HTTPS: the padlock is not optional anymore
Since 2014, Google has said in plain words that an encrypted connection is a ranking signal. But the real reason to have a certificate lies elsewhere: without it, the browser displays "not secure" next to your name.
There are still small-business websites served over bare HTTP, and their owners have no idea, because they never visit their own site except as regulars. Three reasons to check today, in order of real importance.
The browser puts a label on you
The first reason has nothing to do with Google: browsers mark HTTP pages with a “not secure” to the left of the address. Your prospect does see it, at the precise moment they are wondering whether your business is serious. No amount of content work makes up for a label like that, and a contact form filled in on an unencrypted page travels in the clear.
Google has said it since 2014
The second reason is official and old: Google announced in 2014 that HTTPS counts as a ranking signal. A light signal, let us be precise as always: encryption will not push a mediocre page past a good one. But it is one of the trade’s rare binary factors, you have it or you do not, and it gets settled once and for all.
The certificate has been free for ten years
The third reason is that the cost excuse is dead: certificates can be obtained for free and renew themselves at any serious host. If yours bills the certificate as an extra or leaves you to manage the expiry by hand, that tells you something about the host, not about the price of encryption.
The two traps of the switch
For an existing site, moving to HTTPS is an address migration: every page changes URL, from http:// to https://. Two moves avoid most of the damage. First, redirect the old address to the new one, page by page, with a permanent redirect, exactly the mechanism described in the article on redirects. Second, hunt down mixed content: an HTTPS page that still loads an image or a script over HTTP keeps a browser warning, and the hunt is done by opening the browser console, which lists the offending resources.
The starting test fits on one line: type your address with http:// in front, and watch whether you are redirected to the encrypted version. If the page displays without a redirect, the two versions coexist, and you have both the “not secure” label and a duplicate problem: two addresses for every page, which brings us to the next article.
Who writes these notes
This journal is kept by the workshop that designs and maintains the house’s websites. Everything described here, the Search Console, internal links, the business profile, is part of the work delivered with a site: if you would rather someone took care of it, that is precisely the trade.