Maybe you have seen the little "Not secure" label next to a website address in Chrome and wondered what it means. Or someone told you that "Google wants HTTPS" and you are not sure whether your site has it, whether it helps rankings, or what happens if your site ever gets hacked. These are fair questions, and the answers are simpler than they sound.
In this lesson, I will explain what HTTPS is in plain words, how much it matters for SEO, how to move a site from HTTP to HTTPS without hurting it, and what to do if Google ever flags your site as hacked or dangerous. By the end, you will be able to check your own site's security status in a few minutes.
What is HTTPS, in plain words?
HTTP is the language a browser and a web server use to talk to each other. HTTPS is the same thing with an "S" for secure. The connection is encrypted, which means the data is scrambled while it travels between your visitor and your server.
Think of it like sending a letter. HTTP is a postcard: anyone who handles it along the way can read it. HTTPS is a sealed envelope: only the person it is addressed to can open it. That matters a lot when visitors type in passwords, card details or even a simple contact form.
To use HTTPS, your site needs a TLS certificate (people still often call it an "SSL certificate", which is the older name). The certificate proves that your site really is your site, and it lets the browser set up the encrypted connection. Many hosting companies now include a free certificate and switch it on with one click.
HTTPS gives your visitors three things:
- Privacy: nobody in between, such as someone on the same café Wi-Fi, can read what is sent.
- Integrity: nobody in between can change the page, for example by injecting ads or malicious code.
- Authentication: the visitor can trust they are talking to your real site and not a fake copy.
Does HTTPS help your Google rankings?
Let me be honest and precise here, because this topic is full of exaggeration. In August 2014, Google announced on its Search Central blog that it would use HTTPS as a ranking signal. I have written about what that announcement really meant in my post on HTTPS as a ranking signal. In brief, it was a small signal, not a magic boost.
Today, Google talks about HTTPS as part of good page experience. Its page experience guide asks site owners, "Are your pages served in a secure fashion?" The same guide says Core Web Vitals are used by Google's ranking systems, while other page experience aspects don't directly help a site rank higher. So I suggest you don't expect HTTPS alone to move you up the results.
Here is why you should still treat it as essential:
- When both an HTTP and HTTPS version of a page exist, Google prefers to index the HTTPS version, as its HTTPS report help page explains.
- Browsers warn people about pages that are not secure, and those warnings scare visitors away.
- Forms, logins and checkouts on plain HTTP put your customers' data at risk.
- Many modern browser features only work on secure pages.
In other words, HTTPS is now the normal starting point. Not having it is a problem; having it is simply expected.
How do you move a site from HTTP to HTTPS?
If your site is still on HTTP, moving to HTTPS is a site move, because every URL changes from http:// to https://. Google's site move guide lists HTTP to HTTPS as one of these moves. The good news is that it is the simplest kind. You don't need Search Console's Change of Address tool for it; Google detects the switch on its own.
Here is how I would do it, step by step:
- Get and install a TLS certificate. Ask your host or check your hosting dashboard. Many hosts offer a free certificate.
- Check that every page loads on https://. Open a few key pages, the homepage, a blog post, a product page, a form, with https:// in front.
- Fix mixed content. Make sure images, scripts and stylesheets also load over HTTPS (more on this below).
- Update internal links. Change links in menus, footers and content to the https:// version, so you don't send visitors and Googlebot through redirects.
- Add permanent redirects. Set up server-side 301 redirects from every http:// URL to the matching https:// URL, page to page, not everything to the homepage. My lesson on redirects explains how they work.
- Update canonical tags and sitemaps. Each page's canonical tag should point to its https:// URL, and your XML sitemap should list only https:// URLs.
- Check robots.txt. Make sure your HTTPS site isn't blocked by a leftover rule.
- Verify the HTTPS site in Search Console. A Domain property covers both versions at once. Then submit your new sitemap and watch the reports.
If you want a more detailed walk-through, my post on HTTPS and SEO covers the setup side, and the post on choosing one URL version explains how HTTPS fits with www vs non-www and trailing slashes.
What is mixed content and why does it matter?
Mixed content happens when a page loads over HTTPS but some of its parts, like an image, a script or a font, still load over plain HTTP. The page is "mixed": partly in a sealed envelope, partly on a postcard.
Browsers don't like this. Depending on the type of file, they may block it or show a warning instead of the secure padlock. A blocked script can break your menu, your form or your checkout. A blocked image just disappears.
Mixed content usually comes from old hard-coded links, for example an image inserted years ago as http://example.com/photo.jpg, or a theme or plugin that calls a file over HTTP. To find it, open a page in Chrome, right-click, choose "Inspect" and look at the Console tab for mixed content warnings. A site crawler can also list every http:// resource across your whole site.
The fix is to change those addresses to https://, or to remove the resource if the other site doesn't support HTTPS.
How to read the HTTPS report in Search Console
Search Console has an HTTPS report that shows how many of your indexed pages are HTTP and how many are HTTPS. For HTTP pages, it tells you why Google didn't index the HTTPS version instead. If you are new to Search Console, my lesson on Google Search Console shows you around.
| Reason in the report | What it means | What to do |
|---|---|---|
| HTTP marked with canonical tag | The HTTP page says it is the main version | Point the canonical tag to the HTTPS URL |
| HTTPS has invalid certificate | Your certificate is expired, wrong or missing | Renew or reinstall the certificate with your host |
| Sitemap points to HTTP | Your sitemap still lists http:// URLs | Regenerate the sitemap with https:// URLs |
| HTTPS has redirect | The HTTPS URL redirects back to HTTP | Remove that redirect or send it to an HTTPS page |
| HTTPS URL is roboted | robots.txt blocks the HTTPS URL | Fix the robots.txt rule |
| HTTPS not evaluated | A catch-all, for example the HTTPS version returns an error or hasn't been crawled yet | Fix the other reasons first, then wait for a recrawl |
Google notes that this report shows a sample of URLs, not a full list, and some issues clear up on their own once Google recrawls the HTTPS pages.
What happens when a site gets hacked?
HTTPS protects the connection. It does not stop someone from breaking into your website itself. A site on HTTPS can still be hacked through an outdated plugin, a weak password or a vulnerable theme.
When that happens, Google may find the problem and list it in the Security issues report in Search Console. Google groups these issues into three broad types:
- Hacked content: pages, links or code someone added to your site without permission, such as hidden spam pages selling fake products.
- Malware and unwanted software: code or downloads that harm visitors' devices.
- Social engineering: content that tricks visitors into doing something dangerous, like a fake login page.
Affected sites can show a warning in Google's search results, and browsers like Chrome can show a full-page red warning before the visitor reaches the site. These warnings come from Google's Safe Browsing technology, which flags dangerous sites for browsers and apps. As you can imagine, a red warning screen stops most visitors cold, so traffic and sales can drop fast.
Hacked spam also connects to Google's spam rules. If you want to see how the two meet, read my posts on recovering when a hacked site gets caught in a spam update and Google's spam policies.
How to recover from a security issue
Here is the general order I would follow if your site is flagged:
- Contact your host. They often have security tools and can help find the entry point.
- Find out how the attacker got in, for example an old plugin or a stolen password, and close that gap.
- Clean every affected page and file, or restore a clean backup and then patch the hole.
- Change all passwords for the site, hosting, database and FTP.
- In the Security issues report, click Request Review and explain what the problem was, what you did, and the result.
Two points from Google's help page are worth knowing. First, you must fix the issue on all affected pages; fixing only some won't get you a partial return. Second, reviews usually take from several days to a few weeks, and you shouldn't resubmit while a request is still pending.
How to keep your site secure from now on
Prevention is far cheaper than cleanup. Google's guide on preventing malware infections gives sensible advice, which I sum up here:
- Keep your CMS, themes, plugins and server software updated.
- Use strong, unique passwords for every account connected to the site.
- Remove plugins, themes and old tools you no longer use.
- Use SFTP or SSH instead of plain FTP to move files.
- Keep regular backups stored somewhere other than your server.
- Run a
site:yourdomain.comsearch now and then to spot pages you didn't create. - Make sure Search Console messages reach your email inbox.
Try it: check your site's security in ten minutes
Let's put this lesson to work on your own site. Set a timer for ten minutes and go through these checks:
- Type
http://yourdomain.cominto your browser. Does it redirect to the https:// version on its own? It should. - Look at the address bar. Do you see a padlock or similar secure icon, with no "Not secure" warning?
- Open your three most important pages (homepage, a service or product page, a contact form) and check the same thing on each.
- On one page, right-click, choose Inspect, and look at the Console tab for "Mixed Content" messages.
- In Search Console, open Security issues. You want to see "No issues detected."
- Still in Search Console, open the HTTPS report and note any HTTP URLs and their reasons.
Write down anything that fails. Most of these fixes take a single setting change or a quick message to your host.
Questions beginners ask about HTTPS and site security
Do I need a paid SSL certificate for SEO?
Not as far as Google's documentation goes. Its HTTPS report checks whether your certificate is valid, not what you paid for it. A free certificate from your host is fine for most sites.
Will moving to HTTPS make my rankings drop?
You may see small ups and downs while Google recrawls your URLs. If you redirect page to page, update internal links, canonicals and sitemaps, and avoid mixed content, the move is usually smooth.
Do I need the Change of Address tool when moving to HTTPS?
No. Google's help says the Change of Address tool doesn't support HTTP to HTTPS changes because Google detects them automatically. You only need it when moving to a different domain.
Does HTTPS protect my site from being hacked?
No. HTTPS protects data while it travels between the visitor and your server. Keeping the site itself safe requires updates, strong passwords and good hosting.
How do I know if Google thinks my site is dangerous?
Check the Security issues report in Search Console. If Google finds hacked content, malware or social engineering on your site, it lists the issue there, with sample URLs.
Secure sites are the starting line, not the finish line
In brief, HTTPS encrypts the connection between your site and your visitors. It is a small signal for rankings but a big deal for trust, and Google prefers to index HTTPS pages. Move with page-to-page 301 redirects, fix mixed content, update canonicals and sitemaps, and watch the HTTPS and Security issues reports in Search Console. And remember that HTTPS doesn't stop hackers, so keep your software updated and your passwords strong.
In the next lesson, we look at JavaScript SEO basics: how Google handles sites built with JavaScript and how to make sure your content gets seen. If you would rather have someone check your site's security setup or plan an HTTPS move for you, you can always get in touch with our team.