What is HTTPS?
HTTPS is HTTP sent over an encrypted TLS connection: the browser and the site agree on keys, and everything between them is private and can't be changed on the way. It also proves the browser reached the domain in the address bar. It does not prove the site is honest, safe or run by who it says: a phishing page can have a valid certificate too. Google calls HTTPS a very lightweight ranking signal. Since 21 October 2026 Chrome asks before opening any public site over plain HTTP, so a site without it now meets a warning before its first visit. All 4 sites I checked redirect to it, and none of them pays for its certificate.
What HTTPS protects
The HTTP standard, RFC 9110, lists what an https:// address gives you: the server has been authenticated as acting for the domain, and the connection has confidentiality and integrity protection. In plain words:
- Privacy: nobody on the network in between, such as a café's Wi-Fi or an internet provider, can read what is sent.
- Integrity: nobody in between can change the page, inject ads or swap a download.
- The right server: the certificate shows the browser it reached the domain it asked for.
What it doesn't prove
A domain-validated certificate, the kind Let's Encrypt issues, shows only that the requester controls the domain. Let's Encrypt itself says such a certificate says nothing about a site's reputation, real-world identity or safety. A padlock means the connection is private. It doesn't mean the site deserves your card number.
Does HTTPS help SEO?
A little. When Google announced HTTPS as a ranking signal, it called it a very lightweight one, affecting fewer than 1 percent of queries and carrying less weight than high-quality content. Its current page-experience guidance asks whether pages are served securely but gives HTTPS no weight of its own.
What matters more is which version gets indexed. Google prefers the HTTPS version of a page as the canonical one when both exist, as long as the certificate is valid and the HTTPS page doesn't depend on insecure resources or point back to HTTP.
What browsers do now
- Chrome marks plain HTTP pages "Not secure", and has done so for every HTTP page since July 2018.
- Chrome now asks first. Google announced that Chrome would ask for the user's permission before first opening any public site without HTTPS, and on 21 October 2026 said this protection had reached all users by default.
- Mixed content is blocked or upgraded. On an HTTPS page, browsers try to upgrade images, video and audio requested over http://, and block other insecure requests such as scripts and stylesheets.
Redirects and HSTS
Moving a site to HTTPS is a site move in Google's terms. Redirect every http:// address to its own https:// address with a permanent redirect (301 or 308), not everything to the home page, and keep the redirects for at least a year.
HSTS goes a step further. A site that sends the Strict-Transport-Security header tells the browser to use HTTPS for it from then on, without asking. The HSTS preload list builds that into browsers before the first visit. It needs a header with a max-age of at least a year, includeSubDomains and preload, and it is hard to undo: removal takes months to reach users.
Some whole domain endings are preloaded. Every .app domain is on the list, so browsers that use it never try plain HTTP for one.
Certificates are free, and getting shorter
Let's Encrypt issues certificates at no charge, and its default lifetime is 90 days. It has announced shorter ones: 64 days from 10 February 2027 and 45 days from 16 February 2028. Industry rules will cap every public certificate at 47 days from 15 March 2029. Renewal has to be automatic, because nobody can renew by hand that often.
What four real sites showed
On 9 November 2026 I checked 4 sites I run.
| Sites | |
|---|---|
| http:// redirects to https:// with a 301 | 4 of 4 |
| Certificate issued by Let's Encrypt or Google Trust Services | 4 of 4 |
| Certificate lifetime | 89 to 90 days |
| Send an HSTS header | 0 of 4 |
| On the HSTS preload list through their domain ending | 3 of 4 |
None sends an HSTS header, and for 3 of them that doesn't matter: they are .app sites, and the preload list already makes browsers use HTTPS before the first request. The other one depends on its redirect alone for the first visit. That is the pattern worth checking on your own site.
What Check Engine checks
Check Engine checks whether your site is served over HTTPS, whether http:// redirects to https://, and whether http:// answers with an error instead. It reports a certificate that is invalid or close to expiring, pages that load scripts, styles or images over http://, and a missing HSTS header. On a domain ending that is already preloaded, such as .app, it says no HSTS header is needed instead of flagging one. It also reports missing baseline security headers.
Sources
- RFC 9110, the https URI scheme
- MDN, HTTPS
- Google, HTTPS as a ranking signal (2014)
- Google, canonical URLs
- Google, Chrome now warns before insecure HTTP connections
- Chromium, marking HTTP as non-secure
- MDN, mixed content
- HSTS preload list
- Let's Encrypt, from 90 to 45 days
- Let's Encrypt, certificate lifetimes
- Google, site moves
$59once
For Macs with Apple silicon or Intel, macOS 12 or later, and 64-bit Windows
Priced in US dollars. Checkout shows your currency and any local tax.
On a Mac? Get the Mac version.
On your phone?
Launch price: $29.50 once, through 30 November. From 1 December: $59. Buy applies the code FOUNDINGDOCKET for you; if the checkout shows $59, enter it under ‘Have a discount code?’.
Screaming Frog is $279 a year. Ahrefs plans with Site Audit run $129–$449 a month. Check Engine is $59 once. Screaming Frog’s price read 4 November 2026, Ahrefs’ 9 November 2026.
30 days, no conditions, no questions asked. Refund policy
Common questions
What is the difference between HTTP and HTTPS?
HTTPS is HTTP over an encrypted TLS connection. With plain HTTP, anyone on the network in between can read and change what is sent. With HTTPS, they can't, and the browser can confirm it reached the right domain.
Does HTTPS mean a website is safe?
No. It means the connection is private and goes to the domain shown. A phishing site can have a valid certificate. Domain-validated certificates say nothing about who runs a site or whether it can be trusted.
Is HTTPS a ranking factor?
A very small one. Google described it as a very lightweight signal affecting fewer than 1 percent of queries. Google does prefer the HTTPS version of a page when both exist.
Do I need to pay for an SSL certificate?
No. Let's Encrypt and other authorities issue certificates for free, and most hosts renew them automatically.