Why this signal matters for Google
HTTPS is what stops someone from reading what your visitor sends you. A person fills out a law firm's contact form on coffee shop wifi. They type their name, their phone number and three lines about their divorce. Over HTTP, that message travels in plain text: someone well placed on the same network can read it. Over HTTPS, it is encrypted between their browser and your server. To turn it on you need an SSL certificate: a small file installed on your server that proves the site really belongs to your domain name. (The technical name is TLS, but everyone still says SSL.) Without it, the browser prints "Not secure" next to your address, and your privacy policy promises a protection the site does not deliver. It is getting stricter, too: in October 2025, Google announced that Chrome will turn on its "Always Use Secure Connections" setting by default, which shows a warning before opening a site over HTTP.
On the Google side, do not expect a miracle. HTTPS has been a ranking signal since 2014, but a lightweight one. In its official 2014 announcement, Google described a signal affecting fewer than 1% of queries. So an HTTP to HTTPS migration will not lift your rankings. The risk runs the other way: not having it makes you stand out, for the wrong reason. The people Google pays to review its results notice as well. Their handbook, the Quality Rater Guidelines (QRG), never uses the word HTTPS. But section 3.4 puts Trust at the center of E-E-A-T and states that online stores need secure online payment systems. Section 2.5.3 sends raters looking for your contact options, forms included. And section 4.5.5 covers the moment a browser shows a certificate warning: a rater who is hesitant to continue can release the task. Your page never gets read.
Having an SSL certificate does not mean the whole site runs on HTTPS. This is where most sites lose points. According to the HTTP Archive Web Almanac 2024, 95.6% of mobile home pages are served over HTTPS, yet only 30% of mobile responses carry the HSTS header, the setting that tells browsers to always use the secure version. The certificate has become ordinary. Finishing the job has not. Three failures keep coming back. An image or script still called over http: that is "mixed content," and the browser blocks it or flags the page. An expired certificate: visitors hit a full-page warning before they ever see your site. An old http address that still answers without redirecting: now you have two copies of the same site. When I audit a law firm's website, the certificate is almost always there. What I find instead are old internal links in http and images called over http in posts nobody has reopened in years. These failures cost more on YMYL pages, the ones where a reader's health, money or safety is at stake: a person booking a clinic appointment is handing you their name and their reason for the visit.
AI assistants hit the same wall your visitors do. To cite your page, a tool like ChatGPT, Claude or Perplexity sends a crawler to fetch it. That crawler behaves like a browser: if the certificate is expired or does not match the domain, the connection usually fails and the page is not read. No read, no citation. Even when everything works, the assistant shows a link to your site. The person who clicks should land straight on the right https address, not on a warning or a chain of three redirects. Think one step further: they will look for your contact page, and that is where they will type their details. Clean HTTPS from end to end does not get you cited. It only keeps you from being dropped for a silly reason.
The NeuroEEAT scoring grid (0-10)
Place your site on the scale, from a plain http address to HTTPS that is locked down and monitored.
| Score | Description | Concrete indicators |
|---|---|---|
| 0-2 | No HTTPS | The site answers over http and the browser shows "Not secure." Or the SSL certificate has expired and visitors hit a warning page before they reach you. |
| 3-4 | Certificate installed, nothing else | The site opens over https, but the http address still answers without redirecting. Some pages load images or scripts over http (mixed content). |
| 5-6 | Switch done | Every http address sends visitors to its https twin through a 301 redirect (a permanent redirect). No mixed content left on the main pages. The certificate renews on its own. |
| 7-8 | Clean everywhere | Internal links, canonical tags (the official address each page declares), the sitemap (the list of pages you give Google) and Search Console all point to https. Subdomains are covered: blog, store, client portal. One redirect is enough, never a chain. |
| 9-10 | Locked down and monitored | The HSTS header is on. An alert warns you before the certificate expires. An outside test such as SSL Labs returns a good grade, and you rerun the check after every redesign or change of host. |
How to audit it on your site
Fifteen minutes, a browser and your site address: no paid tool needed.
- 01
Type your address with http
In the address bar, type http:// followed by your domain name, with and without www. Every variant should take you to the same https address, in a single hop. Repeat the test with a deep page, such as a blog post: a redirect that dumps everything on the home page is a failed migration.
- 02
Open the SSL certificate details
Click the icon to the left of the address, then the connection details. Note three things: the expiry date, the domain name covered, and who issued the certificate. If expiry is close and nobody knows whether renewal is automatic, that is your first emergency.
- 03
Hunt for mixed content
Open five different kinds of pages: home, service, article, contact, checkout or booking. On each one, open the browser console (F12 key, Console tab) and look for lines that say "Mixed Content." Each line names a file still called over http: an image, a font, a script, an embedded video.
- 04
Check what you declare to Google
View the source of a page and search for the word canonical: the address shown should start with https. Then open your sitemap: no http address should be left in it. In Search Console, Google's free tool for site owners, confirm that the https version is the one being tracked.
- 05
Walk through subdomains and forms
List everything that lives next to the main site: blog, store, client portal, an old campaign site. Each needs a valid certificate. Finally, test every form: the page that receives the data has to be on https as well, or the browser warns the visitor at the moment they hit send.
How to activate or improve it
From a plain http address to a locked-down site, in the order the steps actually happen.
Get the certificate and switch
- Make a full backup of the site before you touch anything.
- Turn on the free SSL certificate in your hosting control panel: most hosts offer Let's Encrypt in one click.
- Confirm that automatic renewal is on, then put the expiry date in your calendar.
- In your site platform's settings (WordPress, Shopify or other), replace the site address with its https version.
- Turn on the redirect from all http to https, then test three addresses at random.
Clean up what is still on http
- Replace internal links, images and scripts written with http, in your pages and in the database.
- Fix every "Mixed Content" line found in the audit, starting with pages that have a form.
- Update canonical tags, the sitemap and hreflang tags (the links between language versions) so they point to https.
- Add the https version in Search Console, or create a Domain property, which covers every version.
- Change the site address everywhere you control it: Google Business Profile, social profiles, email signature, directories.
Lock down and monitor
- Turn on the HSTS header with a short duration at first, then lengthen it once everything has worked for a few weeks.
- Remove redirect chains: the http address with www should reach the final https address in a single hop.
- Cover every subdomain with its own certificate, or with a wildcard certificate that covers them all.
- Set up an alert that emails you a few weeks before each certificate expires.
- Run the site through an outside test such as SSL Labs after every change of host, and fix the outdated protocols it flags.
5 common mistakes to avoid
Sector specifics
Clinic or practitioner
The booking form carries a name, a phone number and often a reason for the visit. On a health topic, visitors forgive less. Also check the outside booking tool embedded in your page: if it opens on another domain name, that domain's certificate is the one the patient sees.
Online store or broker
QRG section 3.4 says it in so many words: online stores need secure online payment systems. The whole path has to stay on https, from cart to confirmation, including the page hosted by your payment provider. A single screen flagged "Not secure" at the moment the card comes out can be enough to lose the sale.
Contractor or neighborhood shop
The site was often built years ago and nobody touches it anymore. That is the textbook case of a certificate that expired without anyone noticing. Ask your host whether renewal is automatic, and check that the website link on your Google Business Profile starts with https.
SaaS, agency or consultant
The risk sits in the side properties: documentation, status page, client portal, campaign pages on a subdomain. A buyer who hits a certificate warning in your demo environment doubts the whole product. Keep a list of your subdomains and monitor every certificate.
Signals to activate in parallel
HTTPS protects data in transit. These signals show what you do with it and who you are:
FAQ
Can you redirect HTTP to HTTPS?
Yes, and you should, for every URL. A 301 redirect sends each http address to its https twin, so old links and bookmarks keep working. Most hosts and CDNs such as Cloudflare offer it as a single switch; on your own server it is a short rule in the Apache or Nginx configuration. Test a deep page afterward, not just the home page: a redirect that sends everything to the home page is a failed migration.
Which is safer, HTTP or HTTPS?
HTTPS, no contest. Over HTTP, everything between the visitor and the site travels in plain text: passwords, form entries, pages viewed. HTTPS encrypts that traffic, and the SSL certificate confirms the visitor is talking to your domain and not an impostor. Safer does not mean trustworthy, though: a scam site can get a valid certificate too, which is why Chrome removed the padlock icon from its address bar in 2023.
How do you convert HTTP to HTTPS for free?
Through your host, in most cases. Most hosting companies include Let's Encrypt, a free certificate authority, and turning it on takes one click in the control panel. According to the HTTP Archive Web Almanac 2024, Let's Encrypt issues more than 56% of the certificates in use on the web. A free SSL certificate encrypts exactly as well as a paid one; what you pay for is company validation and a warranty, not stronger protection.
Does anyone use HTTP anymore?
Very few sites. According to the HTTP Archive Web Almanac 2024, 98% of mobile web requests are served over HTTPS, and 95.6% of mobile home pages use it. A site still on HTTP is now the exception, and browsers label it "Not secure." The sites left behind are mostly old ones nobody maintains, and that is exactly what a visitor will assume about yours.
Does an HTTP to HTTPS migration hurt SEO?
Not when it is done properly. Google treats it as a site move with URL changes: expect some fluctuation while it recrawls your pages, then a return to normal. The drops people report come from mistakes, not from HTTPS itself: missing 301 redirects, canonical tags still pointing to http, an outdated sitemap, blocked resources. Redirect every URL one to one, update what you declare to Google, and watch Search Console for the following month.
Case study
Before · carts that were filled
After · the reason given at the payment step
Source: Baymard Institute, 2025, https://baymard.com/lists/cart-abandonment-rate · The survey measures distrust at the moment of entering a card, not the effect of an SSL certificate: HTTPS is only one part of that trust. What the case shows is what a doubt costs at the payment step.