Skip to main content

    HTTP to HTTPS

    HTTPS is a baseline trust signal. Use permanent redirects and update canonicals/internal links to avoid duplicate HTTP/HTTPS versions.

    Definition

    Migrating from HTTP to HTTPS improves security and trust. For SEO, the key is consolidating all HTTP URLs to HTTPS using permanent redirects, and updating canonicals, hreflang, sitemaps, and internal links so search engines see one consistent version.

    Why it matters

    • HTTPS is a baseline trust signal for users and search engines
    • Google has confirmed HTTPS as a ranking factor (lightweight but essential)
    • Avoid duplicate HTTP/HTTPS versions that split ranking signals
    • Mixed content causes browser security warnings
    • Modern browsers label HTTP sites as 'Not Secure'
    • Many modern features (Service Workers, Geolocation) require HTTPS
    • User trust in HTTPS affects conversion rates

    How to implement

    • Obtain SSL/TLS certificate (Let's Encrypt is free, Cloudflare is automatic)
    • 301/308 redirect all HTTP URLs to HTTPS permanently
    • Update canonicals, hreflang, sitemaps, and internal links to HTTPS
    • Find and fix mixed content (images, CSS, JS must also be HTTPS)
    • Add HTTPS version in Google Search Console
    • Update external links and social media URLs where possible
    • Monitor to ensure index and traffic transition smoothly

    Examples

    html
    # Cloudflare Dashboard settings
    # SSL/TLS → Edge Certificates → Always Use HTTPS: ON
    
    # Or use Page Rules:
    # Match: http://*example.com/*
    # Setting: Always Use HTTPS
    html
    # nginx.conf
    server {
        listen 80;
        server_name example.com www.example.com;
        return 301 https://$host$request_uri;
    }
    
    server {
        listen 443 ssl http2;
        server_name example.com;
        
        ssl_certificate /etc/ssl/certs/example.crt;
        ssl_certificate_key /etc/ssl/private/example.key;
        
        # HSTS (force HTTPS)
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    }

    Related

    FAQ

    Common questions about this term.

    Back to glossary