SEO100
SEO method 19 of 100

HTTPS for SEO: Get a Free Certificate and Fix Mixed Content

Beginner Medium impact Under an hour Technical SEO

Updated · First published

Short answerHTTPS encrypts the connection between visitor and site. Google announced it as a very lightweight ranking signal in 2014, and browsers warn visitors on plain HTTP. Get a free certificate (Let's Encrypt), 301-redirect every HTTP URL to its HTTPS twin, fix mixed content and only then add HSTS.

HTTPS is the secure version of the web’s HTTP protocol: a TLS certificate encrypts everything between the visitor’s browser and your server, and proves the visitor reached the real site. Google announced in August 2014 that it uses HTTPS as a ranking signal, and called it very lightweight, affecting fewer than 1% of global queries and carrying less weight than signals such as high-quality content.

Does HTTPS help Google rankings?

A little. The signal is small. The stronger reasons to switch sit elsewhere:

  • Trust: Browsers mark plain HTTP pages as not secure, and visitors leave before they fill in a form.
  • Data safety: Logins, checkout and contact forms send data you must protect.
  • Features: Browsers support HTTP/2, which loads many files in parallel, only over HTTPS. That also helps page speed.

Fixing it costs nothing.

How do you move a site to HTTPS, step by step?

  1. Get a certificate. Let’s Encrypt is a nonprofit authority that issues certificates for free. Most hosts and CDNs (Cloudflare, Netlify, Vercel, cPanel hosts) switch it on with one click or automatically. On your own server, use an ACME client such as Certbot. Wildcard certificates need the DNS-01 challenge.
  2. Automate renewal. Let’s Encrypt certificates last 90 days, and the FAQ says to renew about every 60 days. The authority has announced shorter lifetimes: from 10 February 2027 the default profile moves to 64 days, and from 16 February 2028 to 45 days, so use a client that renews on its own. A forgotten certificate shows visitors a full-page browser error.
  3. Turn on HTTPS and test it before redirecting. web.dev advises turning on HTTPS first, without the redirect, then testing. Run the Qualys SSL Server Test and aim for an A grade.
  4. Update internal URLs. Change links, image sources, scripts, stylesheets, <link> tags and canonical tags to HTTPS. Use relative URLs where you can.
  5. 301-redirect HTTP to HTTPS. Send every HTTP URL to its exact HTTPS equivalent, not to the homepage, with a 301 (permanent) redirect. Avoid chains: http://www should reach https:// in one hop (see redirects).
  6. Fix mixed content. Open your main pages in Chrome DevTools and check the Issues tab. It lists each resource that loads over HTTP (see the next section).
  7. Update your sitemap, canonicals and hreflang. All must use the HTTPS URLs, or Google gets conflicting signals (see XML sitemaps and canonical tags).
  8. Add the HTTPS property in Search Console. Google treats HTTP and HTTPS as separate properties. A Domain property covers both and every subdomain, and saves you doing this again. Submit your sitemap and watch the report (see Google Search Console).
  9. Add HSTS last. The Strict-Transport-Security header tells browsers to use HTTPS directly, which skips the redirect and blocks downgrade attacks. web.dev warns to turn it on only when your TLS setup is reliable and to start with a low max-age, because clients can hard-fail on a later certificate error.

What is mixed content and how do you fix it?

Mixed content means an HTTPS page loads some files over HTTP. web.dev splits it into two kinds:

Type Examples Risk
Passive Images, video, audio An attacker can swap the media and track users
Active Scripts, stylesheets, iframes An attacker can take over the whole page

Most browsers block mixed content by default and treat active content most strictly. Chrome can upgrade passive content to HTTPS when a secure copy exists, and the file does not load when it does not. A blocked script or stylesheet breaks your layout or features for visitors.

Fix it by changing each http:// reference to https://. Search your theme files, database (WordPress Better Search Replace handles this), CSS and third-party embeds. If a third party offers no HTTPS version, drop it.

How do you measure the result?

  • Browser padlock on every template: homepage, article, product, checkout.
  • Chrome DevTools Issues tab: zero mixed-content entries.
  • Search Console Page indexing report: HTTPS URLs indexed, and the old HTTP URLs show as “Page with redirect”, which needs no action.
  • Crawl the site with Screaming Frog and filter for any http:// internal links, canonical tags or sitemap entries.
  • SSL Server Test: grade A or better, and a calendar alert 14 days before certificate expiry as a backstop.

What mistakes should you avoid?

  • Redirecting all HTTP URLs to the homepage. Each page needs its own one-to-one 301.
  • Leaving http:// in canonicals, sitemaps or hreflang. They contradict your redirects.
  • Turning on HSTS with a strong max-age before the setup is tested. A bad certificate then locks visitors out.
  • Letting the certificate expire. Automate renewal and monitor it.
  • Forgetting subdomains and the www variant. Each hostname needs certificate coverage.
  • Buying an expensive certificate for SEO. A free Let’s Encrypt certificate gives the same encryption.

Where can you learn more?

The free digital marketing module of the Fe/male Switch startup school shows founders how to check the technical set-up of a new site. Next steps on SEO100: confirm your redirects are single hops, then run the crawl for broken links that the move may have created.

Earlier versions of this directory listed this as: SSL certificates, HTTPS Implementation.

Learn SEO as part of building a startup

Fe/male Switch is a startup school and game where you build a real company step by step. Its free digital marketing module covers SEO, and the free startup tools help with the rest.