TL;DR
- Google announced HTTPS as a ranking signal in 2014, and Chrome labels HTTP pages ‘Not secure.’
- Free certificates are widely available, and most hosts install them automatically.
- After switching, redirect every http URL to https and fix mixed content.
- Hacked sites can be flagged in search results; updates, strong logins and backups prevent most compromises.
HTTPS encrypts the connection between your website and its visitors. Google announced in August 2014 that HTTPS would be a ranking signal, and Chrome began marking all HTTP pages as “Not secure” in 2018. Today, a site without HTTPS looks broken to many visitors before they read a word.
Getting HTTPS in place
- Get a certificate. Most hosts offer free certificates, often from Let’s Encrypt, and install them automatically. Check your hosting panel.
- Redirect http to https with a 301 for every URL, so links and bookmarks keep working; see redirects and site migrations.
- Update internal links, canonical tags and your sitemap to https URLs.
- Fix mixed content by loading every image, script and stylesheet over https.
- Add the https property in Search Console if you use a URL-prefix property, or use a domain property that covers both.
Quick fix: Once everything works on HTTPS, consider HSTS, a header that tells browsers to always use HTTPS for your site. Add it only after you’re sure every page and subdomain works over https.
Security beyond the certificate
HTTPS protects data in transit; it doesn’t stop your site from being hacked. Compromised small business sites often end up hosting spam pages or redirecting mobile visitors elsewhere, which can get flagged in search results.
| Habit | Why it matters |
|---|---|
| Update your CMS, themes and plugins | Most break-ins exploit known vulnerabilities in outdated software |
| Remove unused plugins and themes | Less code, fewer holes |
| Use unique passwords and two-factor login | Stolen or guessed admin passwords are a common entry point |
| Keep off-site backups | Lets you restore a clean copy quickly |
| Limit admin accounts | Fewer people with full access, fewer risks |
| Watch Search Console | The Security Issues report flags detected hacks and malware |
If you’ve been hacked
Restore from a clean backup or have the site cleaned, change every password, update everything, then request a review in Search Console’s Security Issues report. Check the page indexing report afterward for spam URLs that need to return 404 or 410.
FAQ
Do I need HTTPS if I don’t sell anything online?
Yes. Browsers warn visitors on any HTTP page, and HTTPS protects form submissions, logins and visitors’ privacy on public Wi-Fi.
What is mixed content?
An HTTPS page that loads images, scripts or styles over HTTP. Browsers may block those files or warn users, so update the links to https.
How do I know if my site was hacked?
Search Console’s Security Issues report and email alerts, odd pages showing up when you search site:yourdomain.com, and unexpected redirects on mobile are common signs.
Search engines update their systems and documentation often. This guide reflects Google’s published guidance at the time of writing; check Google Search Central for current details, and test changes on a staging copy of your site before making them live.