SEO Course #5: From HTTP to HTTPS

In the previous section of the course, we established that HTTPS is one of the most important domain-level SEO optimization factors. Back in 2014, Google announced that it would take into account whether a website uses a secure (HTTPS) or insecure (HTTP) protocol, giving a slight ranking advantage in search results to sites using the secure protocol. This is precisely why this topic deserves a closer look.

What is HTTPS?

HTTPS is a more secure version of the HTTP protocol, characterized by the following features:

• Encryption - data exchange is encrypted to protect it from unwanted third parties. This means that while a user browses the website, no one can track their actions or steal information.
• Data integrity - data cannot be modified or corrupted during transmission.
• Authentication - confirms that users are accessing the intended website, protecting against attacks and increasing user trust.

Does HTTPS Really Protect Against Everything?

Many experts point out that HTTPS is often positioned incorrectly to website owners, falsely creating a sense of total security. Of course, data is encrypted as mentioned above, but this alone does not protect a website from hacker attacks. Owners of HTTPS websites must continue to take care of website security and regular maintenance.

On the other hand, around 2016-2017, the lack of HTTPS was barely felt; yes, most websites transitioned to this solution, but for many, it felt like a large and seemingly unnecessary headache. Various services and hosting companies made the migration process much easier, triggering a mass migration from HTTP to HTTPS.

This was also rapidly driven by web browsers, which began issuing increasingly active and alarming warnings to visitors about to access "insecure" HTTP websites. Many have undoubtedly seen this warning, which can have a devastating impact on website traffic.

Migration to HTTPS

For new websites, using the HTTPS protocol is absolute and unquestionable. While four years ago one might have weighed what kind of data was being collected and whether the site was just a corporate business card (no HTTPS needed!) or an e-commerce platform (HTTPS needed!), today it is clear that

ANY WEBSITE NEEDS THE HTTPS PROTOCOL AND NOT JUST BECAUSE OF SEO!

Existing websites without HTTPS must first resolve all technical issues on the site and perform maintenance, handled by a web development specialist or partner company.

Keep in mind that absolutely everything must be moved to HTTPS - all pages, images, files, CSS, and Javascript. All internal redirects created on the site must also be converted to point to the HTTPS version. Canonical tags left pointing to the non-secure version will cause serious SEO issues immediately after migration. Additionally, manually created internal links between pages must not be forgotten. The robots.txt file and sitemap must be updated if this does not happen automatically.

Remember to redirect the entire HTTP version to HTTPS so that two duplicate website versions do not remain - another typical and very severe SEO mistake. Also, the HTTPS version specifically must be added to your Search Console account. However, with so many warnings present today (from browsers and SEO tools alike), failing to notice this problem, ignoring it, or failing to consult specialists is becoming an increasingly rare occurrence.

Common Mistakes When Implementing HTTPS

Finally, let us look at the most common mistakes made when implementing and maintaining the HTTPS protocol:

1. Not all pages use secure HTTPS - during migration to the new HTTPS version, not all website sections or specific solutions (such as customer profiles located on another subdomain) were transferred.
2. Not all elements use HTTPS - individual website elements (images, links, scripts) were forgotten during migration.
3. Internal links on the new HTTPS version point to the old HTTP version.
4. Sitemap - links from the old HTTP version were left in place.
5. Canonical error - forgetting to update the canonical tag to the HTTPS version.
6. SSL certificate expiration.
7. SSL certificate registered to the wrong domain name.