HTTPS

HTTPS protects the connection, not the site. It stops anyone on the same café network or along the route from seeing passwords, form contents or which pages on a site someone reads (the name of the site itself stays visible), and it stops them injecting content into the page. It does not stop a hacked site from serving malware or a scam site from collecting card numbers. The SSL/TLS certificate is the part that makes HTTPS work.

Browsers treat HTTPS as the default. Pages loaded over plain HTTP are labelled "Not secure" in Chrome, which can also show a full-page warning before opening them through its Always Use Secure Connections setting; other browsers show similar warnings, and many browser features, from location access to faster protocol versions, only work over HTTPS.

How it works

When a browser opens an https address, it connects to the server, normally on port 443, and starts a TLS handshake. The server sends its certificate, the browser checks it, and both sides use public-key cryptography to agree on a shared secret key without ever sending it in readable form. Everything after that, the request, the page, the cookies and form data, travels encrypted with that key.

A site serving HTTPS should also send every plain HTTP request to the secure version with a 301 redirect, so old links and typed addresses end up on the encrypted page. An extra header called HSTS tells browsers to use HTTPS for the domain automatically on future visits, which closes the gap before the redirect.

The most common leftover problem is mixed content: an HTTPS page that still loads an image, script or font over plain HTTP. Browsers block or warn about these resources, which can break parts of the page or stop the browser treating the page as fully secure. They usually come from hard-coded old addresses in the content or theme.

Example

An events association moves its old site to HTTPS. The certificate installs in minutes, but the browser still flags the programme page as not fully secure, because the speakers' photos were inserted years ago with http addresses. A search-and-replace of the database updates them, and the developer adds a site-wide 301 redirect from HTTP to HTTPS plus an HSTS header.

The association then checks in Google Search Console that the HTTPS version is the one being indexed, updates the website address in its Google Business Profile and social profiles, and confirms with an online redirect checker that every old address now reaches the secure page in a single step.

Why it matters for your business

HTTPS is a baseline, not a selling point. Without it, visitors see warnings, contact forms send data unprotected and some browser features stop working. Google has confirmed HTTPS as a ranking signal, though a light one; the larger cost of skipping it is lost trust. Since certificates are typically free and hosts automate them, the only real work is the migration: redirects, mixed content and updating the address everywhere it is listed. For a typical small site, the whole switch is an afternoon's work. Plan it for a quiet week, keep a list of the old addresses so every one can be tested afterwards, and expect Search Console to take some days to reflect the switch fully.

Common mistakes

• Installing a certificate but not redirecting HTTP to HTTPS, leaving two versions of every page.
• Leaving hard-coded http links to images and scripts, causing mixed content warnings.
• Forgetting to update the site address in analytics, Search Console and business listings.
• Chaining redirects, for example http to https and then to www, instead of going straight to the final address.

Questions people ask

Is HTTPS necessary if my site does not take payments?

Yes. HTTPS protects contact forms, logins and even which pages someone reads, and browsers mark plain HTTP pages as not secure regardless of what they contain. It is also expected by search engines and many browser features. With free certificates, there is little reason to run without it.

Does HTTPS make my website secure?

Only the connection. HTTPS encrypts data in transit so it cannot be read or changed along the way. It does nothing about outdated plugins, weak passwords or malware on the server, which are separate risks that need updates, backups and good access control.

Does switching to HTTPS affect SEO?

Done correctly, the effect is neutral or slightly positive, since HTTPS is a light ranking signal. The risk is in the migration: missing redirects, mixed content or blocked resources can cause temporary drops. Use permanent redirects, update internal links and monitor Search Console afterwards.