Does SSL Affect SEO? HTTPS, Rankings and a Safe Migration

Q: Will switching to HTTPS make my traffic drop?

A short wobble is possible while Google recrawls. With clean 301 redirects and updated canonicals, the HTTPS pages normally take the place of the old ones.

Q: Do I need a new Search Console property?

Not if you use a Domain property, which covers http and https. With URL-prefix properties, add and verify the https version.

Q: Does a paid certificate rank better than a free one?

Google's guidance only asks whether pages are served securely. Nothing in it gives paid certificates extra weight.

Q: Is HTTPS needed if I do not sell online?

Yes. Contact forms, logins and trust all benefit, and browsers warn on any HTTP page.

Q: What happens if my certificate expires?

Visitors see a full-page security warning. Use automatic renewal, which free certificates usually include.

Key takeaways

Google confirmed HTTPS as a ranking signal in 2014, and described it as very lightweight.
The bigger effect is on people: Chrome marks every HTTP page as Not secure.
Certificates can be free, for example from Let's Encrypt, and many hosts install them for you.
To move: certificate, 301 redirects, canonicals and sitemaps on HTTPS, fix mixed content, check Search Console.

<1%of global queries affected when Google announced HTTPS as a signal (2014)

Chrome 68the version that began marking all HTTP sites Not secure (July 2018)

Freecertificates from Let's Encrypt, a nonprofit certificate authority

What is SSL, and what is HTTPS?

SSL, now technically called TLS, is the technology that encrypts the connection between a browser and your server. HTTPS is simply HTTP running over that encrypted connection. When a site has a valid certificate, the address starts with https:// and data like form submissions cannot be read or changed by others on the network.

People still say "SSL certificate" out of habit; your host may call it SSL or TLS. For SEO purposes they are the same thing.

Is HTTPS a Google ranking factor?

Yes, a small one. In August 2014 Google announced it would use HTTPS as a ranking signal and described it as very lightweight, affecting fewer than 1% of global queries at the time. Today Google's page experience documentation asks whether pages are served securely, and still says the most relevant content wins even when page experience is weak.

The same 2014 announcement gave practical tips that still hold: decide which certificate type you need (single, multi-domain or wildcard), use 2048-bit key certificates, use relative URLs for resources on the same secure domain, do not block the HTTPS site in robots.txt, and let search engines index your pages, avoiding noindex. See the original HTTPS as a ranking signal post and Google's page experience guide, which includes the question "Are your pages served in a secure fashion?" and notes that good page experience does not guarantee top rankings. In short: HTTPS will not lift a weak page, but a site without it starts at a disadvantage with visitors.

Why does my site say Not secure?

Because it loads over HTTP, or because a secure page loads some files over HTTP. Since Chrome 68 in July 2018, Chrome marks all HTTP sites as not secure. That label appears right next to your address and can make a visitor leave before filling a form or paying, which costs more than any ranking effect.

Google announced the change in A secure web is here to stay. If you already have a certificate and still see a warning, the usual cause is mixed content, covered below.

Do I need to pay for an SSL certificate?

Usually not. Let's Encrypt is a free, automated and open certificate authority run by a nonprofit, and many hosting companies and website builders install a free certificate for you. Paid certificates exist for specific needs, such as extra company validation or special support, but they do not give any extra SEO benefit.

Details on Let's Encrypt. If your host charges for a basic certificate, ask whether a free one is available; most offer it in the control panel.

How do I move from HTTP to HTTPS without losing SEO?

Treat it as a site move with a simple map: every HTTP URL redirects with a 301 to the same HTTPS URL. Install the certificate, set the redirects on the server, update canonical tags, internal links and sitemaps to HTTPS, fix mixed content, and confirm in Search Console that Google is indexing the HTTPS pages.

Install and test the certificate on every version of the domain you use (with and without www).
Redirect each HTTP URL to its HTTPS twin with a server-side 301, one hop, no chains.
Update canonical tags so each HTTPS page points to itself.
Change internal links, images and scripts to HTTPS (or relative URLs).
Regenerate the XML sitemap with HTTPS URLs and submit it.
Do not block the HTTPS site in robots.txt and do not add noindex.
Check Search Console: a Domain property covers both http and https; with URL-prefix properties, add the https one.
Watch the Page indexing and Performance reports for a few weeks.

Google's site move guide lists HTTP to HTTPS as a URL change, asks for self-referencing canonicals and updated sitemaps, and says you do not need the Change of Address tool for this move. Search Console's property help explains that a Domain property includes both protocols. The mechanics of 301s are in my guide to redirects and 404 errors, and the sitemap step in what is an XML sitemap. If the switch comes with a new design or new URLs, follow the full plan in website redesign without losing SEO.

What is mixed content and how do I fix it?

Mixed content is when a page loads over HTTPS but some of its images, scripts or styles still load over HTTP. Browsers try to upgrade simple files like images and block riskier ones like scripts, often with a warning. The fix is to change those file addresses to HTTPS, in the theme, the database and any plugin settings.

web.dev explains the browser behavior in fixing mixed content. On WordPress, old image addresses in posts are the usual culprit; a careful search and replace in the database, done with a backup, solves most cases.

Symptom	Likely cause	Fix
Not secure on every page	No certificate or no redirect	Install certificate, add 301 to HTTPS
Warning only on some pages	Mixed content	Change HTTP file links to HTTPS
Both versions in Google	Missing redirects or canonicals	301 every HTTP URL, self canonical on HTTPS
Redirect loop	Two rules fighting (host and plugin)	Keep one redirect rule

Checking HTTPS, redirects and indexing is part of every technical SEO review I do, and new sites I build under web design and development launch on HTTPS from day one. As an SEO consultant, I can check your setup in a free diagnosis: book it here.

Frequently asked questions

Will switching to HTTPS make my traffic drop?

A short wobble is possible while Google recrawls. With clean 301 redirects and updated canonicals, the HTTPS pages normally take the place of the old ones.

Do I need a new Search Console property?

Not if you use a Domain property, which covers http and https. With URL-prefix properties, add and verify the https version.

Does a paid certificate rank better than a free one?

Google's guidance only asks whether pages are served securely. Nothing in it gives paid certificates extra weight.

Is HTTPS needed if I do not sell online?

Yes. Contact forms, logins and trust all benefit, and browsers warn on any HTTP page.

What happens if my certificate expires?

Visitors see a full-page security warning. Use automatic renewal, which free certificates usually include.

About the author

Juan José Giraldo is an SEO consultant in Medellín, Colombia, with 5+ years of experience. He works on technical and local SEO for 600+ US car dealerships at Reunion Marketing, an Inc. 5000 agency, and supervises the SEO of 18 US online stores with more than 3 million products at Prontomowers. Read more · LinkedIn.

Want to see these guides first? Choose JJ SEO Colombia as a preferred source on Google, and my articles are more likely to show up for you in Top Stories.

Follow on GoogleAdd as a preferred source

Does SSL affect SEO? What HTTPS changes, and how to switch without losing traffic.