01What Google has actually said, and what it has not
Google's Search Central blog has a post titled HTTPS as a ranking signal, dated August 2014. In that announcement Google called HTTPS a "very lightweight signal", said it affected "fewer than 1% of global queries" and carried "less weight than other signals such as high-quality content". That is Google's own 2014 wording, not a promise of a jump in position. More recent guidance points the same way. Google's web.dev guide on HTTPS says Google uses HTTPS as a positive search quality indicator. Its page experience documentation asks whether your pages are served in a secure fashion, then says that beyond Core Web Vitals, other page experience aspects do not directly help a site rank higher. Our reading: the padlock is expected, and nothing we read promises a jump in position for adding it.
- August 2014: Google's announcement HTTPS as a ranking signal called it a "very lightweight signal" affecting fewer than 1% of global queries
- web.dev: Google uses HTTPS as a positive search quality indicator
- Page experience docs: beyond Core Web Vitals, other aspects do not directly help you rank higher
- No source we read promises a position for adding a certificate
02Where a missing padlock really costs you
The damage lands in front of the visitor, not in a ranking table. Chrome labels plain HTTP pages Not secure, and its help page suggests not entering private or personal information on pages marked Not secure or Dangerous. Your contact form is exactly that: a name, a phone number, a message. A full-page warning such as Your connection is not private is worse, because the visitor has to choose to continue at all. We have no figure for how many visitors turn back, and we will not quote one from memory. If you are unsure which of your pages are served securely, the Search Console HTTPS report shows it and tells you what to fix.
- A contact form on a page marked Not secure asks visitors to ignore the label
- A full-page certificate warning stops the visit before the page loads
- No figure for how many visitors turn back: we do not publish one
- Search Console HTTPS report: which pages are served securely, and what to fix
03Moving from HTTP to HTTPS without losing what you have
If your site still runs on plain HTTP, the move is a migration, and it can go wrong. Google's web.dev guide says to use a 301 redirect to signal that the HTTPS version is the canonical one, and to point a canonical link at the HTTPS address. Update internal links and the sitemap to the HTTPS addresses, and fix mixed content, because a secure page that loads an image or script over HTTP can trigger warnings or broken elements. Leave HSTS for last. The same guide says not to enable it until you are certain you will never deploy HTTPS with certificate validation errors, since browsers can then refuse to load the site. Our post on moving a website without losing Google rankings covers the wider case.
- 301 redirect from every HTTP address to its HTTPS twin
- A canonical link on each page pointing at the HTTPS address
- Internal links, sitemap and images all moved to HTTPS
- HSTS last, only once certificate errors cannot happen
04Where PROOF48 is the wrong choice
If the only thing missing is the padlock, you do not need an SEO plan. Ask your hosting provider whether a certificate is included and how to switch it on. PROOF48's FOUND plan costs 297 EUR a month and starts with a technical audit of crawlability, duplicate titles, canonical tags, sitemap format and Core Web Vitals, so buying it just to get HTTPS is the wrong purchase. The Lite maintenance plan, at 27 EUR a month, lists managed hosting and SSL, and Plus and VIP include everything in Lite. Our 48-hour website lists hosting and SSL as handled. Nobody controls a Google position, and we promise none. A store is 2,500 to 4,500 EUR on its own timeline, not the 48-hour offer.
- Only the padlock is missing: ask your hosting provider, no SEO plan needed
- FOUND, 297 EUR a month: a technical audit first, wrong buy for HTTPS alone
- The Lite maintenance plan, 27 EUR a month, lists managed hosting and SSL; Plus and VIP include everything in Lite
- No Google position promised by us or by anyone
A move where every old address had to point to the new one
SCP Shine & Style is a beauty salon in Sector 3, Bucharest. It already had a WordPress site, and we rebuilt it and redirected every old URL with a 301 so nothing already indexed broke. The case study does not say that move involved HTTP to HTTPS, and we do not claim it did. It shows the same discipline a protocol change needs: old addresses pointing permanently to new ones. We do not publish the salon's ranking or traffic figures, because we do not measure them.
See the build: SCP Shine & StyleQuestions, answered
Is HTTPS a Google ranking factor?
Google announced it as a ranking signal in August 2014 and its web.dev guide calls it a positive search quality indicator. Its current page experience documentation says that beyond Core Web Vitals, other aspects do not directly help you rank higher. Treat it as a baseline.
Will moving to HTTPS hurt my rankings?
Done with 301 redirects, canonical links and updated internal links and sitemap, it follows Google's guidance. Done carelessly, old addresses can stop pointing anywhere. We have no figure for how often a move goes wrong.
Does the padlock mean a business is trustworthy?
No. It means the connection between the browser and the site is encrypted. It says nothing about the business behind the site.
Do I need to do anything for HTTPS on a PROOF48 site?
Our 48-hour website page lists hosting and SSL as handled, so the certificate is part of that work and the padlock alone is not an SEO job. The Lite maintenance plan lists managed hosting and SSL, and Plus and VIP include everything in Lite. A store is a separate scope and price.
Where PROOF48 fits
Google calls HTTPS a positive quality indicator, but its current guidance says other page experience aspects beyond Core Web Vitals do not directly help you rank higher. Have the padlock because browsers warn visitors without it, and move to it with 301 redirects and canonical links. PROOF48's 48-hour website lists hosting and SSL as handled, and we promise no Google position.
Cosmin Tiu · Founder, PROOF48
Cosmin has worked in online marketing and software development since 2018, and has built with AI every day since January 2023. He still writes code from scratch daily, in Python, React, Rust and C#. PROOF48 ships business websites in 48 hours and invoices afterwards, so every opinion on this blog was paid for in real builds, not in theory.