# HTTPS HTTPS is HTTP over TLS. For SEO, it is a lightweight ranking signal since 2014 and a clear trust cue. A small site should run 100 percent over HTTPS and redirect the rest cleanly. Updated 2026-09-14 · Source: https://porteur.ai/glossary/https ## What HTTPS means for SEO Google announced HTTPS as a lightweight ranking signal in August 2014. Chrome has marked HTTP pages as Not secure since July 2018, and browsers now default to HTTPS. Users expect the lock. Search expects the secure version to be canonical. On a small site, the gains are simple: fewer browser warnings, higher user trust, and fewer indexing quirks. You will not jump rankings on HTTPS alone, but you remove friction that costs clicks and links. ## How to check your setup 1. **Open a known HTTP URL** Type http://yourproduct.com/pricing. It should 301 once to https://yourproduct.com/pricing, not via www or a slash hop first. 2. **Check canonicals and sitemap** View source on a few pages. The rel=canonical must point to the HTTPS URL. Your XML sitemap should list only HTTPS URLs. 3. **Test mixed content** Load https://yourproduct.com in a fresh browser tab and check the console for blocked HTTP images, scripts or fonts. Fix to HTTPS or host locally. 4. **Verify in Search Console** Add your site as a Domain property so both protocols are covered at once. Use the Sitemaps report to resubmit the HTTPS sitemap. 5. **Spot stray links** Search your codebase and CMS for “http://yourproduct.com”. Update internal links, Open Graph tags and RSS feeds to HTTPS. > Do not chain redirects. One hop from HTTP to HTTPS. ## The migration checklist Certificates are free. Use Let’s Encrypt or your CDN’s certificate. Enable TLS on all hosts that serve your domain, including www and any subdomains you use. - Force a 301 from HTTP to HTTPS in one hop on every host. - Keep the same paths and query strings. Do not change URLs during the switch. - Set rel=canonical to the HTTPS URL on every page. - List only HTTPS URLs in your XML sitemap and resubmit it. - Update hreflang, Open Graph and structured data to reference HTTPS. - Rewrite absolute internal links to HTTPS. Relative links are fine. - Purge caches and warm the CDN on key pages like /, /pricing and /guides/getting-started. A fixed page looks like this: http://yourproduct.com/pricing 301 → https://yourproduct.com/pricing. The page source rel=canonical is https://yourproduct.com/pricing and every resource loads over HTTPS. ## Common traps and how to fix them - Mixed content: an HTTPS page loads an image, script or font over HTTP. Update the URL to HTTPS or serve the file from your domain. - Redirect loops: both HTTP and HTTPS redirect to each other. Fix rules so only HTTP redirects to HTTPS, never the other way. - Redirect chains: http → http www → https www. Collapse to a single 301 hop. - Stale canonicals: pages still declare an HTTP canonical. Update templates so it is always the HTTPS URL. - Old sitemaps: an HTTP sitemap still listed or submitted. Remove it, submit the HTTPS sitemap only. - Subdomains forgotten: blog.yourproduct.com still on HTTP. Issue a certificate and apply the same rules there. ## When to add HSTS HTTP Strict Transport Security tells browsers to always use HTTPS for your domain. It reduces downgrade attacks and removes a first hop from HTTP. Set a short max‑age first, then raise it once you are confident. Only enable HSTS after every page and subdomain you serve is stable on HTTPS and redirecting correctly. Consider the preload list later, as it is hard to roll back. ## Questions ### Does HTTPS improve rankings? A little. As of 2014 it is a lightweight signal. The real gains are trust, no browser warnings and cleaner indexing. You still need good content and speed. ### How do I move from HTTP to HTTPS without losing SEO? Keep URLs the same and 301 every HTTP URL to its HTTPS twin in one hop. Update canonicals, sitemaps and internal links to HTTPS. Verify a Domain property in Search Console and submit the HTTPS sitemap. ### What is mixed content and how do I find it? It is when an HTTPS page loads assets over HTTP. Browsers block or warn on these. Open the console on a few key pages and fix each URL to HTTPS or host the file yourself. ### Should I enable HSTS? Yes, once everything works on HTTPS. Start with a short max‑age so you can roll back if needed, then extend it and consider preloading when stable. ### Do I need to update old backlinks to HTTPS? Not urgently if your redirects are clean. A one‑hop 301 passes users and signals. Update important links you control, like profiles and directory listings. ### Do canonical tags need HTTPS URLs? Yes. The rel=canonical should point to the HTTPS version of the page. This helps Google index the secure URL and avoids duplicate protocol versions. ## Read next - [Canonical URL](https://porteur.ai/glossary/canonical-url): A canonical URL names the original version of a page. Use it to handle parameters and duplicates, avoid split signals and keep the right page indexed. - [Alternate page with proper canonical tag: what Search Console means](https://porteur.ai/guides/alternate-page-with-proper-canonical-tag): What this Search Console status means, when to ignore it, when it hides the wrong page, and the exact checks and fixes to set the right canonical. - [The Sitemaps report: what Success, Has errors and Couldn’t fetch mean](https://porteur.ai/guides/search-console-sitemaps-report): How to submit your sitemap URL, read Success, Has errors and Couldn’t fetch, and fix invalid XML, 404s, cross‑host URLs and missing child sitemaps. - [How to verify a site in Google Search Console, and which property to pick](https://porteur.ai/guides/how-to-verify-google-search-console): Pick Domain or URL-prefix, then verify in minutes with DNS, an HTML file or a meta tag. Avoid common pitfalls and know what to check first. - [301 redirect](https://porteur.ai/glossary/301-redirect): A 301 redirect is a permanent move. Use it to send users and bots to a new URL, keep signals, avoid chains, and choose 308 when methods must persist. - [Technical SEO checklist for a small site](https://porteur.ai/guides/technical-seo-checklist): Run these 20 technical SEO checks, in order. Each shows how to check it free and what fixed looks like for a site under 1,000 pages. Run your URL in Porteur’s free check to see if your pages redirect in one hop to HTTPS, your sitemap lists HTTPS URLs only, and mixed content is flagged. Free check: https://porteur.ai/