What HTTPS is
HTTPS is HTTP with encryption. With plain HTTP, everything between a visitor and your site — pages read, forms submitted, passwords typed — travels as readable text that any network in between can inspect or alter. HTTPS encrypts that connection, verified by a certificate, shown to the visitor as the padlock in the address bar.
What it does for SEO
Google announced in 2014 that HTTPS is a ranking signal — deliberately a lightweight one, described at the time as affecting fewer than 1% of queries. It still stands as one of the few ranking factors Google has ever confirmed by name.
The indirect effects are larger than the signal itself:
- Browsers punish HTTP. Chrome marks plain-HTTP pages "Not secure" and interrupts form submissions with warnings. Visitors bounce before your content gets a chance.
- Referral data survives. Traffic from HTTPS sites to HTTP sites drops its referrer, polluting your analytics with "direct" visits.
- Modern web features require it. HTTP/2, service workers, geolocation and most powerful browser APIs are HTTPS-only.
Certificates have been free (Let's Encrypt) since 2016, and most hosts provision them automatically — which is why an HTTP page in 2026 reads as neglect, to browsers and visitors alike.
Mixed content — secure page, insecure pieces
A page served over HTTPS must load its resources — images, scripts, stylesheets — over HTTPS too. An insecure resource on a secure page is mixed content: browsers block insecure scripts outright and quietly upgrade or flag insecure images. The result ranges from a broken padlock to a page whose functionality silently fails.
Mixed content usually traces back to hard-coded http:// URLs in templates or old post bodies.
The fix is mechanical: reference resources by https:// (or protocol-relative paths), and set
your CMS's base URL to the https address.
Doing the migration right
Moving a site to HTTPS is a site move: 301-redirect every HTTP URL to its exact HTTPS twin, update internal links and the sitemap to the final addresses, and keep the certificate renewing automatically. Done that way, rankings carry over; the common failures are redirect chains and forgotten subdomains, not the protocol change itself.