There is no need to rush, but plan the move. Get a certificate, send each HTTP address to the matching secure page, fix images and scripts still loaded over HTTP, and update Webmaster Tools and Analytics.

What Google said yesterday

Google said yesterday that it now uses HTTPS, the secure connection shown by a padlock in the address bar, as a signal when ranking its results.

It described the signal as very light for now, carrying less weight than signals such as the quality of a page's content, and said it may strengthen it to encourage every site to move.

Alongside the announcement came advice for site owners: use certificates with 2048-bit keys, follow Google's guidance on moving a site, and do not block the secure pages from its crawler.

Where a small site stands

Most small business sites still run on plain HTTP, with HTTPS only on a checkout or a login page, if anywhere.

Nothing about such a site changed overnight. A light signal is a slight preference, and a plain site with good content is still a good site.

What changed is the direction. Google has now said publicly that it wants the web on HTTPS, and a move planned calmly costs less than one rushed later.

What HTTPS actually does

HTTPS encrypts what passes between a visitor's browser and your server. Others on the same network, in a cafe or a hotel, cannot read it or change it on the way.

The certificate also confirms that the browser is talking to your site and not to an impostor along the route. The padlock is the browser's way of saying both checks passed.

What a move involves

Moving a whole site to HTTPS is a project with several parts, each simple on its own:

None of it is exotic, but it has to be done completely. A half-moved site is worse than one left alone.

The certificate

Certificates come for a single name, several names, or every subdomain of a domain. Most small sites need one covering the domain with and without the www prefix.

Some certificates check only that you control the domain; others also check the business behind it. Either kind encrypts the connection equally well.

Ask for the 2048-bit key Google mentioned and a SHA-2 signature, since Microsoft has announced that Windows will stop accepting the older SHA-1 kind. Note the renewal date too.

Redirects, page by page

Every old HTTP address should send visitors and Googlebot to the same page on HTTPS with a permanent redirect. The menu page goes to the secure menu page, not to the home page.

That way links from other sites, bookmarks and Google's existing record of each page carry across. Redirecting everything to the home page throws that away.

Do not block the HTTPS pages in robots.txt or mark them noindex. Google listed both as mistakes to avoid.

Mixed content

When a secure page pulls in an image, script, font or embedded map over plain HTTP, the page has mixed content. Browsers treat it as a crack in the padlock.

Insecure images usually still appear, while the padlock picks up a warning or vanishes. Insecure scripts are often blocked outright, so menus, sliders and forms can stop working without any message.

Older pages are full of these: an image inserted years ago with its full http address, a map or video embedded with old code, a script loaded from another site.

A worked example

A kitchen exhaust hood cleaning company serves restaurants, hotel kitchens and food courts around Kamloops, cleaning hoods, ducts and fans overnight while the kitchens are closed.

Its site has a quote form and a customer login, where kitchen managers download service reports with before and after photos for their landlords and insurers.

This spring the owner realised that the login sent each manager's password over plain HTTP, and the quote form carried names and phone numbers the same way.

The whole site moved to HTTPS, with a certificate covering both versions of the domain and every old address redirected to its secure twin, page by page.

A check before launch found mixed content: a logo linked by its full http address, an embedded map using old code, and a gallery script loaded from another site. Each was fixed.

Passwords, reports and quote details now travel encrypted, browsers show the padlock without warnings, and Google finds one secure copy of each page, with the old links pointing to it.

Reasons beyond search

A contact form sends a name, an email address and often a phone number. Over plain HTTP, anyone on the same cafe network can read them on the way.

A site's own admin login is the bigger risk. Over plain HTTP, the password that controls the whole site travels unencrypted each time someone signs in from a hotel or an airport.

Visitors notice the padlock too, especially on forms and anything involving money. Google's announcement adds a reason to move; it was never the only one.

The counter-case

For a site that is only a brochure, without forms or logins, HTTPS adds little beyond Google's light signal, and the move costs money and a developer's time.

A careless move can also do more harm than the signal could ever do good: redirects to the home page, blocked scripts, a certificate that expires unnoticed.

The fair answer is to plan the move rather than rush it because of yesterday's news. Done properly in a quiet month, with every page redirected and tested, it is done once, apart from renewing the certificate.

Planning the move

  1. List every address and subdomain the site uses.
  2. Ask your host what a certificate involves on your plan.
  3. Find mixed content on a test copy before launch.
  4. Redirect each HTTP page to its HTTPS twin.
  5. Add the HTTPS site to Webmaster Tools.
  6. Update Analytics and internal links.
  7. Note the renewal date of the certificate.

Step four is where moves most often go wrong. A redirect for each page keeps what the site has built up; a single redirect to the home page discards it.

For a site that already has a certificate, Heartbleed and the padlock on your site covers what to ask the host when a flaw turns up in the encryption software.

Frequently asked questions

What did Google announce about HTTPS?

That secure HTTPS connections now count as a ranking signal. Google called it very light for now, weaker than content quality, and said it may strengthen it later.

Will a plain HTTP site lose its place in search?

Nothing changed overnight. The signal is light, and a site with good content remains a good site. The announcement is a reason to plan a move, not to panic.

What does a move to HTTPS involve?

A certificate, hosting that supports it, a permanent redirect from each old address to its secure version, mixed content fixed, internal links updated, and Webmaster Tools and Analytics told.

What is mixed content?

Anything on a secure page, such as an image, script or font, that is fetched over plain HTTP. Browsers warn about it or block it, which can break menus and forms.

Should every old page redirect to the home page?

No. Give every old address a permanent redirect to the secure copy of that same page, so links, bookmarks and Google's record of each page carry across.

Is HTTPS worth it for a site without forms?

It matters less, but the site's own admin login still sends a password, and Google has said where it wants the web to go. Plan it for a quiet month.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Still on plain HTTP?

Tell us your site's address, and we will list what a move to HTTPS would involve on your hosting, page by page.

Start a Conversation