HTTPS is the secure version of HTTP, the protocol browsers use to fetch web pages. It encrypts traffic between the browser and server with TLS, so data cannot be read or altered in transit. Google announced HTTPS as a lightweight ranking signal in 2014 and includes it in its page experience guidance, and browsers mark plain HTTP pages as not secure.
Why HTTPS matters for SEO
The direct ranking effect is small, but the side effects are not. Browsers warn users on HTTP forms, some features only work on secure origins, and modern protocols like HTTP/2 and HTTP/3 are used over TLS in practice. When both versions of a URL exist, Google generally prefers the HTTPS one as canonical.
Setting it up properly
Getting a certificate is easy and often free through providers like Let's Encrypt or your host or CDN. The SEO work is in the details around it.
- 301-redirect every HTTP URL to its HTTPS equivalent, one hop
- Update internal links, canonicals, hreflang and sitemaps to HTTPS
- Fix mixed content so pages do not load HTTP resources
- Consider HSTS once redirects are stable
- Renew certificates automatically and monitor expiry
Common certificate problems
An expired certificate, one that does not cover a subdomain, or an incomplete certificate chain makes browsers show a full-page warning. Crawlers may also fail to fetch the page. Wildcard or multi-domain certificates help when you run several subdomains.
Example
An expired certificate on the docs subdomain
Kettlewisp, a log management SaaS, renews certificates automatically for its main site, but its docs subdomain runs on an older server with a manual certificate. When it expires, visitors see a security warning and support tickets arrive within the hour. The team moves the docs behind the same CDN, which manages certificates for every hostname.
Common mistakes
Leaving HTTP pages live
Both versions returning 200 creates duplicates. Redirect HTTP to HTTPS sitewide.
Internal links still on HTTP
Every internal HTTP link adds a redirect hop. Update links at the source.
Questions
No. It protects data in transit only. Application security, software updates and access control are separate concerns.
