Skip to content
RankThat

HTTPS

HTTPS is the secure version of HTTP. It encrypts data between a visitor's browser and your website using a TLS certificate, and Google uses it as a light ranking signal.

HTTPS (Hypertext Transfer Protocol Secure) is how almost every website is served today. It wraps the connection in TLS encryption, so nobody between the visitor and your server can read or alter what’s sent. That covers form submissions, logins, card details, and the pages themselves.

To use it, your server needs a TLS certificate (often still called an SSL certificate). Most hosts provide free certificates through Let’s Encrypt and renew them automatically.

Why it matters

Trust. Chrome and other browsers label plain HTTP pages “Not secure” in the address bar. If Brightside Dental’s appointment form sits on an HTTP page, a patient sees that warning right before typing in their phone number and date of birth. Many won’t continue.

Rankings. Google confirmed HTTPS as a ranking signal in 2014. It’s a light one, more of a tie-breaker than a major factor, but there’s no reason to give it up.

Features. Many modern browser features, and the HTTP/2 and HTTP/3 protocols as browsers use them, only work over HTTPS.

Moving from HTTP to HTTPS

  1. Install a certificate that covers both example.com and www.example.com.
  2. Redirect every HTTP URL to its HTTPS version with a single 301 redirect, page to page, not everything to the homepage.
  3. Update internal links, canonical tags, sitemaps and hreflang tags to use https://.
  4. Fix any mixed content: images, scripts or stylesheets still loaded over HTTP.
  5. Add the HTTPS property in Google Search Console (a Domain property covers both versions automatically).
  6. Once everything is stable, consider adding HSTS so browsers always use HTTPS.

A typical Apache redirect rule:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [L,R=301]

Common mistakes

  • Both versions loading. If http:// still serves the page without redirecting, you have two copies of the site.
  • Expired certificates. When automatic renewal fails, visitors get a full-screen browser warning. Set up an expiry alert.
  • Certificate doesn’t cover www or a subdomain, which causes errors on some URLs only.
  • Redirect chains like http://example.com to https://example.com to https://www.example.com. Go straight to the final version.

How to check

Visit the HTTP version of your homepage and a deep page, and confirm both land on the matching HTTPS URL in one hop. RankThat’s Site Audit checks for pages not on HTTPS, HTTP pages that don’t redirect, invalid or soon-to-expire certificates, mixed content and a missing HSTS header.

Do this month’s SEO in an afternoon.

Start free trialCheck a site free