What Is HTTPS and Why Does Google Penalise Sites Without It?

If you visit a website and see a padlock icon in your browser's address bar, that site is using HTTPS. If you see a "Not Secure" warning instead, it is running on the older HTTP protocol — and Google has been penalising those sites in search rankings since 2014.

This is one of the most basic technical SEO requirements on the web — and one that still catches site owners off guard. This guide explains what HTTPS is, exactly how it affects your Google rankings, and how to switch if you have not already done so.

What Is HTTPS — and What Is the Difference from HTTP?

HTTP stands for HyperText Transfer Protocol. It is the system that governs how data travels between a visitor's browser and your website's server. The S in HTTPS stands for Secure.

The core difference is encryption. When a visitor loads a page on an HTTP site, the data transferred — including any form submissions, login details, or personal information — travels in plain text. Anyone intercepting that connection can read it directly.

HTTPS encrypts that data using SSL/TLS certificates. Even if the connection is intercepted, the data cannot be read. This is why HTTPS is required for any site handling payments, logins, or personal data — and why Google now treats it as a baseline expectation for all websites.

What does the padlock mean?

The padlock icon in your browser's address bar confirms the site has a valid SSL/TLS certificate and is using HTTPS. Clicking it shows certificate details — who issued it, when it expires, and whether the connection is secure.

On HTTP sites, Chrome and other modern browsers display a "Not Secure" warning directly in the address bar. This warning alone is enough to cause visitors to leave before they read a single word.

Why Google Cares About HTTPS

In 2014, Google officially announced HTTPS as a ranking signal — meaning sites with HTTPS would receive a ranking boost over equivalent HTTP sites. At the time it was described as a lightweight signal. Since then, Google has progressively increased its weight and Chrome has added increasingly strong user-facing warnings for HTTP sites.

Google's reasoning is straightforward: it does not want to send users to sites that could expose their data to third parties. If Google is going to recommend your site, it needs to meet a baseline standard of security.

The indirect SEO damage from HTTP

Beyond the direct ranking signal, staying on HTTP damages SEO in several indirect ways that are often more impactful than the signal itself:

• Higher bounce rates: Users who see a "Not Secure" warning leave immediately — increasing your bounce rate and reducing engagement signals that Google uses as indirect ranking inputs
• Referral data is stripped: When users navigate from an HTTPS site to your HTTP site, referral information is removed. Your analytics shows these visits as direct traffic, making it impossible to understand where your users are coming from
• Reduced conversion rates: Visitors who do stay are far less likely to submit forms, sign up, or purchase on a site flagged as insecure — affecting the business outcomes that SEO exists to drive
• Flagged in every audit: HTTP is a critical issue in every technical SEO audit tool — it signals to clients, investors, and partners that your site is poorly maintained

How Strong Is HTTPS as a Ranking Factor in 2026?

HTTPS is best understood as a baseline requirement rather than a performance booster. Think of it like having a sitemap — you will not dramatically jump rankings just because you have one, but not having one puts you at a clear disadvantage against sites that do.

Google has confirmed that between two pages equal in all other factors, the HTTPS version will rank above the HTTP version. In practice, most sites competing for the same keywords are already on HTTPS — so the real risk is being penalised for not having it, not being rewarded for having it.

The simplest way to think about it: HTTPS removes a ranking penalty. It is a prerequisite, not an advantage.

Does HTTPS improve PageSpeed scores?

Indirectly, yes. HTTP/2 — the faster version of the HTTP protocol that significantly improves page load performance — requires HTTPS to work. Without HTTPS, your server cannot use HTTP/2's performance improvements including request multiplexing, header compression, and server push. Switching to HTTPS also enables HTTP/2, which can meaningfully improve your Core Web Vitals scores.

See how Core Web Vitals affect your rankings in our guide → How to Pass Core Web Vitals Without Hiring a Developer

How to Check If Your Site Has HTTPS

Method 1: Check the address bar

Visit your homepage. Look at the URL in the address bar. If it starts with https:// and shows a padlock icon, you are on HTTPS. If it shows http:// or a "Not Secure" warning, you are not.

Method 2: Check for mixed content issues

Even if your site is technically on HTTPS, you may have mixed content issues — where some resources on the page (images, scripts, stylesheets) are still loading over HTTP. This causes browsers to display security warnings on pages that should be secure.

To check: open Chrome DevTools (press F12) → go to the Console tab → look for warnings starting with "Mixed Content." Each one represents an HTTP resource loading on an otherwise HTTPS page.

Method 3: Run a full technical audit

SEOMentor's technical audit flags both HTTP status and mixed content issues in a single scan — so you can see the full picture without manually checking each page and resource.

How to Switch from HTTP to HTTPS

Step 1: Get an SSL certificate

Most hosting providers now include free SSL certificates via Let's Encrypt. Check your hosting control panel — look for an SSL or HTTPS section. Major hosts including SiteGround, Bluehost, Kinsta, Cloudflare, and Netlify include free SSL with all plans and activate it in a single click.

Step 2: Force HTTPS for all traffic

After activating SSL, configure your site to redirect all HTTP requests to HTTPS automatically. In WordPress with cPanel hosting, this is usually a toggle in your hosting control panel. You can also add a redirect rule to your .htaccess file:

Step 3: Update your WordPress site URL

In WordPress: Settings → General → change both "WordPress Address" and "Site Address" from http:// to https://. Save the changes.

Step 4: Fix mixed content

Install the Better Search Replace plugin for WordPress. Use it to find all instances of http://yourdomain.com in your database and replace them with https://yourdomain.com. This updates all internal image URLs, links, and scripts that still reference the old HTTP version.

Step 5: Update Google Search Console

HTTPS and HTTP are treated as separate properties in Google Search Console. Add your HTTPS property, verify ownership, and submit your sitemap to the HTTPS property. Google will begin re-indexing your pages under the secure URL.

Step 6: Update your sitemap and robots.txt

Confirm your sitemap references HTTPS URLs. Check your robots.txt file includes the correct HTTPS sitemap URL at the bottom of the file.

FAQ

Will switching from HTTP to HTTPS hurt my rankings temporarily?

There may be a brief period of flux as Google recrawls and re-indexes your pages under new HTTPS URLs. This typically resolves within 2–4 weeks if your 301 redirects from HTTP to HTTPS are correctly configured. Most sites see a net positive outcome after the transition settles.

Does HTTPS cost money?

Free SSL certificates through Let's Encrypt are supported by virtually every modern hosting provider and cost nothing. Paid SSL certificates offer no ranking advantage over free ones — the padlock is identical. Unless you need an Extended Validation certificate for specific legal or enterprise reasons, the free version is identical for SEO purposes.

I have the padlock but Search Console still shows errors. Why?

You may have both HTTP and HTTPS properties registered in GSC, and Google may still be indexing pages under the old HTTP version. Add the HTTPS property, verify it, submit your sitemap under the HTTPS property, and use the URL Inspection tool to request re-indexing of your key pages.

What is a mixed content warning and how serious is it?

A mixed content warning means your page is on HTTPS but still loading some resources over HTTP. Browsers may block these resources or show security warnings, which undermines user trust and can damage PageSpeed scores. Fix them by updating all internal resource URLs to HTTPS using Better Search Replace.

Does HTTPS affect local SEO rankings?

Yes. Local search uses the same HTTPS signal as organic rankings. If your local business website is on HTTP while competitors are on HTTPS, you are at a disadvantage in local results — particularly in the Google Maps pack.

Conclusion

HTTPS is not optional in 2026. It is a baseline security requirement, a confirmed Google ranking signal, a prerequisite for HTTP/2 performance improvements, and one of the most visible trust signals to your visitors.

The good news: switching is free, typically takes under an hour, and most hosting providers make it a one-click process. If your site is still on HTTP, this is your single highest-priority technical SEO fix — nothing else matters as much until this is resolved.

After switching, run a full technical audit to confirm HTTPS is correctly configured, your redirects are in place, and there are no mixed content issues undoing the upgrade.

Continue with the rest of your technical SEO fixes in our guide → 7 Technical SEO Fixes Anyone Can Do This Weekend