Serving your site over HTTPS
HTTPS encrypts the connection between a visitor and your website. It has been a Google ranking signal since 2014, and browsers now actively warn people away from sites that lack it.
What it is
HTTPS is HTTP with a layer of encryption. A TLS certificate proves the site is what it claims to be, and scrambles everything sent between the browser and the server so it cannot be read or altered in transit.
Without it, anyone on the same network can read what a visitor submits, and in some cases inject content into the page.
Why it matters
Chrome, Safari and Firefox all mark plain HTTP pages as 'Not secure' in the address bar. For a business asking people to fill in a contact form or make a booking, that warning does more damage than any ranking penalty.
Google has confirmed HTTPS as a lightweight ranking signal. More importantly, many modern browser features, including geolocation and service workers, simply refuse to run on an insecure origin.
How to fix it
- Check whether your host already offers free certificates. Most managed hosts and every major platform now include Let's Encrypt certificates at no cost.
- Install the certificate, then redirect every HTTP request to its HTTPS equivalent with a 301 redirect, so links and rankings carry across.
- Update internal links, images, scripts and stylesheets to HTTPS. A single HTTP asset on an HTTPS page causes a mixed-content warning.
- Update the canonical tags and the sitemap so they list the HTTPS addresses.
- Add the HTTPS property in Google Search Console; it is treated as a separate site.
What good looks like
<!-- Apache: force HTTPS -->
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]Common mistakes
- Installing the certificate but never redirecting, so both versions stay live and split your ranking signals.
- Leaving images or scripts on HTTP, which keeps the padlock away even though the certificate is valid.
- Forgetting to renew. Let's Encrypt certificates last 90 days and should be renewed automatically.
Check your own site. ppclift checks this automatically on every page it audits. Run a free audit and see every check on one page, with no account required.