How the HTTPS update works
In August 2014 Google announced that it would use HTTPS as a ranking signal. It described the signal as lightweight — weaker than content quality, and affecting only a small share of searches — and said it might strengthen over time so that site owners had a reason to move early. That is the whole of the ranking story: a small nudge, applied per URL, in favour of encrypted pages.
What HTTPS itself does is more interesting than the nudge. It encrypts the connection between a visitor’s browser and your server, so whatever passes between them — a password, a phone number typed into an enquiry form, the page being read — cannot be read or altered by anything sitting in between, including the network the visitor happens to be using.
Why the HTTPS update matters
Less than the browsers did. Google’s signal was small. Chrome marking every unencrypted page “Not secure” in the address bar, which it began doing for all HTTP pages in 2018, was not. A warning beside your domain costs enquiries in a way that a ranking adjustment never did, and nothing written on the page can undo it.
There are two quieter consequences worth knowing. HTTPS is one of the things grouped under page experience, so it now sits alongside speed and mobile usability as a baseline expectation. And when someone moves from a secure site to an unencrypted one, the browser withholds the referring address, so the visit lands in analytics as direct traffic and a genuine referral disappears from your reporting.
Common mistakes with HTTPS
The commonest is a half-finished migration. The certificate is installed, the home page loads securely, and images, scripts or old internal links still point at the HTTP version, so browsers report mixed content and the padlock never appears. The second is leaving both versions reachable, which gives every page a duplicate and splits the signals between them.
The third is treating the certificate as a one-off purchase. Certificates expire, and an expired one produces a full-page browser warning that stops visitors entering the site at all — worse than never having had one. Automatic renewal is not optional.
How to act on it
If any part of the site still runs on HTTP, move it, and treat the move as a migration rather than a switch. Send every HTTP URL to its HTTPS equivalent with a one-to-one permanent redirect, update internal links and canonical tags to the secure version instead of relying on the redirect, clear any mixed content, and add the HTTPS property in Search Console so you keep seeing your own data.
Then make sure it stays fixed: renewal automated, an expiry date in the calendar, and an occasional look at the browser’s own security view. Certificates are available at no cost from Let’s Encrypt and most hosts install them for you, so price is no longer a reason to wait. Where a migration is involved, it belongs with the rest of your technical SEO work.