HTTPS as a Ranking Signal — and a Trust One

Every so often someone asks me if switching to HTTPS will improve their rankings, and I have to give the deflating answer: barely. Google announced HTTPS as a ranking signal back in 2014 and described it, in its own words, as lightweight. A tiebreaker among the tiebreakers. If you’re hoping encryption will lift you past a competitor with better content, it won’t. And yet I’d put HTTPS near the top of the list of things a site must get right, because the ranking signal is the least interesting thing about it. The interesting thing is what browsers do to you when you don’t have it.

Open a plain HTTP page in any modern browser and look at the address bar. It says “Not secure,” right there, next to your name. This is remarkable if you think about it. The most trusted piece of software on a person’s computer, the browser itself, is affixing a warning label to your business. Fill in a form on that page and the warning gets more insistent. No search-ranking penalty could compete with this, because it doesn’t operate on your position in a list. It operates on the visitor who already chose you, at the exact moment they’re deciding whether to trust you with an email address or a credit card. A ranking factor costs you strangers. A trust warning costs you converts.

It helps to know what HTTPS actually does, because the name “secure” oversells and undersells at once. HTTPS means the connection between the visitor’s browser and your server is encrypted and authenticated. Encrypted: nobody sitting between them, on the coffee shop Wi-Fi or at the ISP, can read or modify what passes. Authenticated: the browser has cryptographic proof it’s talking to the domain in the address bar, not an impostor. That’s all. It says nothing about whether your site is honest, well-built, or safe to buy from. A phishing site can have a perfectly valid certificate, and many do. HTTPS is not a virtue. It’s table stakes, which is precisely why lacking it is so damning. It’s like a restaurant without hand soap in the bathroom. Having soap wins no stars. Not having it tells you everything.

The excuses for staying on HTTP evaporated years ago. Certificates used to cost real money and require annual ritual sacrifice to renew. Now Let’s Encrypt issues them free, and most hosting platforms and modern web servers renew them automatically. If your site is still plain HTTP in 2026, the reason is almost never cost. It’s that nobody is looking after the site, which is, again, exactly the inference visitors draw.

Where sites actually get hurt nowadays is not in lacking HTTPS but in migrating to it sloppily, and this is where the SEO stakes become real. To a search engine, the HTTP and HTTPS versions of a URL are different URLs. If both respond with the same page and nothing declares which is canonical, you’ve split one page’s identity in two. The clean migration is mechanical: every HTTP URL should answer with a permanent redirect, a 301, to its HTTPS twin, and your canonical tags, your sitemap, and your internal links should all point at the HTTPS versions, so every signal agrees about which address is the real one. Sites that redirect but leave canonicals or sitemaps pointing at the old scheme send mixed messages, and mixed messages are the one thing you never want to send a crawler.

Then there’s mixed content, the migration’s long tail. Your page loads over HTTPS but some image or script on it still loads over plain HTTP. Browsers treat this coldly: they block insecure scripts outright and degrade or flag insecure images, so your “secured” page shows up broken or still earns a warning. The cause is usually hardcoded http:// URLs sleeping in old content, a decade of blog posts embedding images by their full address. Nobody notices, because nobody rereads old posts. This is the kind of thing that makes automated auditing worthwhile; when GazeSite loads a page it records every network request the page makes, and a stray insecure request stands out in that record like a typo in red ink. Not because the tool is clever, but because it actually looks, and looking is the step humans skip.

So my advice comes in two halves that point the same direction. Don’t adopt HTTPS for the ranking boost; the boost is nearly a rounding error, and chasing it misunderstands what you’re buying. Adopt it, and finish the job properly, because the address bar is the first line of your site anyone reads, and right now it either says nothing or it says “Not secure.” One of the oldest rules of selling anything is that you don’t let someone else define you before you’ve spoken. On the web, the browser speaks first. Make sure that when it does, it has nothing to say about you.