Earlier this month Google announced that it has started using HTTPS as a ranking signal. In plain words, a website that loads over a secure, encrypted connection, the kind with a padlock in the browser’s address bar, may now get a small boost in Google’s search results compared with an otherwise similar site that does not.
Since then, a few clients have called us worried that their website is about to drop. Others have been told by a hosting company that they must buy an SSL certificate right away. Neither reaction is quite right. Here are the questions we have been answering, in the order people usually ask them.
What exactly did Google say?
Google said it had been testing whether secure connections should count in its ranking algorithms and was happy with the results. It described the HTTPS ranking signal as very lightweight for now, affecting fewer than 1% of searches worldwide and carrying less weight than things like high-quality content. It also said it may make the signal stronger over time, because it wants website owners to move to HTTPS.
So for today, this is not a big shift. Good content, a fast and mobile-friendly site, and accurate local listings matter far more. But the direction is clear, and it is not going to reverse.
What is HTTPS, in simple terms?
When someone visits a normal website over HTTP, the information passing between their browser and your server travels as plain text. Anyone in between, for example on a shared office or café Wi-Fi network, could in theory read or tamper with it. HTTPS encrypts that connection. It is what banks, Gmail and payment pages have used for years.
To use HTTPS, your website needs an SSL certificate, which is installed on your hosting server. Once it is set up, your address changes from http:// to https:// and visitors see the padlock.
Security has been in the news a lot this year. The Heartbleed bug in April, which affected widely used encryption software on servers, made many people aware of this for the first time. Google’s announcement adds a search reason on top of the security one.
Will my site lose rankings if I don’t switch?
Not in any way you are likely to notice right now. For a typical small business site, such as a clinic, a coaching centre, a restaurant or a manufacturer’s brochure site, the content, the local listings and the links pointing to it matter much more.
That said, if you are already planning a redesign or a move to new hosting, this is the right time to add HTTPS. Doing it later as a separate job means going through the move twice.
Which sites should switch soon?
We would put these at the top of the list, mostly for security reasons rather than rankings:
- Online stores, including ones that send customers to a payment gateway for checkout.
- Sites where users log in, such as student or parent portals.
- Sites with enquiry or admission forms that collect phone numbers, addresses or other personal details.
- Clinics and hospitals that ask for any health information through a form.
A note for online stores: many have SSL only on the checkout pages. Google has explained that the signal is applied page by page, so only the secure pages benefit. If you want the whole site to count, the whole site needs to run on HTTPS.
What does a certificate cost?
It depends on the type. A basic domain-validated certificate, which simply confirms you control the domain, is the cheapest and is enough for most small business sites. Organisation-validated and extended-validation certificates involve checks on your company and cost more. Extended validation is the one that shows your company name in green in some browsers. Most small businesses do not need it.
Prices vary between sellers and hosting companies, and they change, so we compare current offers for each client rather than quoting a single figure. Google’s own advice is to use a 2048-bit key certificate, which any reputable provider will offer.
There can be hidden costs. On some older shared hosting plans, installing a certificate requires a dedicated IP address, which is an extra monthly charge. Some cheap plans do not support custom SSL at all, in which case you may need to upgrade your hosting. Ask your host before you buy anything.
How do we switch a WordPress site safely?
The move itself is not complicated, but it is easy to get small details wrong. This is the checklist we follow:
- Take a full backup of the files and the database first.
- Buy the certificate and have it installed on the hosting account. Check that https:// loads the site correctly before changing anything else.
- In WordPress, go to Settings, then General, and change both the WordPress Address and Site Address to https://.
- Update old internal links and image addresses in the database from http:// to https://, using a proper search-and-replace tool rather than editing by hand.
- Set up permanent 301 redirects so every old http:// address sends visitors and Google to the matching https:// page.
- Look for “mixed content”, meaning images, scripts or fonts still loading over http://. Browsers show warnings or a broken padlock when this happens. Old themes and plugins are the usual culprits.
- Add the https:// version of the site as a new site in Google Webmaster Tools, because it treats it as separate, and submit the updated sitemap there.
- Change the default URL in Google Analytics to https://.
- Update the website address on your Facebook page, Google listing, directories and printed material when you next reprint.
Expect some small movement in rankings for a few weeks while Google recrawls the site. With proper redirects, it normally settles.
Anything to watch out for?
A few things. Visitors using very old browsers, such as Internet Explorer on Windows XP, may see warnings on some shared-hosting setups because of how the certificate is served. If many of your customers use old office computers, test on one before you switch.
Also, do not let anyone block the HTTPS version in robots.txt or mark it noindex by mistake. It sounds unlikely, but it happens during migrations, and it can quietly remove a site from Google.
Our view
HTTPS is worth doing for most sites, and essential for sites that handle payments or personal details. It is not an emergency for a small brochure site, and it will not rescue a website with weak content. Plan it properly, ideally alongside your next round of website work, and do it once, carefully.
If you would like us to check whether your hosting supports it and what it would involve for your site, send us your website address and we will tell you honestly whether it is worth doing now.
