HTTPS ranking signal

Google announced HTTPS as a ranking signal in August 2014. At launch it affected fewer than 1% of global queries and carried less weight than signals like high-quality content. Google said it might strengthen the signal over time to push the web toward encryption, but in practice it stayed a tie-breaker, not a growth lever. Today Google frames HTTPS as one input to page experience (the set of signals describing how users perceive a page) rather than a standalone boost, and web.dev still calls it a “positive search quality indicator.”

What actually matters now

A valid certificate will not outrank better content, but running on HTTP can cost you. Browsers flag http:// pages as “Not secure,” which erodes trust and conversions, and Google indexes HTTPS URLs by default. The migration itself is where rankings get lost or preserved. Google’s own steps:

• Install a valid TLS certificate (2048-bit RSA key).
• 301 redirect every HTTP URL to its HTTPS twin.
• Point canonicals and internal links at the secure version.
• Add HSTS and set the Secure flag on cookies.
• Register the HTTPS property in Search Console (HTTP and HTTPS are tracked separately).

Treat HTTPS as table stakes. It is close to universal now, so the real value is avoiding the penalty of being one of the few insecure sites, not gaining an edge over secure competitors.