HTTPS and SEO: The Complete Migration Checklist

HTTPS is settled law: it's been a Google ranking signal since 2014, browsers brand plain HTTP pages "Not secure" in the address bar, and no visitor should be asked to trust an unencrypted site in this decade. If you're already on HTTPS — most sites are — this guide is your leak-check, because partial or sloppy migrations quietly cost equity for years. If you're migrating now, this is the complete runbook, and done right it costs you nothing.

Why this is non-negotiable

Three stacked reasons. Trust: the browser warning on HTTP forms is a conversion killer that no ranking gain could offset. The ranking signal: lightweight — a tiebreaker, Google says — but a tiebreaker you simply collect by being correct. The ecosystem: HTTP/2 speed gains, modern browser APIs, referral data integrity — all gated on HTTPS. The certificate objection died when Let's Encrypt made them free and auto-renewing; every serious host provisions one in a click.

The migration runbook

An HTTPS migration is a site move where only the protocol changes — same playbook, smaller blast radius:

1. Install and verify the certificate — covering all hostnames you serve (www and bare domain both); auto-renewal on, because expired certificates are self-inflicted outages.
2. 301 everything, one hop — every http:// URL redirects permanently to its exact https:// counterpart. Page-to-page, sitewide, at server level. The classic leak: http→https→www chains — fold protocol and host policy into a single hop.
3. Update every internal reference — links, images, scripts, stylesheets to https (protocol-relative or absolute-https); internal links should never ride the redirect.
4. Kill mixed content — http assets on https pages break the padlock and get blocked by browsers. Crawl for hardcoded http:// asset URLs (database search-and-replace on CMS sites), fix, and consider a Content-Security-Policy upgrade directive for stragglers.
5. Update the infrastructure references — canonicals to https, sitemap URLs to https, robots.txt Sitemap line, and re-add the https property in Search Console (properties are protocol-specific — your data continues there).
6. Verify externally where you can — update profile links, directories and ad destinations; the rest of the web's http links are exactly what your 301s are for, passing their equity through indefinitely.
7. Add HSTS once stable — the header that tells browsers "https only, always," removing even the first insecure request. Set a short max-age initially, lengthen when confident.

What to expect, and the leak-check

Expect a few weeks of index churn as recrawl processes the moves — URL-by-URL, important pages first — with rankings consolidating onto https versions; sitewide traffic should hold within normal variance if the mapping is complete. The post-migration (or years-later) leak-check, ten minutes in the quarterly audit: crawl a sample of old http URLs and confirm single-hop 301s; check for mixed-content warnings on key templates; confirm no internal links still point at http; verify the certificate chain and renewal; and in Search Console, confirm the http property's indexed count has drained toward zero. Sites that migrated casually in 2016 still fail two of these — free equity for whoever finally runs the check.

Frequently asked questions

Will migrating to HTTPS drop my rankings temporarily?

A clean migration typically shows only minor churn for a few weeks; sloppy ones (partial redirects, chains, mixed content) show real dips with slow recoveries. The variance is execution, not luck — the runbook above is the whole difference.

Do I lose the value of my old http backlinks?

No — permanent 301s pass their equity through, indefinitely, per the redirect rules. Updating high-value external links to https directly is nice-to-have hygiene, not a rescue mission.

Is HTTPS enough to make my site "secure"?

It secures the connection — not the application behind it. Padlock ≠ audited. For SEO purposes though, the box is binary and this checklist closes it — after which the contest returns to the usual arena: content, intent, and the authority to back it (where we come in).