HTTPS and SEO: certificates, HSTS, and mixed content

HTTPS has been a Google ranking signal since 2014, and it is a light one. You will not jump ten spots for adding a certificate. The real SEO risk is the opposite: a half-finished setup that splits your URLs, warns visitors, or locks out crawlers. This guide covers what to get right and what to skip.

Why HTTPS matters less for ranking than for everything else

Google has described HTTPS as a minor signal that works as a tiebreaker. Treat it as a baseline, not a growth tactic. What it does affect is trust and measurement.

• Browsers label plain HTTP pages as not secure, which hurts conversions and clicks you already earned.
• Referrer data is stripped when a visitor moves from an HTTPS page to an HTTP page, so your analytics can misattribute traffic.
• Some browser features and newer web APIs only work on secure origins.
• Google prefers the HTTPS version when it picks a canonical between two duplicates.

None of that is dramatic. All of it is cheap to fix, and a site that skips it looks neglected.

Redirects: one hop, every time

After you install a certificate, your site often answers on four addresses: http and https, with and without www. Search engines see four copies of every page unless you collapse them.

1. Pick one canonical origin, for example https://www.example.com.
2. Send every other variant to it with a single 301 redirect. Avoid chains like http to https to www.
3. Update canonical tags, hreflang, and your XML sitemap to use the final URLs.
4. Change internal links to point straight at the HTTPS version instead of relying on redirects.
5. Use a domain property in Search Console so all four variants are covered in one view.

Chains matter because each hop adds latency for users and wastes crawler requests. Our guide to 301 redirects covers the failure modes in detail.

Mixed content: the quiet breakage

Mixed content means an HTTPS page loads a resource over HTTP. Modern browsers block most of it. Scripts and stylesheets that fail to load can break layout or functionality, and images may simply disappear.

This usually appears after a migration, when old posts still hold hard-coded http:// image URLs. It is worth a crawl to find them.

• Crawl the site and filter for any resource URL starting with http://.
• Search your database for http:// references to your own domain and replace them.
• Check third-party embeds, fonts, and widgets, which are common offenders.
• Open the browser console on key templates. Blocked requests are listed there.

A content security policy with the upgrade-insecure-requests directive can rewrite insecure requests as a safety net. Use it as a backstop, not a substitute for fixing the URLs.

HSTS: useful, but hard to undo

HTTP Strict Transport Security is a response header that tells browsers to use HTTPS for your domain and skip the insecure request entirely. It saves a redirect for returning visitors and closes a downgrade gap.

The header takes a max-age in seconds. Start small, such as a few minutes or a day, confirm nothing breaks, then raise it. The includeSubDomains option applies the rule to every subdomain, so make sure all of them serve valid HTTPS first.

Be careful with the preload option. Submitting to the browser preload list bakes your domain into browsers, and removal can take a long time. Only do it when you are sure every subdomain will stay on HTTPS.

Raise HSTS in stages. A mistake with a long max-age is slow to reverse.

Certificate hygiene and crawlers

An expired or misnamed certificate is the most common way HTTPS goes wrong years after launch. Visitors see a full-page warning and most leave. Crawlers may fail the connection, and repeated failures can slow how often your pages get fetched.

• Turn on automatic renewal and add an alert for the weeks before expiry.
• Make sure the certificate covers every hostname you serve, including www and subdomains.
• Serve the full certificate chain, since some clients fail without intermediates.
• Test with an outside tool after each change, not just your own browser, which may cache a working chain.

There is no solid public data on how much a short outage costs rankings, so treat any precise figure you read with suspicion. The safe assumption is that it costs traffic while it lasts and little afterward if you fix it fast.

What to do this week

Run through this short audit on your own site:

1. Request all four URL variants of your homepage and confirm each ends at one HTTPS address in a single hop.
2. Crawl for http:// resources and internal links, and fix them.
3. Check the certificate expiry date and confirm renewal is automatic.
4. Add an HSTS header with a short max-age, then raise it over a few weeks.
5. Confirm your sitemap, canonicals, and Search Console property all use the HTTPS version.

If those five pass, HTTPS is done. It will not win you rankings, but it removes a class of problems that can quietly lose them.