HTTPS SEO
HTTPS SEO means ensuring your site uses a valid SSL/TLS certificate and that all pages, links, and assets resolve securely — it's a lightweight ranking signal and a prerequisite for HTTP/2 and Core Web Vitals eligibility.
What I’d do first
- Get a valid SSL certificate and set up 301 redirects from HTTP to HTTPS.
- Update internal links, canonicals, hreflang, and sitemaps — don't skip any.
- Scan for mixed content and fix it before launch.
- Monitor Search Console for crawl errors and index coverage after migration.
- Audit HTTPS setup quarterly — it's not a one-time task.
I've seen plenty of sites lose rankings after an HTTPS migration — not because HTTPS is bad, but because the redirects, canonicals, and internal links weren't handled properly.
The path I'd take
- Get a valid SSL/TLS certificate — free options like Let's Encrypt work fine. Install it on your server.
- Set up 301 redirects — redirect every HTTP URL to its HTTPS counterpart. Use server-level rules (e.g.,.htaccess, Nginx config) for speed.
- Update internal links — search your database or CMS for hardcoded HTTP links and change them to HTTPS.
- Update canonical tags — every page's rel="canonical" should point to the HTTPS version.
- Update hreflang tags — if you use hreflang for multilingual sites, make sure all language/region URLs use HTTPS.
- Update your XML sitemap — regenerate it with HTTPS URLs only, then submit via Search Console.
- Monitor in Search Console — check for crawl errors, index coverage, and manual actions after migration.
Watch-outs
- Don't block HTTPS pages in robots.txt — this prevents Google from crawling your secure URLs. Keep robots.txt open for HTTPS.
- Don't use 302 redirects — they're temporary and don't pass link equity. Use 301 for permanent moves.
- Don't forget external links — if you control backlinks from other sites, ask them to update to HTTPS. If not, the 301 will pass most equity.
- Don't ignore mixed content — even one HTTP image on an HTTPS page can trigger a browser warning. Use a tool like Why No Padlock to scan.
- Don't treat it as a one-time task — new content, third-party scripts, or CMS updates can reintroduce HTTP links. Audit quarterly.
What I got wrong
- I assumed HTTPS was just a ranking boost — it's not. It's a foundation. I've seen sites lose rankings after migration because they didn't update internal links or canonicals, creating duplicate content.
- I once blocked HTTPS in robots.txt — thought I was being safe. Instead, Google couldn't crawl my secure pages for weeks. Fixed it fast, but it cost indexation.
- I forgot to update hreflang tags — my multilingual site had HTTP URLs in the hreflang annotations. Google ignored them, and the wrong language versions showed up in search.
- I didn't check for redirect chains — HTTP → HTTPS → WWW → non-WWW. Each hop adds latency and can dilute link equity. Now I always test with a redirect checker.
Next step
Sources
Primary documentation is linked directly. Anything commercial is marked nofollow.
- Google Search Central: SEO starter guide — Primary source for Google-recommended technical SEO practices including HTTPS.
- Google Search Central: HTTPS and site migrations — Best source for HTTPS migration, canonicalization, and secure-site implementation details.
- Google Search Central: Sitemaps documentation — Authoritative guidance on XML sitemap purpose, format, and submission.
- Google Search Central: Internationalization and hreflang — Official reference for multilingual and regional targeting signals.
Notes from Callum Bennett.