If your website still loads on http://, Chrome shows visitors a "Not secure" warning next to your address. For a business asking customers to call, enquire or pay online, that's a trust problem before it's an SEO problem.
Why HTTPS matters
- Ranking signal: HTTPS has been a lightweight Google ranking signal since 2014. It won't push a weak page to the top, but you shouldn't give it away.
- Trust: "Not secure" warnings scare visitors, especially on contact and payment forms.
- Required for modern features: HTTP/2 and HTTP/3 speed improvements, many browser APIs, and payment gateways like PayHere all expect HTTPS.
- Referral data: traffic from HTTPS sites to HTTP sites loses its referrer, making your analytics less accurate.
What SSL/TLS actually does
An SSL (technically TLS) certificate encrypts the connection between the visitor's browser and your server, so nobody in between, such as on public Wi-Fi, can read or change what's sent. It also confirms the visitor is connected to your real domain.
Getting a certificate
- Free: Let's Encrypt certificates are trusted by all browsers and renew automatically. Most hosts and Cloudflare provide them in one click.
- Paid: organisation-validated certificates exist, but give no SEO advantage over free ones.
For almost every small business, a free certificate is the right choice.
Moving from HTTP to HTTPS
Treat it as a small site migration:
- Install the certificate and confirm
https://loads every page. - Redirect all HTTP URLs to HTTPS with 301 redirects, page to page.
- Update internal links, images and scripts to https, so there's no "mixed content".
- Update canonical tags and your XML sitemap to the HTTPS URLs.
- Add the HTTPS property in Google Search Console, if you use URL-prefix properties. Domain properties cover both.
- Update external profiles: Google Business Profile, social media, directories.
- Check GA4 and other tools use the HTTPS address.
For larger changes, use our website migration SEO checklist.
Mixed content
If an HTTPS page loads images or scripts over HTTP, browsers may block them or show warnings. Find mixed content with your browser's developer console, then update the URLs to https, or use relative URLs.
HSTS
Once HTTPS works everywhere, consider enabling HSTS (HTTP Strict Transport Security). It tells browsers to always use HTTPS for your domain, skipping the redirect. Only enable it when you're sure every subdomain supports HTTPS.
Common mistakes
- Redirecting all HTTP pages to the HTTPS homepage instead of the matching page
- Leaving both HTTP and HTTPS accessible without redirects
- Letting the certificate expire; set up auto-renewal and a reminder
- Certificates that cover
wwwbut not the bare domain, or the reverse
Check yours
Our free SEO health check tests whether your site loads on HTTPS. It's one of the eight checks we run in seconds. For everything else, see the technical SEO checklist.