HTTPS (Hypertext Transfer Protocol Secure) is the HTTP protocol sent over an encrypted TLS connection. A URL starting with https:// tells the browser to establish that secure connection before any page data is exchanged. By default it uses port 443, while plain HTTP uses port 80.
What does HTTPS protect?
web.dev names two protections. Integrity: content cannot be changed on the way without detection, so third parties cannot inject scripts or ads. Privacy: eavesdroppers cannot read the traffic, including browsing behavior. In addition, the server proves with a certificate that it is the host the user asked for (MDN).
Some browser features, among them service workers and camera or microphone access, are only available on HTTPS pages.
HTTPS and SEO
Google announced HTTPS as a ranking signal in August 2014 and called it “a very lightweight signal” at the time. Its page experience documentation today lists “Are your pages served in a secure fashion?” as one question for self-assessment and says that, beyond Core Web Vitals, other page experience aspects don’t directly help a site rank higher. For SEO, the practical points are:
- All HTTP URLs should redirect to their HTTPS versions with a permanent redirect, and internal links, canonicals and sitemaps should use HTTPS.
- Pages should not load images, scripts or stylesheets over HTTP. Browsers block or upgrade such mixed content.
- The certificate must stay valid, since an expired certificate triggers a browser warning page.
- HSTS can make browsers use HTTPS without first requesting the HTTP URL.
Example
GET http://example.com/shoes/
→ 301 Location: https://example.com/shoes/
Common mistakes
- Mixed content. According to web.dev, a browser warns when an HTTPS page uses HTTP resources, and some browsers refuse to load or execute them, which can break the page. Intrasite links and resources should be as relative or protocol-independent as possible.
- Canonicals that still point to HTTP. web.dev advises putting a
rel="canonical"with the HTTPS address in the head of each page to tell search engines which version to use. - Enabling HSTS too early. According to web.dev, clients that know a site as an HSTS host hard-fail when its TLS configuration has an error, such as an expired certificate. HSTS should only be switched on once operations are robust.
- Forgetting blocks from the migration. For a move from HTTP to HTTPS, Google names
noindexand robots.txt blocks that were only needed during the migration as a common mistake. Sitemaps also need the new HTTPS URLs. - Redirecting to wrong targets. Google reports that people frequently redirect to non-existent URLs on the new site.
Common questions
What is the difference between HTTP and HTTPS? HTTPS adds TLS encryption and server authentication to HTTP. The HTTP messages inside the connection stay the same.
Is port 443 used for HTTPS? Yes, 443 is the default port for https URIs.
Sources
- HTTP Semantics, RFC 9110, section 4.2.2 (https URI scheme)rfc-editor.org
- Why HTTPS matters – web.devweb.dev
- Understanding page experience in Google Search results – Google Search Centraldevelopers.google.com
- HTTPS as a ranking signal – Google Search Central Blog (2014)developers.google.com
- Enable HTTPS on your servers – web.devweb.dev
- Site move with URL changes – Google Search Centraldevelopers.google.com
Last updated: