Google now indexes the HTTPS copy of a page by default when that copy works properly. Finish the move: fix insecure images and scripts, redirect every page, and point canonical tags at the secure addresses.

What Google said yesterday

Yesterday Google said that when a page exists at both an http address and an https address, it will normally index the https one. That is the address searchers see and click.

It will also start looking for secure copies of pages by itself, even when nothing links to them.

There is a condition. The secure copy has to work properly, and Google listed what that means.

Sites entirely on plain http, or fully moved to https, see little change. The announcement matters most for the many stuck in between.

What working properly means

Google's conditions read like a checklist for a clean move. The secure copy should have:

The second is where half-moved sites most often fail. One photo or script loaded from an http address can be enough for Google to keep the plain copy.

A site caught halfway

Many small business sites got a certificate in the past year or so, often after Google said in August last year that https would count as a light ranking signal.

The host installed it and the site began answering at both addresses, but little else changed.

Images, slideshows and maps still load from http addresses in the code, menu links still point to http, and nothing redirects. Canonical tags, lines in each page's code naming the preferred address, often still name the http pages.

So every page exists twice, and nobody at the office looks at the secure copy.

What visitors see on the secure copy

Browsers treat insecure content on a secure page in two ways.

Images still load, but the padlock gains a warning or disappears, which some visitors read as a sign that something is wrong with the site.

Scripts loaded over http are blocked outright by most current browsers. Whatever they ran, a slideshow, a map or a form's checks, simply stops without a message.

And visitors do reach the secure copy: through a shared link, a bookmark or an address the browser remembers.

Why yesterday's change raises the stakes

Until now a neglected secure copy mostly stayed out of sight. Google indexed what the links pointed to, which was http.

Now Google will go looking. Where a secure copy passes every condition, it will normally become the address in the results.

That is good news only if the copy really works. A crawler can miss faults that visitors meet, such as a form sending its contents to an http address, which some browsers warn about as the visitor presses send.

Where the secure copy fails, Google keeps the plain one, and the site gets none of the benefit.

A worked example

A central vacuum installer with two vans fits built-in vacuum systems in new and older houses across several suburbs, and gets most of its work through its website's quote form.

Last year someone at the office read that Google favoured secure sites, and the host installed a certificate. Nobody changed the site, so it answered at both addresses.

The slideshow, the service area map and the quote form's script still loaded from http addresses, and the canonical tags named the plain pages.

A few secure links escaped anyway, in the owner's email signature and on a manufacturer's list of installers.

Visitors who followed them found a warning by the padlock, a blank band instead of the slideshow and a quote form whose button did nothing. On the plain address all of it worked.

A developer finished the move in a day. Every image, map and script now loads over https, the canonical tags and sitemap name the secure pages, and each http page redirects permanently to its twin.

Finishing the move properly

Most of the work is in the site's own code, best done in one sitting rather than a page at a time.

Change every image, script, font and stylesheet address in the templates and content to https. Older pages often hold dozens of image addresses typed in by hand.

Then add a permanent redirect, known as a 301, from each http address to the same page on https, page to page rather than everything to the home page.

Update the canonical tags, internal links and sitemap to the https addresses, and check that robots.txt does not shut out the secure copy.

Telling Google and the other tools

Search Console, formerly Webmaster Tools, treats http and https as separate sites. Add the https version and submit its sitemap there.

In AdWords, change the final URLs so paid clicks reach the secure pages without a redirect.

Update the website address in your Google My Business listing, Facebook page and directories. The redirect catches the rest.

The certificate itself

A valid certificate is the first condition and the easiest to miss. It has to cover the address visitors type, with and without www, and it has to be current.

Shared hosting sometimes answers secure requests with a certificate issued for the host's own name. Visitors see a warning, and Google will not prefer that copy.

Put the expiry date in a calendar. Chrome already warns about certificates signed with the older SHA-1 method that run into next year, and certificate authorities stop issuing them after this month.

The counter-case

A site with no secure copy at all loses nothing today. The change chooses between two copies, and https is still only a light ranking signal.

A brochure site with no forms or logins can schedule its move for a quiet month, provided it is planned and finished rather than started and left.

Sites relying on old widgets or advertising code that only work over http need those replaced first.

For any site already answering at both addresses, make the secure copy work completely, then redirect everything to it.

The checks for a clean move

  1. Open your site at https and read every page type.
  2. Fix each image and script still loaded over http.
  3. Confirm the certificate covers www and the bare domain.
  4. Redirect every http page to its secure twin.
  5. Point canonical tags and the sitemap at https.
  6. Add the https site in Search Console.
  7. Update AdWords, listings and profiles afterwards.

Step four is what turns two copies into one. Until every http page redirects, links and visitors keep dividing between them, whichever Google prefers.

Why a form collecting personal details belongs on https whatever Google decides is covered in health details sent through a plain HTTP form.

Frequently asked questions

What did Google announce this week?

That when a page exists at both http and https addresses, Google will normally index the https copy, provided it works properly. It will also look for secure copies itself.

What does working properly mean?

A valid certificate for the address, no images or scripts loaded over http, nothing blocking crawlers, and no redirect, canonical tag, link or sitemap pointing back to http.

What is a half-moved site?

One where a certificate was installed and the site answers at both addresses, but images, scripts, links and canonical tags still use http and nothing redirects.

Why do scripts stop working on the secure copy?

Most current browsers block http scripts on a secure page, so whatever they ran, such as a slideshow, a map or a form's checks, stops without explanation.

Which redirect should the move use?

A permanent redirect, known as a 301, from each http address to the same page on https. Sending everything to the home page breaks old links and search results.

Does a plain http site need to move now?

Not this week. The change chooses between two existing copies, and https is still a light signal alone. Plan the move for a quiet month, then finish it.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Site answering at both http and https?

Send us the domain. We will hunt down each image and script still loading over http, then complete the move.

Start a Conversation