HTTPS, Security Headers and Why They Affect SEO
HTTPS stopped being a ranking advantage years ago and became a requirement. The interesting question is what else about security quietly affects whether you rank at all.
HTTPS is a confirmed but very small ranking signal — its real importance is that browsers mark HTTP sites as insecure, which destroys conversion. The larger SEO risk is a compromised site, which can be deindexed or flagged with a warning that removes essentially all organic traffic.
HTTPS Is a Baseline, Not an Advantage
Google confirmed HTTPS as a lightweight ranking signal over a decade ago. Because nearly every site now has it, having it confers no advantage — but lacking it is conspicuous, and the browser penalty is far harsher than the search one.
Modern browsers display a "Not secure" warning on HTTP pages, prominently, next to the address. Visitors who would not describe themselves as technical still understand that warning perfectly well, and forms on such pages get abandoned. The conversion cost dwarfs any ranking consideration.
Certificates are free and automated, so there is no remaining cost argument. Any site still on HTTP is either abandoned or has a migration nobody completed.
The migration itself deserves care, since it changes every URL on the site. Redirect every HTTP URL to its HTTPS equivalent permanently, update internal links and canonical tags to the new scheme, and add both properties in Search Console so you can watch the transition rather than infer it.
Mixed Content, the Usual Leftover
A site can hold a valid certificate and still show as insecure because individual resources load over HTTP. This is the most common post-migration problem and it is entirely fixable.
What it is
The page loads over HTTPS but pulls an image, script or stylesheet over HTTP. Browsers either block the resource or downgrade the security indicator, depending on the type. Either outcome undermines the migration.
Where it usually hides
Hardcoded absolute URLs in old content, image sources in a database, embedded third-party widgets, and stylesheets referencing HTTP fonts. Content written before the migration is the usual source.
How to find it
The browser console reports mixed content warnings on every affected page. A site-wide crawl finds them in bulk, which matters because the problem is usually spread across old content rather than concentrated in the template.
How to fix it
Update the references to HTTPS, or use protocol-relative paths where the resource supports both. For content stored in a database, a careful search and replace across the content table is the standard approach.
Security Headers Worth Setting
These do not directly affect rankings. They reduce the chance of the compromise that would, and several are checked by security scanners your clients may run.
| What it does | Why it matters | |
|---|---|---|
| Strict-Transport-Security | Forces browsers to use HTTPS for future visits | Closes the window where a first request goes over HTTP and can be intercepted |
| Content-Security-Policy | Restricts which sources can load scripts and styles | The strongest single defence against injected scripts, which is how most site compromises monetise |
| X-Content-Type-Options | Stops browsers guessing a file's type | Prevents an uploaded file being executed as something it is not |
| X-Frame-Options | Controls who can embed your pages in a frame | Blocks clickjacking, where your UI is overlaid invisibly |
| Referrer-Policy | Controls what referrer data leaves your site | Prevents internal URLs and parameters leaking to third parties |
What Actually Costs You Rankings
The real SEO risk is not a missing header. It is a compromised site, where the damage is fast, severe and considerably harder to reverse than it was to prevent.
A hacked site typically gets used to host spam pages or inject links, and Google's response is proportionate: a warning label in results, a browser interstitial, or removal from the index. Any of these removes essentially all organic traffic within days.
Recovery is slower than the compromise. You have to find and remove everything the attacker added — which frequently includes backdoors specifically designed to survive the obvious cleanup — then request a review and wait. Sites regularly take weeks to return, and the ranking recovery lags the reinstatement.
Prevention is ordinary maintenance: keep the platform and plugins updated, remove what you do not use, use strong unique credentials with two-factor authentication, and keep backups you have actually tested restoring. This is unglamorous and it is the whole answer.
Common Questions
What people ask about HTTPS and security.
Will moving to HTTPS hurt my rankings?
Done properly, no. It is a site-wide URL change, so expect a brief settling period. Redirect every URL permanently, update internal links and canonicals, and add the HTTPS property in Search Console. Done carelessly, it has the same risks as any migration.
Do I need an expensive certificate?
No. A free automated certificate provides identical encryption to a paid one. Paid certificates offer organisational validation and warranties, which matter for some businesses and make no difference to browsers or to search.
Do security headers affect rankings directly?
No. They reduce the probability of the compromise that would devastate your rankings, which is a different and better argument for setting them.
How do I know if my site is hacked?
Search Console reports security issues directly, and enabling email alerts means you hear about it early. Other signs: unfamiliar pages in a site: search, sudden traffic from unrelated queries, or visitors reporting redirects you cannot reproduce.