Is HTTPS a ranking factor?

Yes, though a lightweight one. Google confirmed it as a tiebreaker signal years ago. The bigger practical effect is trust and functionality: browsers flag HTTP pages as not secure, and several web features, including many analytics and payment integrations, require HTTPS to work at all.

What breaks when migrating to HTTPS?

Usually mixed content, where a secure page still calls images or scripts over HTTP, plus forgotten redirects from the HTTP versions and stale canonical or sitemap URLs. Update Search Console properties too, since HTTP and HTTPS are treated as separate sites.

Technical SEO

HTTPS

HTTPS is the secure version of HTTP, encrypting data between a browser and a server using an SSL/TLS certificate.

It protects any information passing through the page and has been a lightweight Google ranking signal since 2014. Browsers now flag plain HTTP pages as "Not Secure," which alone is reason enough to migrate. Every modern site should serve all pages over HTTPS.

Migrations go wrong in predictable places, so a short checklist covers most of the risk. Redirect every HTTP URL to its HTTPS equivalent one to one, never to the homepage. Update canonicals, hreflang, and sitemap entries, since these often keep the old protocol. Fix mixed content, which browsers block silently and which can break scripts including analytics. Add the HTTPS property in Search Console, because Google treats the two protocols as separate sites and historical data does not carry over. Finally, check that the certificate covers every subdomain the site actually serves.

Example

A form on an HTTP page sends everything readable in transit, and Chrome brands the page "Not Secure" next to the address. After migrating, the browser warning disappears and the padlock returns. The overlooked step in one real migration: the sitemap still listed http:// URLs for months, so crawlers kept requesting redirects instead of final pages.

Frequently asked questions

Is HTTPS a ranking factor?: Yes, though a lightweight one. Google confirmed it as a tiebreaker signal years ago. The bigger practical effect is trust and functionality: browsers flag HTTP pages as not secure, and several web features, including many analytics and payment integrations, require HTTPS to work at all.
What breaks when migrating to HTTPS?: Usually mixed content, where a secure page still calls images or scripts over HTTP, plus forgotten redirects from the HTTP versions and stale canonical or sitemap URLs. Update Search Console properties too, since HTTP and HTTPS are treated as separate sites.

Related terms

Core Web Vitals Page Speed Status Code

Working on HTTPS? See how our SEO audit can help.

Explore SEO audit

Back to glossary