How to enforce HTTPS
HTTPS encrypts traffic and is a ranking signal. Every http:// request should redirect permanently to https://.
Step by step, with screenshots: ERR_SSL_PROTOCOL_ERROR: what it means and how to fix it →
Check your own site
Runs these 2 checks and the other 191, free, in about 45 seconds.
Or run only this check with the free SSL checker, the free Redirect checker or the free HTTP/2 & HTTP/3 test.
What it is
HTTPS is HTTP sent over an encrypted TLS connection, so nobody between the visitor and your server can read or change what is sent. Enforcing HTTPS means every page is served over https:// and every http:// address redirects permanently, with a 301 or 308, to its https:// version.
Browsers label plain HTTP pages "Not secure", withhold features such as geolocation and service workers from them, and Google uses HTTPS as a lightweight ranking signal. getReport checks that the final page is served over HTTPS and that the http:// address redirects to it. Your site is OK when both checks pass and your certificate is valid.
What a passing site looks like
- The site is served over HTTPSfail · −15 ptseffort M
- http:// redirects to https://fail · −8 ptseffort S
1. The site is served over HTTP, not HTTPS
Why it matters. Browsers label HTTP pages "Not secure" and Google uses HTTPS as a small ranking signal. Anyone on the network can read or alter what visitors see.
- Get a certificate (Let's Encrypt is free) and enable HTTPS on your host.
- Redirect every http:// URL to https:// with a 301.
2. http:// does not redirect to https://
Why it matters. Visitors who type your address without https, or follow an old link, land on the unencrypted page. Every one of those visits can be read or altered on the network.
- Redirect every http:// URL to the same path on https:// with a 301.
- nginx: return 301 https://$host$request_uri; Apache: RewriteRule in .htaccess; most hosts and Cloudflare have a "Always use HTTPS" switch.
Questions people ask
What is the difference between HTTP and HTTPS?
HTTPS is HTTP with encryption. With HTTP, everything travels as plain text, so anyone on the same Wi-Fi or network path can read form entries and change pages in transit. HTTPS encrypts the connection with TLS and proves, through a certificate, that the visitor reached your real server. The address starts with https:// and browsers show no "Not secure" warning.
Does HTTPS affect SEO?
Yes, a little. Google has used HTTPS as a lightweight ranking signal since 2014, and when both versions of a page exist it prefers to index the https:// URL. The bigger effects are indirect: "Not secure" warnings put visitors off, and links from HTTPS sites to HTTP pages pass no referrer, so your analytics lose the source. Redirect every http:// URL to its https:// version with a 301.
Is it safe to use a website without HTTPS?
For reading public information the risk is small; for anything you type in, it is not safe. On an HTTP page, logins, contact forms and payment details can be read by anyone on the network path, and the page itself can be altered, for example to inject ads or malware. That is why browsers mark HTTP pages "Not secure", especially when they contain forms.