Serving your site over HTTPS
HTTPS encrypts the connection between a visitor and your website. It has been a Google ranking signal since 2014, and browsers now actively warn people away from sites that lack it.
What it is
HTTPS is HTTP with a layer of encryption. A TLS certificate proves the site is what it claims to be, and scrambles everything sent between the browser and the server so it can't be read or altered in transit.
Without it, anyone on the same network can read what a visitor submits, and in some cases inject content into the page.
Why it matters
Chrome, Safari and Firefox all mark plain HTTP pages as 'Not secure' in the address bar. For a business asking people to fill in a contact form or make a booking, that warning does more damage than any ranking penalty.
Google has confirmed HTTPS as a lightweight ranking signal. More importantly, many modern browser features, including geolocation and service workers, simply refuse to run on an insecure origin.
Moving across without losing rankings
Treat the switch as a site move, because to a search engine that is what it is. Every address changes from http:// to https://, and the ranking history attached to the old addresses only follows if each one redirects permanently to its new equivalent. A 301 to the matching page keeps that history; sending everything to the home page throws most of it away.
Plan the order of work. Install and test the certificate first, then turn on the redirects, then update everything that still names the old addresses: internal links, the canonical tags, the sitemap, the Google Business Profile listing, social profiles and any directory you control. Rankings sometimes wobble for a week or two while the new addresses are recrawled. They settle if the redirects are clean, and rarely do if they aren't.
Checking it worked
Open the site in a private browser window and type the address with http:// in front. You should land on the https:// version of the same page, in a single hop, with a padlock and no warnings. Try it with and without www, because each combination is a separate address that needs its own redirect.
Then look for mixed content. The browser's developer console lists every image, script or stylesheet still requested over HTTP, and those are what keep the padlock away on an otherwise secure page. Once everything is clean, consider adding a Strict-Transport-Security header, which tells browsers to use HTTPS for the site every time without asking first. Add it last: it is remembered for as long as you specify, so turning it on before HTTPS is reliable locks visitors out of a broken setup.
Certificates, renewals and cost
For a business website, the free certificate from Let's Encrypt or the one bundled with the hosting plan is all that is needed. Paid certificates that verify the organisation behind the site exist, but browsers no longer display that verification prominently, and search engines treat every valid certificate the same way. Paying more buys no ranking advantage and no extra padlock.
What matters far more is renewal. Free certificates are short-lived by design, so they rely on the host renewing them automatically. When that automation breaks, the site doesn't slowly degrade. Overnight, every visitor sees a full-page browser warning that the connection is not private, and most of them leave before they read any further.
Ask the host or developer how renewal is handled, and set a reminder to check the expiry date shown when you click the padlock. Sites that sit behind a content delivery network or a website builder usually have certificates managed for them entirely, which is one less thing to go wrong. Either way, it is worth knowing who is responsible before the day it expires rather than after.
How to fix it
- Check whether your host already offers free certificates. Most managed hosts and every major platform now include Let's Encrypt certificates at no cost.
- Install the certificate, then redirect every HTTP request to its HTTPS equivalent with a 301 redirect, so links and rankings carry across.
- Update internal links, images, scripts and stylesheets to HTTPS. A single HTTP asset on an HTTPS page causes a mixed-content warning.
- Update the canonical tags and the sitemap so they list the HTTPS addresses.
- Add the HTTPS property in Google Search Console; it's treated as a separate site.
- Check the certificate's expiry date every few months, or use a free monitoring service that emails you before it runs out.
What good looks like
<!-- Apache: force HTTPS -->
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]Common mistakes
- Installing the certificate but never redirecting, so both versions stay live and split your ranking signals.
- Leaving images or scripts on HTTP, which keeps the padlock away even though the certificate is valid.
- Forgetting to renew. Let's Encrypt certificates last 90 days and should be renewed automatically.
- Redirecting through several hops, such as http to https to www, which slows every visit and dilutes the signal each redirect passes on.
Check your own site. ppclift checks this automatically on every page it audits. Run a free audit and see every check on one page, with no account required.
Doing this for a client? This is one of 15 checks. ppclift is SEO lead generation software that audits every local business in a suburb at once, so you can find SEO clients who already need this work. Free plan, no card.