HTTPS

HTTPS stands for Hypertext Transfer Protocol Secure: the secure version of the protocol your browser uses to communicate with a website. Everything sent between visitor and server, from a completed contact form to payment details, is encrypted. That means nobody can read along on the way or quietly alter the content. You can recognise it by "https://" in the address bar and, in most browsers, by a padlock or a similar symbol.

The encryption works with an SSL/TLS certificate that belongs to your domain. That used to be a paid extra; today most hosting providers and website builders offer it free of charge, often with automatic renewal.

Why is HTTPS essential for your business?

First, there's trust. Browsers such as Chrome and Firefox show a warning like "Not secure" on pages without HTTPS, especially on forms. A visitor who sees that on an accountant's site or an online shop is quick to leave.

Second, there's Google. Since 2014, HTTPS has officially been part of the page experience signals. Google calls it a lightweight signal: it won't suddenly make a weak page strong, but not having it is an unnecessary disadvantage. Third, it's a matter of privacy and legislation. Under GDPR, anyone processing personal data must secure it appropriately, and encrypted traffic is a basic part of that.

Switching from HTTP to HTTPS

A jeweller in York has an old website that still runs on HTTP. When making the switch, things often go wrong in the details. A safe step-by-step plan:

1. Install a valid certificate for all variants of your domain, with and without www.
2. Redirect every HTTP URL with a 301 redirect to the HTTPS version of exactly the same page.
3. Update internal links, images and scripts so they point directly to HTTPS.
4. Update your canonical tags and your sitemap with the new URLs.
5. Add the HTTPS version in Google Search Console and monitor indexing.

Common mistakes

• Mixed content: the page loads over HTTPS, but an image or script still loads over HTTP. Browsers sometimes block this or show a warning.
• Expired certificate: visitors then see a full-page warning screen. Automatic renewal prevents this.
• Redirect chains: from HTTP to HTTPS, then to www, then to a new URL. One direct step is better.
• Redirecting only the homepage: every old URL should go to its own new counterpart, not to the home page.

HTTPS and AI search

AI search engines such as Perplexity or ChatGPT Search don't disclose how much weight they give to security. Even so, HTTPS is the standard for a trustworthy website today, and a site with certificate errors can be harder or even impossible for crawlers to reach. If you want to show up as a source in AI answers, first make sure every page loads securely without a hitch. It fits into the bigger picture of technical SEO: a solid foundation the rest can build on.

Not sure whether all your pages, images and redirects run correctly over HTTPS? A technical SEO analysis of your website quickly exposes mixed content and faulty redirects.