Does HTTPS matter for SEO?

HTTPS, explained

HTTPS encrypts traffic between the browser and the server, so people on the same network can't read or alter it. In 2014 Google announced HTTPS as a ranking signal, describing it as very lightweight at the time and affecting fewer than 1% of global queries. Today it's part of Google's page experience guidance, and modern browsers flag plain HTTP pages as not secure, which hurts trust and signups far more than any ranking effect.

For a new site, HTTPS is a default rather than a project. Most hosts and CDNs issue free certificates automatically. The SEO work is in making HTTPS the only version: permanently redirect every http:// URL to its https:// equivalent in one hop, use https:// in canonicals, internal links, sitemaps, hreflang and structured data, and avoid loading any resources over HTTP, which causes mixed content warnings or blocked scripts.

Google's 2014 announcement also recommended not blocking HTTPS pages with robots.txt, allowing them to be indexed, and using HSTS. HSTS tells browsers to always use HTTPS for your domain, removing the insecure first request on later visits.

When moving an existing site from HTTP to HTTPS, treat it like a site migration: map URLs, use permanent redirects, update internal links and submit the new sitemap. A Domain property in Search Console covers both protocols, which makes the move easier to monitor.

Why it matters for founders

There's no reason for a startup site to be on HTTP in 2026. The work is making sure every variant redirects cleanly and nothing still loads over HTTP.

Example

Your site has a certificate, but http://example.com/blog still returns 200. You add a permanent redirect for all HTTP requests and switch two hardcoded http:// image URLs to https://.

Common mistakes

• Both HTTP and HTTPS versions returning 200.
• Canonicals or sitemaps still using http://.
• Hardcoded HTTP resources causing mixed content.
• Redirecting HTTP through several hops.