HTTPS and security as a technical SEO factor

Google confirmed HTTPS as a ranking signal in 2014 and has kept reinforcing its importance ever since, for a reason that goes beyond ranking itself: Chrome actively flags as "not secure" any site served over http:// that includes a form, and that visible warning drives users away regardless of where the page ranks. Security is no longer an optional add-on to technical SEO, it's a precondition for the rest of the work to matter.

HTTPS: what it actually certifies and what it doesn't

A valid SSL/TLS certificate encrypts the connection between browser and server, preventing a third party on the same network (a public Wi-Fi, for example) from intercepting or modifying data in transit. What it does not certify, and this is a common misunderstanding, is the reliability of the content or the company behind the site: a Domain Validated (DV) certificate, the most common and free type today thanks to services like Let's Encrypt, only confirms whoever requested it controls the domain, nothing more. Extended Validation (EV) certificates, which used to show the company name in the browser bar, have lost practical relevance because modern browsers stopped visually distinguishing them from a DV certificate.

Forced redirect and HSTS: having HTTPS isn't enough on its own

Having a certificate installed isn't enough if the http:// version remains accessible in parallel, because then two versions of the site exist competing for indexing (see the canonicalization guide). The forced 301 redirect from http:// to https://, already covered in the redirects guide, is the first step; the second, more advanced one, is the Strict-Transport-Security (HSTS) header, which tells the browser to always remember to use HTTPS for that domain for a set period, even if a user manually types http:// or clicks an old unencrypted link:

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

The max-age parameter is expressed in seconds (31536000 equals one year) and includeSubDomains extends protection to every subdomain, useful if versions like blog.yourdomain.com or shop.yourdomain.com also need to always be served over HTTPS.

Mixed content: the mistake that still shows a broken padlock

Mixed content happens when a page served over HTTPS loads a resource (an image, a script, a stylesheet) still over http://, usually via an absolute URL forgotten from when the site had no certificate. Browsers outright block the most dangerous mixed resources (JavaScript, iframes) and show visible warnings for others (images), which in any case projects a poorly maintained site signal to both users and, indirectly, the trust Google places in the domain.

// Quick check from the browser console:
// look for resources still loading over http:// on an https page
[...document.querySelectorAll('img, script, link')]
  .filter(el => (el.src || el.href || '').startsWith('http://'))

Expired certificates: a silent failure until it isn't

An SSL certificate has an expiration date (usually 90 days with Let's Encrypt, up to a year with commercial providers) and, if not renewed in time, the entire site stops being normally accessible: browsers show a full-screen warning interstitial before letting the user through, which in practice is indistinguishable, for most people, from the site being down. The most common cause isn't technical but procedural: manual renewals that depend on someone remembering, instead of automatic renewal set up in advance (the standard today with Let's Encrypt and most hosting).

Hacks and malware: the direct impact on Google's index

When Google detects a site has been compromised (injected content, malicious redirects to other domains, or malware served to visitors), it can apply two distinct measures with different impact: show a "this site may be hacked" warning directly in search results, or, in serious cases, remove the site from the index entirely until it's resolved. Both are communicated in Search Console, under Security Issues, and recovery requires cleaning up the actual compromise (not just the visible symptom) and requesting a manual review once confirmed, a process that takes anywhere from days to weeks depending on severity.

Additional security headers that matter too

Beyond HSTS, a set of HTTP security headers reduces the site's attack surface without directly affecting SEO but does affect the domain's overall trust: X-Content-Type-Options: nosniff stops the browser from insecurely guessing a file's type, X-Frame-Options or the frame-ancestors directive of Content-Security-Policy prevent the site from being loaded inside a third-party iframe (clickjacking protection), and Content-Security-Policy in general limits which origins JavaScript can load from, reducing the impact of a potential code injection.

Frequently asked questions