HTTP to HTTPS Migration: The SEO Checklist

Does HTTPS help rankings?

A little. Google announced HTTPS as a ranking signal in 2014 and called it "very lightweight", affecting fewer than 1% of global queries at the time (Google Search Central blog, August 2014). It is now part of page experience, next to Core Web Vitals (Google, page experience). The bigger reason is trust: browsers mark http pages as "Not secure", and many visitors leave.

Step 1: certificates for every hostname

• Cover example.com and www.example.com, plus every subdomain that serves pages (shop, blog, help).
• Turn on auto-renewal. An expired certificate shows a full-page browser warning, and visitors cannot reach the page.
• Most hosts and website builders (Shopify, Wix, Squarespace, Webflow) issue free certificates on their own. Check that they cover both www and non-www.

Step 2: one-hop redirect rules

The classic mistake is three rules that fire one after another: http to https, then non-www to www, then add a trailing slash. That is a chain. Write one rule that sends every variant straight to the final URL.

Test four variants of your homepage and one deep URL:

Use curl -I or any redirect checker. Every row must reach the final URL in one hop. Google says to use server-side permanent redirects for site moves (Google Search Central, updated August 2026).

Step 3: fix mixed content

A page loaded over https that pulls images, scripts, fonts or iframes over http is "mixed content". Browsers block some of it and show warnings for the rest.

1. Search your database and theme files for http://yourdomain.
2. Replace with https:// (or relative URLs). On WordPress, use a search-and-replace tool and back up first.
3. Check third-party embeds: old video players, chat widgets and tracking pixels.
4. Open your key templates with the browser console open and look for mixed content warnings.

Step 4: update every signal to https

Leave the http robots.txt open. Google must be able to crawl the http URLs to see their redirects.

Step 5: Search Console

• Use a Domain property. It covers http and https, www and non-www, so your data does not split.
• Submit the https sitemap.
• Open the HTTPS report under Experience. It counts how many indexed URLs are http vs https and lists issues such as a bad certificate or insecure resources. It is available for Domain properties and https URL-prefix properties (Search Console Help, HTTPS report).
• Inspect a few old http URLs: they should show "Page with redirect".

Step 6: HSTS, carefully

HSTS is a response header that tells browsers to always use https for your site. It is good for security. It does not change rankings: Google uses canonicalization, not the HSTS header, to pick which URL to index.

Start with a short max-age (for example 300 seconds), check that nothing breaks, then raise it to a year. Only add includeSubDomains when every subdomain works on https, and only submit to the browser preload list when you are sure, because removal is slow.

Worked example

Brightsmile Dental (fictional) moves to https on a WordPress host. The host issues a certificate for both hostnames, but the old .htaccess has a www rule and the host adds an https rule, so http://brightsmile-dental.com takes two hops. The team merges them into one rule, runs a database search-and-replace for http://brightsmile-dental.com, and finds the logo and two blog images still loading over http. After the fix, the HTTPS report in Search Console shows every indexed URL on https within about three weeks.