Is HTTPS Still a Google Ranking Signal? What Search Central Says

If you are asking whether HTTPS still helps you rank, the honest answer is: not much on its own, and Google now says so more plainly than it used to. The Google Search Central HTTPS ranking signal began as a small boost announced in 2014. Today Google’s own documentation treats a secure connection as part of a good page experience, not as a lever you pull for positions.

I have worked in SEO for more than 16 years, and I have seen HTTPS sold as a ranking fix more than once. I have also cleaned up after HTTPS migrations that went wrong. Both mistakes come from the same place: treating HTTPS as a ranking trick instead of as a technical change that touches every URL on your site. This article separates what Google has documented from the myths, then gives you the checklist I use so the switch costs you nothing.

The Google Search Central HTTPS ranking signal, then and now

The story has two chapters, and most of the confusion comes from people quoting only the first one.

2014: a lightweight signal. In August 2014 Google announced on its webmaster blog that HTTPS would be used as a ranking signal. As Search Engine Journal reported at the time, Google called it a “very lightweight” signal, affecting fewer than 1% of global queries, and said it would carry less weight than other signals such as high-quality content. Google also said it may decide to make HTTPS a stronger signal later, to encourage more sites to switch.

Now: part of page experience. Google’s page experience documentation includes a self-assessment checklist, and one of its questions is “Are your pages served in a secure fashion?” The same page answers the ranking question directly in its FAQ. It says there is “no single signal” for page experience, that “Core Web Vitals are used by our ranking systems”, and then: “Beyond Core Web Vitals, other page experience aspects don’t directly help your website rank higher in search results.”

Read those two chapters together and the position is clear. HTTPS was never a big ranking factor. Google’s current documentation places a secure connection among the page experience aspects that don’t directly lift rankings, while still recommending it because it makes a site better to use.

HTTPS is a hygiene standard, not a ranking strategy: you need it, and it won’t carry you.

Myths I still hear about HTTPS and rankings

The pattern behind most of these myths is simple. Someone needs a reason to sell a migration, and “Google ranks secure sites higher” is easier to say than “Google prefers your URLs to be consistent.”

Where HTTPS really affects your SEO: which URL Google picks

The part of HTTPS that matters most for search is canonicalisation: which version of a page Google treats as the main one. Google’s guide to consolidating duplicate URLs says that “Google prefers HTTPS pages over equivalent HTTP pages as canonical”, and then lists the exceptions. Google may prefer the HTTP version when:

• the HTTPS page has an invalid SSL certificate,
• the HTTPS page contains insecure dependencies (other than images),
• the HTTPS page redirects users to or through an HTTP page,
• the HTTPS page has a rel="canonical" link to the HTTP page.

The same page is blunt about the worst cases: “Avoid bad TLS/SSL certificates and HTTPS-to-HTTP redirects because they cause Google to prefer HTTP very strongly.” It adds that HSTS cannot override that preference. It also says the certificate must match your complete site URL (or be a wildcard covering the right subdomains), and that sitemaps and hreflang annotations should list the HTTPS URLs.

This is where I find real problems in audits. Not “the site has no HTTPS”, which is rare now, but half-finished setups: a certificate that covers www but not the bare domain, a canonical tag in the theme that still hard-codes http://, a payment or login step that bounces through HTTP, or a sitemap generated before the switch and never updated. Each one sends Google mixed signals about which URL is the real one, and duplicate signals are what quietly split your rankings.

HTTP to HTTPS is a site move: what Google tells you to do

Google’s documentation on site moves with URL changes names “URL changes from HTTP to HTTPS” as one of its examples. That one line is the reason I treat every HTTPS switch as a small migration, with a plan and a check afterwards.

The same page sets the expectations you should hold your developer or agency to:

• “Use server side permanent redirects if technically possible.” Google says 301 and other permanent redirects don’t cause a loss in PageRank.
• “Avoid chaining redirects.” Each old URL should go straight to its final HTTPS address.
• Each new URL should have a self-referencing canonical tag.
• “Change the internal links on the new site from the old URLs to the new URLs.”
• “Submitting a sitemap can help make the discovery process quicker.”
• Verify both the old and new sites in Search Console. You don’t need the Change of Address tool for HTTP to HTTPS moves.
• “Keep the redirects for as long as possible, generally at least 1 year.”
• “Expect temporary fluctuation in site ranking during the move.”

For the server side, Google links to web.dev’s guide to enabling HTTPS on your servers. Two points from it save the most trouble. Use a 301 redirect to show that the HTTPS version is canonical. And be patient with HSTS: the guide says not to enable it until you are certain your HTTPS setup will hold up, because clients may hard-fail when the TLS configuration breaks, and it suggests starting with a low max-age and increasing it gradually.

My HTTPS migration checklist, in order

The “before” column is where most of the value sits. Without a baseline you cannot tell whether a dip in the second week is the temporary fluctuation Google warns about or a broken template. If you want a structured way to watch that period, our checklist for tracking rankings after a website migration covers what to compare and when.

On WordPress, the usual traps are the site address settings, absolute URLs stored in the database, page builder content and a caching layer that keeps serving old HTTP links. On larger sites, I often check the server logs after the switch to see which old URLs Googlebot still requests and whether every one of them meets a single clean 301. That is the job our log file analysis service does.

What to prioritise instead of HTTPS

If your site already runs on HTTPS without errors, there is nothing more to gain from HTTPS itself. The effort is better spent on the things Google’s documentation says carry weight: content that is genuinely the most useful result for the search, a structure Google can crawl, and Core Web Vitals that don’t hold your key templates back. I covered how much weight to give page experience in what still works for ranking higher on Google: it is real, but more often a tiebreaker than a winner.

If you are still on HTTP, switch, but plan it like the site move it is. The ranking gain is small. The risk of a sloppy migration is not.

How I handle HTTPS work for clients

Most of the HTTPS work I do is not the switch itself but the review afterwards: finding the redirect chain on one directory, the canonical tag that still says http://, or the sitemap nobody regenerated. It fits inside a wider technical SEO review, and on a well-built site it is quick. I charge by the hour with no fixed packages, so a site that needs one hour of checks pays for one hour. If the switch has already happened and traffic fell, an SEO website audit is where I would start.

FAQ

Is HTTPS part of Google’s page experience?

Yes. Google’s page experience self-assessment asks whether your pages are served in a secure fashion, and Search Console has an HTTPS report that shows whether you serve secure pages and what to fix. Google’s documentation also says that beyond Core Web Vitals, other page experience aspects don’t directly help a site rank higher.

Will moving to HTTPS make my rankings drop?

It can, briefly. Google says to expect temporary fluctuation in ranking during a site move. A lasting drop usually points to a mistake: missing or chained redirects, canonical tags or internal links still on HTTP, or a certificate problem that makes Google prefer the HTTP version.

Do I need the Change of Address tool for HTTPS?

No. Google’s site move documentation says you don’t need it for HTTP to HTTPS moves. It is meant for changes of domain or subdomain. Verify the HTTPS version in Search Console and submit an updated sitemap instead.

Does a Google SEO expert still recommend HTTPS?

Yes, without hesitation, but for the right reasons. Visitors expect a secure connection, browsers can warn or block insecure resources, and Google prefers HTTPS URLs as canonical. Anyone who promises a ranking jump from HTTPS alone is overselling it.

How long should I keep HTTP to HTTPS redirects?

Google’s guidance is to keep redirects for as long as possible, generally at least one year. In practice I leave them in place permanently, because old HTTP links keep arriving from other sites for years.