HTTPS (Hypertext Transfer Protocol Secure) is the encrypted version of HTTP, the protocol browsers use to load websites. MDN's HTTPS definition explains that it "uses TLS to encrypt all communication between a client and a server." You can spot it by the https:// at the start of a URL.
For businesses, HTTPS is no longer optional. It protects visitors' data, it's a confirmed if small Google ranking signal, and browsers increasingly warn people before they open sites without it. A site still on plain HTTP risks looking untrustworthy before anyone reads a word.
What is HTTPS?
When a site uses HTTPS, the browser and server set up an encrypted connection using TLS (Transport Layer Security), the successor to the older SSL protocol. That's why many people still call website certificates "SSL certificates." The certificate helps prove the site is the one it claims to be, and the encryption keeps data private and protected from tampering in transit.
HTTPS protects three things:
- Privacy: others on the network can't read what's being sent, like form entries or login details.
- Integrity: no one can quietly alter the page on its way to the visitor, for example by injecting ads or malware.
- Authentication: visitors can be confident they've reached the real site for that domain.
Adoption is now near universal. Google's HTTPS by default announcement from October 2025 says HTTPS use in Chrome navigations rose from about 30 to 45% in 2015 to roughly 95 to 99% around 2020, and has leveled off since.
Why HTTPS matters
It's a Google ranking signal. Google announced in August 2014 that it was starting to use HTTPS as a ranking signal. At the time, Google said it was "only a very lightweight signal," affecting fewer than 1% of global queries, as 9to5Google reported. Search Console's HTTPS report also notes that Google prefers to index the HTTPS version when a page is available over both.
Browsers flag HTTP sites. Since Chrome 68 in July 2018, Chrome has marked all HTTP sites as "not secure". Google also announced that starting with Chrome 154, scheduled for October 2026, Chrome would turn on "Always Use Secure Connections" by default, warning users before they first access a public site over plain HTTP.
It protects trust and conversions. A browser warning before your page loads is a poor first impression, especially on forms, checkouts and logins. That's also true for visitors arriving from AI answers, who may be meeting your brand for the first time.
How HTTPS works
Certificates
To serve HTTPS, a site needs a TLS certificate issued by a certificate authority that browsers trust. Many hosting platforms and CDNs now issue and renew certificates automatically. Certificates expire, so renewal needs to be automated or carefully tracked.
The handshake
When a browser connects, it and the server perform a TLS handshake. The server presents its certificate, the browser checks it, and the two agree on encryption keys. After that, requests and responses travel encrypted.
Redirects and canonicals
For search, the goal is making HTTPS the only version anyone sees. Google's site move guidance treats a switch from HTTP to HTTPS as a site move with URL changes. It recommends mapping old URLs to new ones, using server-side permanent redirects such as 301s, and updating canonical tags, internal links and sitemaps. Google notes that 301 and other permanent redirects don't cause a loss in PageRank, and that you don't need the Change of Address tool for HTTP to HTTPS moves.
How to keep your HTTPS setup clean
- Redirect every HTTP URL. Each HTTP address should permanently redirect to its HTTPS equivalent, ideally in a single hop rather than a chain.
- Point canonicals to HTTPS. Canonical tags, hreflang annotations and structured data should all use HTTPS URLs.
- Update internal links and sitemaps. Don't make crawlers rely on redirects for your own links, and make sure your XML sitemap lists HTTPS URLs only.
- Fix mixed content. Images, scripts or stylesheets loaded over HTTP on an HTTPS page can trigger browser warnings or be blocked.
- Check the HTTPS report. Search Console's report shows how many indexed URLs are HTTP versus HTTPS, and flags reasons like an invalid certificate, an HTTP canonical or a sitemap pointing to HTTP.
- Monitor certificate expiry. An expired certificate triggers a full-page browser warning. Make sure renewal is automated and someone gets alerts.
- Verify both versions in Search Console. Google's site move guidance says to include both the HTTPS and HTTP variants when you verify your site.
Common mistakes and misconceptions
"HTTPS only matters if we take payments." Browsers flag HTTP on any page, and every site benefits from the privacy and integrity HTTPS provides.
"Switching to HTTPS will boost our rankings." Google described it as a lightweight signal. It's a baseline expectation, not a growth tactic.
"The padlock means the site is safe." HTTPS means the connection is encrypted and the domain has a valid certificate. It doesn't mean the business behind it is trustworthy, and phishing sites can use HTTPS too.
"Once it's set up, we're done." Certificates expire, new pages can introduce mixed content, and redesigns can bring back HTTP links. Check periodically.
HTTPS vs. HTTP
HTTP sends data in plain text, so anyone on the network path can read or change it. HTTPS encrypts it. Google's HTTPS by default post explains that on an HTTP connection, an attacker can redirect a navigation and load attacker-controlled content, which can lead to malware or social engineering. For search, Google prefers the HTTPS version of a page. For visitors, browsers increasingly warn about HTTP.
How Butter approaches HTTPS
At Butter, we treat HTTPS as part of the same technical basics as HTTP status codes and redirects, because they tell us what crawlers actually experience. Because AI crawlers and search engines both rely on clean URLs, tidy redirects support GEO as much as traditional SEO. On our GEO+SEO plan, fixing broken links and crawl issues is part of the monthly work, and that often means cleaning up redirect chains and pointing old URLs at the right new pages.
Certificate setup and server configuration usually sit with your hosting provider or developers. When we find related problems, like HTTP canonicals, sitemaps that list HTTP URLs or chained redirects, we fix or flag them as part of our technical work. You can compare what each plan covers on our pricing page.
Frequently asked questions
Is HTTPS a Google ranking factor?
Yes, but a small one. Google announced in 2014 that it uses HTTPS as a ranking signal and described it as very lightweight. Google also prefers to index the HTTPS version of a page when both versions exist.
What is the difference between SSL and TLS?
TLS is the modern successor to SSL, the original protocol for encrypting web connections. Websites today use TLS, but the older name stuck, so many people still say SSL certificate when they mean a TLS certificate.
Will switching from HTTP to HTTPS hurt my SEO?
It shouldn't if it's done carefully. Google treats it as a site move: map every old URL, use permanent server-side redirects, and update canonicals, internal links and sitemaps. Google says 301 and other permanent redirects don't cause a loss in PageRank.
What does Chrome show for sites without HTTPS?
Chrome has marked HTTP sites as not secure since 2018. Google also announced that Chrome 154, scheduled for October 2026, would enable Always Use Secure Connections by default, showing a warning before users first visit a public site over HTTP.