Does HTTPS affect SEO? Yes. Google confirmed HTTPS as a lightweight ranking signal back in 2014, and beyond that small signal it is now a practical requirement for trust, conversions, and clean referral data. Any modern site should be on HTTPS. This guide covers what Google has actually said, the bigger real world effects, how to migrate from HTTP to HTTPS without losing rankings, fixing mixed content, and the honest truth about certificate types.
What Google has said about HTTPS
Google’s position on HTTPS is clear but often overstated. In 2014, Google announced HTTPS as a ranking signal, encouraging site owners to switch to a secure connection. It was described from the start as a lightweight signal, meaning it gives a small ranking benefit rather than a decisive one.
Later clarifications kept it in perspective: HTTPS is a genuine but minor ranking factor, used partly as a tiebreaker between otherwise equal results. So the honest picture is that HTTPS helps a little directly, and you should not expect switching to HTTPS alone to transform your rankings. The far bigger reasons to use HTTPS are the real world effects around trust and user experience, which matter more than the small ranking signal itself.
The bigger real world effects
Beyond the ranking signal, HTTPS matters for several practical reasons that affect your traffic and conversions. Browsers now show a not secure warning on HTTP pages, especially where forms are involved, and that warning scares visitors away and hurts conversions, which indirectly harms your business far more than the small ranking factor.
There is also referral data loss: when traffic passes from an HTTPS site to an HTTP one, the referral information is often stripped, so you lose visibility into where visitors came from. Chrome and other browsers increasingly favor and expect HTTPS, and some modern features only work over a secure connection. Taken together, these effects mean HTTPS is really about trust, usability, and data, not just the ranking nudge, which is why every site should use it regardless of the SEO signal’s size.
Migrating from HTTP to HTTPS without losing rankings
Switching to HTTPS is safe if done carefully, but a botched migration can cause temporary ranking drops, so follow a checklist. Install a valid SSL certificate for your domain, then set up permanent 301 redirects from every HTTP URL to its HTTPS version, so link value and users move across cleanly.
Update your canonical tags to point to the HTTPS URLs, and add the HTTPS version as a new property in Google Search Console so you keep tracking it. Fix mixed content, covered below, and consider enabling HSTS to enforce HTTPS. The common mistakes are forgetting to redirect every URL, leaving canonicals or internal links pointing to HTTP, and not adding the new property in Search Console.
Handle each item, and your rankings transfer smoothly, with at most a brief settling period rather than a lasting drop. For the wider technical picture, keep your site fast too, as our guide to speeding up a WordPress website covers.
Mixed content: finding and fixing it
Mixed content is the issue that lingers after many migrations, so it deserves its own attention. It happens when a page loads over HTTPS but still pulls some resources, like images, scripts, or stylesheets, over insecure HTTP.
Browsers flag mixed content, which can break the secure padlock and even stop some resources from loading, undermining the whole point of the migration. To find it, use your browser’s developer console, which reports mixed content warnings, or a mixed content checker tool. To fix it, update those resource URLs to HTTPS, either manually, with a search and replace across your database, or with a plugin that rewrites insecure URLs. Clearing mixed content is what makes your HTTPS migration truly complete, since a page that is only partly secure still shows problems to users and browsers.
The four addresses, and the redirect chain nobody checks
Before the migration, your site answers on four addresses, not two. There is http and https, and each of those exists with and without www, which gives you http://example.com, http://www.example.com, https://example.com and https://www.example.com. Pick one as the real address, and the other three must each reach it in a single hop.
The word that matters there is single. The common outcome of a rushed migration is a chain: the http non www address redirects to the https non www address, which then redirects again to the https www address. Nothing is broken, every visitor arrives, and nothing obvious shows up in testing, which is exactly why it survives. But every hop is another request, and a redirect chain across a whole site is slower for users and wasteful of crawl budget on a large one.
Test it directly rather than in a browser, because the browser hides the intermediate steps and only shows you the final page. Request each of the four addresses and look at the sequence of responses. You want one 301 landing on the final URL, not two.
Check a deep URL as well as the homepage. Plenty of migrations redirect the homepage correctly and send every inner page to the homepage instead of to its own https equivalent, which quietly destroys the mapping for the entire site.
What the migration checklist usually leaves out
The standard checklist covers the certificate, the redirects, the canonicals and the Search Console property. Four more items decide whether the move is actually finished.
Your XML sitemap and robots.txt. The sitemap should list https URLs, and the sitemap reference inside robots.txt should be an https address too. A sitemap full of http URLs after the migration is you telling Google to go and crawl a set of pages that all now redirect, which is not fatal but is a poor first signal at exactly the moment you want a clean one.
hreflang, if you use it. hreflang annotations point at specific URLs, and they need to point at the https versions. If they still reference http, they no longer match the canonical URLs of the pages they describe, and Google will fall back to ignoring the pairing rather than following it.
Links hard coded inside your content. Internal links written into posts and pages, stored in the database, are the usual survivors. Redirects will carry them, but every one of those links is a chain for a user who clicks it. A search and replace across the database catches these, and it is the same operation that clears most mixed content, since both are http URLs sitting in your content.
Your most valuable inbound links. Redirects pass these across, so this is not urgent, but it is worth writing to the handful of sites sending you the most valuable links and asking them to update the URL. You want your strongest signals arriving directly rather than through a redirect, and this is a short list, not a project.
Certificates expire, and that is how HTTPS usually breaks your SEO
The migration is a one off risk. The certificate is a recurring one, and in practice an expired certificate does far more damage than a slightly imperfect migration ever did.
When a certificate lapses, browsers stop showing your site and show a full page warning instead. Not a padlock that looks wrong, a wall the visitor has to click through. Traffic goes to close to zero for as long as it lasts, and it usually lapses at a weekend, because nobody is watching.
This matters more each year because certificate lifetimes are shrinking. Let’s Encrypt certificates are valid for 90 days today, and the industry is stepping that down deliberately: the CA/Browser Forum has approved a schedule that caps certificate lifetimes at 47 days from 15 March 2029, with shorter caps phasing in before then. Let’s Encrypt is moving faster than the mandate requires, with a published path down to 45 days by February 2028.
The practical consequence is simple. Manual renewal is already a bad idea and is becoming unworkable, so your renewal has to be automated, and you should verify the automation has actually run rather than assuming it. Set an external monitor that checks your certificate’s expiry date and alerts you well before it lapses, because the one thing you cannot rely on is noticing yourself.
What to expect in the weeks after the switch
A correct migration is not invisible in your reporting, and knowing what normal looks like stops you from undoing good work in a panic.
Expect some movement. Google has to recrawl and reprocess every URL on the new protocol, and while that happens rankings can wobble in both directions. On a small site this settles quickly; on a large one it takes longer simply because there are more URLs to get through.
Expect your Search Console data to split. The http and https properties are separate, and the old one stops accumulating data while the new one starts from nothing. Nobody has lost any traffic at that moment, but the graph looks alarming if you were not expecting it. Keep both properties rather than deleting the old one, so you can still see the historical data.
The judgement call is when a wobble stops being a wobble. If a specific page has lost its ranking and stayed there, check that page individually: does its http address redirect to its own https address in one hop, does its canonical point at the https version, and is it in the new sitemap. A settling period affects the whole site loosely; a single page stuck at the bottom is a configuration error on that page.
Certificate types honestly
There is a lot of upselling around SSL certificates, so here is the honest truth for SEO. A free certificate, such as one from Let’s Encrypt, provides exactly the same encryption and the same secure padlock as a paid certificate, and Google treats them identically for ranking purposes.
For SEO, the certificate type makes no difference: a free certificate gives you the full HTTPS ranking signal and the secure connection, so paying more buys you nothing in terms of rankings. Paid certificates can offer things like extended validation branding, warranties, or support that matter to some large organizations, but none of that affects SEO. So for the vast majority of sites, a free, properly installed certificate is completely sufficient, and any claim that you need a paid certificate for better SEO is simply not true.
HTTPS and site performance
A common old worry was that HTTPS slows sites down, but the opposite is now generally true. Modern secure connections enable newer, faster protocols like HTTP2 and HTTP3, which many browsers and servers only use over HTTPS, so a secure site can actually load faster than an insecure one.
The small encryption overhead is negligible on modern hardware, and the performance gains from the newer protocols outweigh it. Since site speed and Core Web Vitals are themselves ranking and user experience factors, HTTPS indirectly supports performance rather than harming it. So you do not need to trade speed for security; a properly configured HTTPS site is both secure and, thanks to modern protocols, often quicker, which is one more reason the move to HTTPS is a clear win with no real downside.
Verdict
Yes, HTTPS affects SEO, but as a lightweight ranking signal rather than a major one. Its real importance is practical: it prevents the not secure browser warnings that scare off visitors, protects your referral data, and meets the trust expectations of modern browsers, all of which matter more than the small ranking nudge.
Every site should be on HTTPS. If you are migrating, follow the checklist of certificate, 301 redirects, canonicals, Search Console property, and mixed content fixes to transfer rankings smoothly. And do not pay extra for a certificate expecting SEO gains, since a free one gives you the same benefit. HTTPS is a baseline of a trustworthy, well built site.
Frequently asked questions
Is HTTPS a big ranking factor?
No, HTTPS is a lightweight ranking factor, not a big one. Google confirmed it as a small signal in 2014, often acting as a tiebreaker rather than a major boost. Switching to HTTPS alone will not transform your rankings. Its bigger value is practical, avoiding browser not secure warnings, protecting referral data, and meeting trust expectations, which affect your traffic and conversions more than the modest ranking signal itself.
Will switching to HTTPS drop my rankings temporarily?
A careful HTTPS migration usually causes at most a brief settling period rather than a lasting ranking drop. Problems only arise from mistakes like missing 301 redirects, canonicals still pointing to HTTP, or unaddressed mixed content. If you redirect every URL, update canonicals and internal links, add the HTTPS property in Search Console, and fix mixed content, your rankings transfer smoothly with little or no temporary loss.
Are free SSL certificates bad for SEO?
No, free SSL certificates are not bad for SEO. A free certificate, like one from Let’s Encrypt, provides the same encryption, the same secure padlock, and the same HTTPS ranking signal as a paid one, and Google treats them identically. Paying more does not improve your SEO. Free certificates are completely sufficient for the vast majority of sites, so any claim that you need a paid certificate for better rankings is false.
Why does my site still say not secure after installing SSL?
If your site still says not secure after installing SSL, the usual cause is mixed content, where the page loads over HTTPS but some resources like images or scripts still load over insecure HTTP. It can also be missing redirects that let HTTP versions load. Find mixed content with your browser’s developer console, update those resource URLs to HTTPS, and ensure all HTTP URLs redirect to HTTPS, which restores the secure padlock.
How long does an HTTPS migration take to settle?
Expect some ranking movement while Google recrawls and reprocesses every URL on the new protocol, settling quickly on a small site and taking longer on a large one simply because there are more URLs. A loose wobble across the site is normal. A single page that drops and stays down is not a settling effect, it is a configuration error on that page, so check its redirect, its canonical and its presence in the sitemap.
Why did my Search Console traffic drop to zero after moving to HTTPS?
It almost certainly did not. The http and https properties in Search Console are separate, so the old property stops collecting data at the switch and the new one starts from zero. No traffic has been lost, the reporting has simply moved. Keep the old property rather than deleting it so the historical data stays available.
How often do SSL certificates need renewing?
Let’s Encrypt certificates last 90 days today, and lifetimes are being shortened across the industry. The CA/Browser Forum has approved a cap of 47 days from 15 March 2029, and Let’s Encrypt has published its own path down to 45 days by February 2028. Renewal therefore has to be automated, and worth monitoring externally, because an expired certificate replaces your site with a full page browser warning and takes traffic close to zero until it is fixed.