Google SEO and SSL: what HTTPS does for ranking, what it does not, and the move that keeps your traffic

Google does use HTTPS in ranking, but only as a small signal. When Google announced it on 7 August 2014, it called HTTPS "a very lightweight signal" that affected "fewer than 1% of global queries" and carried "less weight than other signals such as high-quality content". Today HTTPS sits inside Google's page experience guidance, next to Core Web Vitals and mobile display. So an SSL certificate will not lift a weak page above a strong one. Its real SEO value is elsewhere: Google prefers to index the HTTPS version of a page, Chrome warns visitors away from sites without it, and a badly run move from HTTP to HTTPS is one of the most common causes of a lost index.

This page covers what Google has actually said, what an SSL certificate does and does not change in search, and the checks that make a switch to HTTPS safe. Every Google source below was read on 22 October 2026.

What Google has said about HTTPS and ranking

There are three statements worth knowing, and they fit together.

• The 2014 announcement. On the Search Central blog, Google said it had tested secure connections "as a signal in our search ranking algorithms" and was starting to use HTTPS as a ranking signal. It described the signal as lightweight and said it might strengthen it over time.
• The page experience guidance. Google's current page on page experience lists six self-check questions. One of them is "Are your pages served in a secure fashion?" The same page says there is no single page experience signal: "Our core ranking systems look at a variety of signals that align with overall page experience."
• The indexing preference. Search Console's HTTPS report says: "If your site has a page with both an HTTP and HTTPS address, Google prefers to index the HTTPS version."

Read together, the message is plain. HTTPS is expected. It is part of a good page experience, and Google wants the secure version of each URL in its index. It is not a lever that moves a page up the results by itself, and Google says relevance still comes first: "Google Search always seeks to show the most relevant content, even if the page experience is sub-par."

SSL, TLS and HTTPS: the words people mix up

People search for "SSL" because that is the name most hosts put on the certificate product. Google's own 2014 post describes HTTPS as "HTTP over TLS, or Transport Layer Security", and that is the connection a certificate makes possible. When a site "has SSL", it means the server holds a valid certificate and serves its pages over HTTPS. For search, the certificate brand and price do not matter. What matters is that every page loads over HTTPS without errors, and that the HTTP addresses redirect to it.

Google's 2014 tips still hold as a starting list: pick the certificate type you need (single, multi-domain or wildcard), use 2048-bit key certificates, do not block the HTTPS site in robots.txt, and avoid the noindex tag on pages you want found.

Where HTTPS really affects search traffic

The ranking signal is small. These four effects are not.

Effect	What happens	Source
Which URL gets indexed	Google prefers the HTTPS version when both exist. A site that serves both without redirects splits its signals across two addresses.	Search Console HTTPS report
Browser warnings	Since Chrome 68 (July 2018), Chrome marks every HTTP page "Not secure" in the address bar.	Chromium blog, 8 February 2018
Blocked first visits	Google announced that Chrome 154, in October 2026, turns on "Always Use Secure Connections" by default, so Chrome asks the user's permission before the first visit to a public site without HTTPS.	Google security blog, 28 October 2025
Crawling of the secure site	Search Console warns that "If a site has a lot of HTTPS issues, it can prompt Google to stop crawling your HTTPS pages."	Search Console HTTPS report

The Chrome change matters most: a visitor who meets a warning screen before your page loads is easy to lose, whatever position the result held.

Moving from HTTP to HTTPS without losing traffic

Google treats a move from HTTP to HTTPS as a site move with URL changes. Its site move guide covers it, and the order below follows that guide and web.dev's HTTPS article.

1. Get the certificate and test it

Install the TLS certificate and load every template over HTTPS before you redirect anything. web.dev suggests checking the setup with Qualys' SSL Server Test and treating anything below an A or A+ grade as a bug.

2. Fix mixed content

A secure page that loads images, scripts or stylesheets over HTTP is mixed content. Browsers warn about it and some refuse to load the HTTP resources, which breaks the page. Update internal resource links and database content to HTTPS first.

3. Map every URL and redirect it

Build a list of every old HTTP URL and its HTTPS twin, then set server-side 301 redirects one to one. Google's guide notes that a frequent mistake is redirecting to the wrong or a missing URL. Do not send everything to the home page.

4. Update the signals that still point at HTTP

• Canonical tags must name the HTTPS URL. Search Console flags "HTTP marked with canonical tag" as an error.
• Sitemaps must list HTTPS URLs. "Sitemap points to HTTP" is another listed error.
• Internal links in menus, footers and body text should use HTTPS, so crawlers and visitors do not pass through a redirect on every click.
• An HTTPS URL must never redirect back to HTTP. Search Console reports that as "HTTPS has redirect".

5. Verify and watch in Search Console

Verify both the HTTP and HTTPS variants, and both www and non-www, so you can see each one. You do not need the Change of Address tool for an HTTP to HTTPS move; Google's guide says it is only for moving to a different domain or subdomain. Then open the HTTPS report, which is available for Domain properties and HTTPS URL-prefix properties. Ideally it shows no HTTP URLs at all.

6. Turn on HSTS last

HTTP Strict Transport Security tells browsers to always use HTTPS for your domain, which removes the redirect cost and blocks downgrade attacks. web.dev advises turning it on only once the HTTPS setup is solid, because browsers that know your site as an HSTS host will hard-fail if the certificate ever expires. Start with a short max-age and raise it.

The certificate problems that hurt most

Most HTTPS damage in search comes from maintenance, not from the first install.

• An expired or invalid certificate. Search Console reports "HTTPS has invalid certificate" and notes it typically affects the whole site. Set renewal reminders, or use automatic renewal, and check the expiry date on every domain and subdomain you own.
• A certificate that does not cover a hostname. A certificate for www.example.com does not cover example.com or shop.example.com unless it is issued for them. This is why the single, multi-domain or wildcard choice matters.
• Robots.txt left over from staging. Google's site move guide reminds owners to remove any noindex or robots.txt blocks that were only meant for the migration.
• An HTTPS site that 404s. If Google meets 404 responses on the first HTTPS URLs it tries, the report explains, it "probably gave up trying to crawl corresponding HTTPS pages".

HTTPS is also only one part of keeping a marketing site safe. Account access, tag inventories and form data matter too, and our guide to safe and secure online marketing covers those controls in order.

Trust now shows up in another place

The padlock tells a browser the connection is private. It says nothing about whether the business is any good, and buyers now ask that question of assistants as well as of Google: "is this company legitimate", "who is the safest supplier for this". ChatGPT, Gemini and Perplexity answer from what other sites say about a business, its reviews, its directory listings and its own plain-text pages. A secure, well-indexed site is the base for that answer, not the whole of it. AI Knows Us is built for that second question: it measures whether those assistants name a business when buyers ask, and what sources they lean on when they do.

Questions about Google, SSL and SEO

Does SSL improve Google rankings?

Slightly. Google confirmed HTTPS as a lightweight ranking signal in 2014 and now treats it as one part of page experience. Content relevance and quality carry far more weight, so HTTPS is the base requirement rather than a ranking tactic.

Will switching to HTTPS drop my rankings?

A clean move with one-to-one 301 redirects, updated canonicals and sitemaps, and no robots.txt blocks is a routine change that Google documents step by step. Short-term movement while Google recrawls is normal. Lasting drops usually trace back to wrong redirects or HTTPS errors in Search Console.

Does Google still index HTTP pages?

Yes. HTTP pages can still be indexed. When both an HTTP and HTTPS address exist for a page, Google prefers to index the HTTPS version.

Do I need the Change of Address tool when moving to HTTPS?

No. Google's site move guide says the tool is for moving between domains or subdomains, not for HTTP to HTTPS moves on the same domain.

How do I check my site's HTTPS status in Search Console?

Open the HTTPS report in Search Console. It counts indexed HTTP and HTTPS URLs and lists the reason any HTTPS version could not be indexed, such as an invalid certificate or a sitemap that points to HTTP.