How to Move a Website from HTTP to HTTPS Without Losing SEO
A safe, step-by-step HTTPS switch: certificate, redirects, internal links, canonicals and Search Console.
HTTPS encrypts the connection between your visitors and your website. Browsers mark plain HTTP pages as "Not secure", many features need HTTPS, and Google uses it as a lightweight ranking signal. Moving is not difficult, but it is a site migration: every URL changes, so it needs to be done carefully.
Step 1: Install an SSL certificate
Most hosts offer free certificates (often from Let's Encrypt) in the control panel, usually with automatic renewal. Install it for both the main domain and the www version. Open https://yourdomain.com to check it loads with a padlock.
Step 2: Choose one version of your domain
Decide on one preferred address, such as https://www.example.com or https://example.com. All other versions โ HTTP, with or without www โ should redirect to it.
Step 3: Add site-wide 301 redirects
Redirect every HTTP URL to the same path on HTTPS, in a single hop. Your host may offer a "Force HTTPS" switch; otherwise a server rule handles it. Avoid chains like HTTP โ HTTPS โ www โ final page. Test a few URLs with the redirect checker โ each should show one 301 straight to the final address. Read how to fix redirect chains if you see more than one hop.
Step 4: Update what points to the old URLs
- Internal links in menus, content and footers.
- Canonical tags and hreflang tags.
- XML sitemap โ list only HTTPS URLs.
- Structured data, Open Graph tags and image URLs.
- Your profiles โ Google Business Profile, social pages, Merchant Center.
Step 5: Fix mixed content
If an HTTPS page loads an image, script or stylesheet over HTTP, browsers may block it or show a warning. Search your templates and database for http:// links to your own domain. See how to fix mixed content errors.
Step 6: Tell Google
- Add the HTTPS property in Search Console (a domain property covers both versions).
- Submit the HTTPS sitemap.
- Check robots.txt is reachable on HTTPS and does not block anything new.
The Change of Address tool is not needed for HTTP to HTTPS on the same domain.
Step 7: Monitor
Watch the Page indexing report and your traffic for a few weeks. It is normal to see old HTTP URLs listed as "Page with redirect" โ read what that status means. Keep the redirects permanently.
A worked example
A tuition centre's website still used HTTP and showed "Not secure" on its enquiry form. The owner enabled the host's free certificate and turned on forced HTTPS. They then updated the menu links and the sitemap, and replaced a few image links that still used http://. A quick redirect check confirmed one clean hop for every page. Search traffic stayed steady, and form submissions rose once the warning disappeared.
Things people forget
- Payment gateway and webhook URLs registered in third-party dashboards.
- Email templates with links and images pointing to HTTP.
- Analytics settings that list the old protocol.
- Ad landing page URLs in your ad accounts.
- Certificate renewal โ check automatic renewal is working, as an expired certificate shows a full-page browser warning.
After launch, consider HSTS once you are sure everything works over HTTPS. It tells browsers to always use the secure version, but it is hard to undo, so enable it only when you are confident.
Related guides
More free tools: browse all our free SEO tools, no sign-up needed.
Frequently asked questions
Will moving to HTTPS hurt my rankings?
Not when done with proper 301 redirects. A short period of fluctuation is possible while Google recrawls.
Does HTTPS improve rankings?
It is a small signal. The bigger benefits are trust, security and avoiding browser warnings.
Do I need a paid SSL certificate?
No. Free certificates provide the same encryption for most websites.
How long should I keep HTTP redirects?
Permanently. Old links and bookmarks will keep using HTTP addresses.