HTTPS

What is HTTPS?

HTTPS (Hypertext Transfer Protocol Secure) is the encrypted version of HTTP, the protocol browsers use to load web pages. It uses TLS, often still called SSL, to encrypt traffic between the visitor and the server and to prove the site is who it says it is, via a certificate. Sites on HTTPS show https:// in the address bar.

A TLS certificate is issued by a certificate authority for a domain. Free, automatically renewed certificates from authorities such as Let’s Encrypt, and the certificates built into most hosts and CDNs, mean cost is no longer a reason to stay on HTTP.

Why HTTPS matters for SEO

Google announced HTTPS as a ranking signal in 2014 and has described it as a lightweight one. It is also part of Google’s page experience considerations. On its own it will not lift a weak page, but there is no good reason to give it up.

The bigger effect is on people. Chrome and other browsers label HTTP pages "Not secure", which puts visitors off, and many browser features, such as geolocation and service workers, only work over HTTPS. Without it, anything typed into a form can be read or altered in transit.

When both versions exist, Google prefers to index the HTTPS URL as the canonical, as long as it works properly. A half-done move, with HTTP pages still live or mixed content on HTTPS pages, leaves duplicate URLs and warnings.

How to move a site to HTTPS

1. Get a certificate that covers every host you use (www and non-www, plus subdomains). Most hosts and CDNs can issue and renew one automatically.
2. Redirect every HTTP URL to its HTTPS equivalent with a single server-side 301 redirect, page to page, not to the homepage.
3. Update internal links, canonical tags, hreflang annotations and structured data to use https:// URLs.
4. Fix mixed content: every image, script, stylesheet and iframe must load over HTTPS.
5. Update the XML sitemap and the `Sitemap:` line in robots.txt. A robots.txt file must also be served on the HTTPS host.
6. Verify a Domain property in Search Console (it covers both protocols) and watch the page indexing report as Google swaps the URLs.
7. Once everything works, add an HSTS header so browsers always use HTTPS.

HTTPS example

# Send all HTTP traffic to HTTPS in one hop
server {
  listen 80;
  server_name example.com www.example.com;
  return 301 https://www.example.com$request_uri;
}