HTTPS

HTTPS is HTTP with the connection wrapped in TLS encryption, so everything moving between browser and server — URLs, form data, cookies, credentials — is unreadable and untamperable in transit. The padlock is table stakes now: Google confirmed it as a ranking signal in 2014, Chrome brands plain HTTP as "Not Secure," and free certificates from Let's Encrypt removed the last excuse years ago.

So the interesting part in 2026 isn't whether to run HTTPS — it's that a sloppy HTTPS setup creates genuine SEO damage that a plain HTTP site never had. Duplicate protocol versions splitting your signals, mixed-content warnings scaring users off checkout, an expired certificate throwing full-screen browser interstitials on every page. The protocol upgrade is easy; the hygiene around it is where sites bleed.

Reading your setup in two commands

First, confirm HTTP hands off to HTTPS in a single permanent hop:

curl -I http://example.com/some-page/

HTTP/1.1 301 Moved Permanently
Location: https://example.com/some-page/

Then look at the secure response itself — the header worth hunting for is HSTS, which tells browsers to skip HTTP entirely on future visits:

curl -sI https://example.com/ | grep -i strict

strict-transport-security: max-age=31536000; includeSubDomains

Certificate expiry, the thing that takes sites down at 2 a.m., checks from the terminal too:

echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null 
  | openssl x509 -noout -dates

notBefore=May 12 08:21:44 2026 GMT
notAfter=Aug 10 08:21:43 2026 GMT

Forcing the redirect on Apache, if your host hasn't done it upstream:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

HTTP→HTTPS migration checklist, with what each step risks

The expanded version of each step lives in the HTTPS migration technical checklist.

How to check it on your own site

1. Run the two curl commands above against your homepage and a deep URL. Anything other than one 301 hop from http to the same path on https needs fixing — here's the walkthrough if HTTP isn't redirecting at all.
2. Test whether both protocols answer with 200. If http:// serves content instead of redirecting, you have a protocol split duplicating your entire site — closing that split is covered here.
3. Crawl with Screaming Frog and check Security → Mixed Content for https pages loading http resources. Images degrade the padlock; scripts get blocked entirely by modern browsers. Finding and fixing every flavor of it here.
4. Grade the TLS configuration itself at SSL Labs (ssllabs.com/ssltest) — it catches weak protocol versions, incomplete certificate chains, and misconfigured ciphers that curl won't show you.
5. Put certificate expiry on a monitor (UptimeRobot and most status services check cert validity). Ninety-day Let's Encrypt certs mean renewal automation isn't optional, and you want the alert before browsers show the interstitial.

Common mistakes

• Leaving HTTP alive alongside HTTPS. No redirect means two complete copies of the site competing with each other. Fix: 301 at the load balancer, then verify with a crawl in list mode over your old HTTP URLs.
• Redirect chains through the www/protocol matrix. http://example.com → https://example.com → https://www.example.com is a hop tax on every crawl and click. Fix: one rule that lands any variant on the canonical host and protocol in a single 301.
• Mixed content from hardcoded asset URLs. Ten-year-old templates and database content love absolute http:// image paths. Fix: search-and-replace at the database level, then set a Content-Security-Policy: upgrade-insecure-requests header as a safety net — not as the primary fix.
• Forgetting that GSC properties are protocol-specific. Post-migration, the http property flatlines and looks like a catastrophe; the https property has the real data. Fix: verify both, or use a Domain property and save yourself the heart attack.
• Insecure form targets on secure pages. The page is https but the form posts to an http endpoint — browsers warn, users bail, and the data travels in plaintext. The fix is straightforward; finding every instance is the work.

FAQ

How much does HTTPS actually help rankings?

Google described it as a lightweight tiebreaker, and that hasn't visibly changed. The compelling math is elsewhere: browser trust warnings, referrer data preservation, HTTP/2 and HTTP/3 requiring TLS in practice, and the duplicate-content damage a half-done setup causes. You do it for the ecosystem, not the boost.

Will migrating to HTTPS drop my traffic temporarily?

A clean migration on a small-to-mid site usually shows little more than reporting noise. Larger sites can wobble for a few weeks while Google reprocesses every URL. The dips that make war stories are almost always redirect gaps or mixed-signal canonicals, not the protocol change itself.

Do I need to update my backlinks after migrating?

No — the 301s carry them. If you can get high-value links updated at the source (partners, profiles you control), do it for the marginal crawl efficiency, but it's polish, not a requirement.

What's HSTS and should I enable it?

Strict-Transport-Security is a header telling browsers to always use HTTPS for your domain, eliminating even the first insecure request. Enable it once the migration has been stable for a few weeks, start with a modest max-age, and treat the preload list as a one-way door — removal takes months.

Does the type of certificate (DV/OV/EV) matter for SEO?

Not at all. Google needs valid encryption, full stop. A free Let's Encrypt DV cert and a four-figure EV cert are identical for rankings; browsers stopped displaying EV special treatment years ago. Spend the money on renewal automation instead.