?

Yes, but far less than content and links. The answer has two layers: the official ranking signal, and the indirect effects that matter more in practice.

What Google announced in 2014

On August 7, 2014, Google announced in its post HTTPS as a ranking signal that it was "only a very lightweight signal, affecting fewer than 1% of global queries, and carrying less weight than other signals such as high-quality content". The same post recommended 2048-bit key certificates and warned against blocking the HTTPS site in robots.txt. HTTPS behaves like a tie-breaker: it can separate two pages of similar quality, it will not lift a weak page above a strong one.

What Google's documentation says today

Google's page experience documentation includes "Are your pages served in a secure fashion?" among the questions to self-assess, then specifies that "Beyond Core Web Vitals, other page experience aspects don't directly help your website rank higher in search results". Read together with the 2014 announcement, the message is consistent: HTTPS is expected as a baseline, and the ranking gain from switching is small. The confirmed Google ranking factors put it in perspective next to relevance, quality and links.

The indirect effects that matter more

• Trust and conversions. Since Chrome 68 in July 2018, Chrome marks every HTTP page as "Not secure" in the address bar, as announced on the Chromium blog. A warning next to a form or a checkout costs clicks and sales, which is why HTTPS belongs to UX SEO as much as to technical SEO.
• One canonical version. Google lists whether a page is served over HTTP or HTTPS among the factors it uses to pick a canonical URL. A site that answers on both protocols splits its signals between duplicates until Google consolidates them.
• Speed. Browsers only support HTTP/2 and HTTP/3 over encrypted connections, so HTTPS is the entry ticket to the protocols that help page experience and Core Web Vitals.
• Analytics. When a visitor goes from an HTTPS page to an HTTP page, browsers strip the referrer by default, so an HTTP site sees part of its referral traffic as direct traffic.

How do you migrate from HTTP to HTTPS without losing traffic?

Moving to HTTPS changes every URL of the site, so Google treats it as a site move. Its guide to site moves with URL changes gives the method; the checklist below applies it to a protocol change. The discipline is the same as for any SEO migration.

1. Install and test the certificate

Choose a certificate that covers every hostname you use (example.com and www.example.com, plus any subdomain). Free certificates from Let's Encrypt or from your host and CDN work exactly like paid ones for SEO. Set automatic renewal: an expired certificate shows a full-page browser warning to every visitor.

2. Inventory and map every URL

Crawl the HTTP site and export its URLs from sitemaps, analytics and server logs, including images, PDFs and other files. Each HTTP URL must map to the same path in HTTPS.

3. Fix mixed content

An HTTPS page that loads images, scripts or stylesheets over HTTP triggers mixed content: browsers block or flag those resources. Replace hard-coded http:// links in templates, the database and the CMS settings.

4. Set up 301 redirects in one hop

Google recommends server-side permanent redirects (301 or 308). Redirect http://example.com/page directly to https://www.example.com/page, without passing through an intermediate HTTP www version. Check a sample of old URLs with a redirect checker, including the pages that have backlinks.

5. Update every internal signal

Point canonical URLs, hreflang tags, internal links, structured data and XML sitemaps directly to the HTTPS URLs. A canonical checker quickly shows pages that still declare an HTTP canonical.

6. Configure Search Console

Add a Domain property, or the HTTPS URL-prefix properties, and submit the new sitemap. Google's documentation states that the Change of Address tool is not needed for an HTTP to HTTPS move: it only applies to domain changes.

7. Enable HSTS once everything works

The Strict-Transport-Security header tells browsers to always use HTTPS for your domain. Start with a short duration, then raise it to one year (max-age=31536000) when you are sure every subdomain supports HTTPS. Check the header with an HTTP headers checker.

8. Keep the redirects and monitor

Google advises keeping redirects for at least one year, and keeping them indefinitely is reasonable. Expect some fluctuation for a few weeks while Google recrawls the site.

Which HTTPS errors still hurt SEO?

• Both protocols live. The HTTP version answers with a 200 instead of a 301, creating a full duplicate of the site.
• Redirect chains. HTTP to HTTPS, then non-www to www, then a trailing slash: three hops where one is enough. Each hop slows crawling and users.
• 302 instead of 301. A temporary redirect sends a weaker signal about which URL is permanent. Use a 301 redirect.
• Old HTTP links in profiles you control. Redirects catch them, but updating the links in your social profiles, directories and business listings removes a hop and sends a cleaner signal.
• HTTP canonicals left in templates. The page redirects to HTTPS but declares the HTTP URL as canonical: two contradictory signals.
• An expired or mismatched certificate. Visitors see an error page, and crawlers may fail to fetch the content.
• HSTS preload too early. Submitting the domain to browser preload lists before every subdomain supports HTTPS makes those subdomains unreachable, and removal takes time.

The free Sorank Chrome extension flags on-page errors such as canonicals and redirects while you browse your own pages.

HTTPS, AI crawlers and GEO

ChatGPT, Claude, Perplexity and Gemini rely on crawlers that fetch your pages before they can quote them. These crawlers follow the same rules as a browser: a certificate error, a redirect loop or a blocked HTTPS robots.txt means the page cannot be read, so it cannot be cited. Our guide to robots.txt for AI crawlers explains which bots to allow. A single HTTPS version of each URL also keeps citations pointing to one address, which makes them easier to measure with AI mention tracking.

HTTPS: the baseline, then the real work

HTTPS gives a small ranking boost, removes a trust problem and must be migrated with one clean 301 per URL. Once it is in place, rankings depend on what Google weighs far more: useful content, internal links and authority. Sorank handles that part on autopilot: keyword research, optimized articles published on your HTTPS blog, internal linking and natural backlinks.