Is HTTPS a Ranking Factor?

Yes — Google confirmed HTTPS as a ranking signal in August 2014, and it has never been removed. But Google described it as a lightweight signal affecting fewer than 1% of queries, and that hasn't changed. Adding a certificate won't lift your rankings. Not having one costs you browser trust, referrer data and, increasingly, indexing.

What Google actually announced

The original announcement on Google's Search Central blog is unusually specific for a ranking-factor confirmation. Google said HTTPS was being used as a signal, that it was "very lightweight," that it affected fewer than 1% of global queries, and that it carried less weight than signals like high-quality content — while explicitly leaving room to strengthen it later.

Google's team later characterised it as functioning like a tiebreaker: where two results are otherwise equivalent, the secure one wins. That framing is still the most useful way to think about it.

So the direct ranking effect is real and small. The reason HTTPS matters far more than "fewer than 1% of queries" suggests is everything attached to it.

Why HTTPS matters more than its ranking weight

Browsers mark HTTP as unsafe. Chrome has flagged plain HTTP pages as "Not secure" in the address bar since Chrome 68 in July 2018, and browsers have grown more aggressive since. Any page with a form on it gets an interstitial warning. Your conversion rate takes the hit long before your rankings do.

You lose referrer data. When a visitor moves from an HTTPS page to an HTTP one, browsers strip the referrer header. That traffic lands in your analytics as "direct" — so an HTTP site systematically under-reports where its visitors came from, and you end up optimising blind.

Modern protocols require it. HTTP/2 and HTTP/3 are, in every major browser, only implemented over TLS. Staying on HTTP means staying on HTTP/1.1, which means slower page loads and worse Core Web Vitals — a small ranking input in its own right, plus a real user-experience cost.

Some features simply don't run. Service workers, geolocation, camera and microphone access and several other browser APIs are gated behind a secure context.

Certificates are free. Let's Encrypt has issued free, automatically renewing certificates since 2016, and most hosts now provision one with a single click. There is no remaining cost argument for staying on HTTP.

The migration is where rankings get lost

Almost every "we moved to HTTPS and our traffic dropped" story is a botched migration, not a problem with HTTPS. The protocol change itself is a URL change across your entire site, and it needs the same care as a domain move.

Redirect every HTTP URL to its exact HTTPS equivalent with a 301. One hop, page to matching page. Redirecting the whole site to the HTTPS homepage is the classic destructive shortcut — it throws away every page's earned relevance and every link pointing at a deep page.

Avoid redirect chains. http://example.com → https://example.com → https://www.example.com is three requests and a diluted signal. Configure the server so any variant lands on the final URL in one hop. If you're not sure what you have, check for redirect chains with a crawler before and after.

Fix mixed content. If an HTTPS page loads an image, script or stylesheet over HTTP, browsers block or warn on it and the padlock disappears. Search your templates and database for hard-coded http:// asset URLs — this is the single most common leftover.

Update internal links, canonicals and hreflang to HTTPS. Relying on redirects for your own internal links works, but it's sloppy and slow. Your canonical tags in particular must point at the HTTPS version, or you're telling Google the HTTP URL is the real one.

Regenerate and resubmit your sitemap with HTTPS URLs.

Add the HTTPS property in Search Console. Google treats http:// and https:// as separate properties. If you only have the HTTP one verified, your data goes quiet after the move and it looks like a collapse. A domain property covers both.

Update your robots.txt — it's served per protocol, so make sure the HTTPS version is the one you intend and doesn't block anything. See what a robots.txt file does if yours hasn't been reviewed in a while.

What happens to your backlinks

Every existing backlink still points at an http:// URL. Those links keep working and their value passes through the 301 redirect — Google has been clear that 301s pass ranking signals, and modern guidance is that essentially no value is lost.

Two caveats worth acting on:

Don't break the redirects later. Years after a migration, someone tidies up "old" redirect rules and every legacy backlink starts landing on a 404. If that's already happened, recovering lost backlinks starts with restoring those redirects.
Ask for updates on your highest-value links only. It's not worth an outreach campaign for a marginal gain, but if a handful of strong sites link to you, a one-line email asking them to update the URL is cheap.

Any new links you earn should of course point at HTTPS from the start. If you're actively building them — through Backlinkster or otherwise — check that the URL you hand your partners is the canonical HTTPS version, not an HTTP one that redirects.

Should you add HSTS?

HSTS (HTTP Strict Transport Security) is a response header telling browsers to only ever connect to your domain over HTTPS, which removes the initial insecure request entirely. It's a genuine security improvement and mildly faster.

It is also hard to reverse: browsers cache the policy for the max-age you set, and submitting to the browser preload list is close to permanent. Deploy it with a short max-age first, confirm nothing on any subdomain breaks, then raise it. Don't preload until you're certain.

Frequently asked questions

Will switching to HTTPS improve my rankings? Almost never on its own. The signal is lightweight and most competitive results are already secure, so it functions as a baseline rather than an advantage. Expect the benefit in trust, analytics accuracy and page speed rather than in position changes.

Does HTTPS hurt rankings during a migration? Temporary fluctuation for a few weeks is normal while Google recrawls and reindexes the new URLs. Lasting losses point to a migration error — usually redirect chains, redirects to the homepage, or canonicals still pointing at HTTP.

Do I need an expensive SSL certificate for SEO? No. Google doesn't distinguish between certificate types for ranking purposes. A free Let's Encrypt certificate and a paid EV certificate produce the same SEO outcome; paid certificates buy warranties and support, not rankings.

Do backlinks to my HTTP URLs still count after moving to HTTPS? Yes, provided the 301 redirects stay in place and point each old URL to its exact new equivalent. Break the redirects and those links land on errors, which is when the value genuinely disappears.

What is mixed content and why does it matter? Mixed content is an HTTPS page loading resources over HTTP. Browsers block or warn on it, the padlock is withheld, and users see a security warning. It's a rendering and trust problem more than a ranking one, but it undermines the entire point of migrating.

Is HTTP still indexed by Google? HTTP pages can still be indexed, but Google prefers the HTTPS version when both exist and will canonicalise to it. Combined with browser warnings, staying on HTTP in 2026 has no upside.

The bottom line

HTTPS is a confirmed ranking signal that is genuinely small, and a baseline requirement that is genuinely large. Nobody wins a competitive query because of their certificate. Plenty of sites have lost traffic because they migrated carelessly — homepage redirects, redirect chains, canonicals left pointing at HTTP.

Get the certificate, do the migration properly, verify both Search Console properties, then go back to the work that actually moves rankings: content people want and links pointing at it.