NightshiftDirect

Glossary

HTTPS

HTTPS is the secure version of the protocol web pages travel over. A site served over HTTPS uses a certificate to encrypt what passes between it and the visitor's browser. Chrome flags a site that does not use it with an info or Not secure symbol.

Also called secure connection.

By NightshiftDirect Research. Published . Updated .

What Not secure means

Chrome shows a symbol beside every web address. A site that does not use a private connection gets an info or Not secure symbol. Chrome's help page says what that means: someone may be able to view and change the information sent to and from the site. It also names the fix: the site owner has to secure the site with HTTPS (Chrome Help).

The protection comes from a certificate. Chrome secures HTTPS connections with website certificates, which encrypt the link between your site and the browser. Chrome also has a setting, Always use secure connections, that warns people before it opens a site without HTTPS (Chrome Help). Without HTTPS, the info or Not secure symbol sits beside your address while visitors decide whether to fill in your quote form.

Mixed content

A page can arrive over HTTPS and still pull in pieces over plain HTTP: an image, a video, a stylesheet or a script. web.dev calls that mixed content, and says those insecure requests weaken the security of the whole page (web.dev).

Most browsers now block it. Where an insecure image does load, most browsers show the page as not secure even though the page itself came over HTTPS. Chrome may fetch the image over HTTPS instead and leave it out when there is no secure copy, so a photo can simply vanish. Scripts over HTTP are blocked by default in most browsers (web.dev). The fix is to load every image, script and embed from an https address.

One address, not two

To Google, the http and https versions of your site are duplicates: two addresses for the same pages. When it picks which one to show, whether a page is served over HTTPS is one of the things it weighs, along with redirects and your sitemap (Google Search Central).

Choose one https address for the whole site and point the others at it with permanent redirects: the http version, and the www or bare-domain twin. T4 is the scan's check for this, and it tests both.

What HTTPS does for search

Serving pages securely is one of the questions in Google's page experience self-assessment, beside Core Web Vitals and how pages display on phones. The same page then draws a line between them. Core Web Vitals are used by its ranking systems. The other parts of page experience, secure serving among them, do not directly help a site rank higher, though they can make it more satisfying to use (Google Search Central).

If someone pitches HTTPS to you as a way up the rankings, that pitch goes further than Google does. Set it up for your visitors: no warning beside your address, and a connection that others cannot read or alter along the way.

Keeping it

Ask your host two things: whether your plan includes a certificate, and whether the host renews it for you, so it never runs out unnoticed.

Then check the address bar after any change. When you add a page or install an add-on, open a few pages and look for a Not secure label. An embed pasted with an http address is one way mixed content creeps back in.

What the free scan checks

Questions

Does my site need HTTPS if it has no forms?

Yes. Chrome's help page says that without a private connection, someone may be able to view and change what visitors get from a site, not just what they send to it (Chrome Help). On a site with no forms, that is your phone number and your prices.

Why does my browser say Not secure on only some of my pages?

Either the page opened over http, because a link or a missing redirect sent the visitor there, or it loads something over plain HTTP, such as an old image address, which is the mixed content described above. Fix the redirect, or change the http address in the page to https.

Will moving my site to HTTPS cost me visitors?

Make the move, and redirect every old address as you go. No one can promise a move with no dip at all, but a permanent redirect from each http address to its https twin leads Google to show the new addresses in its results (Google Search Central). Then update your own links, your sitemap and your Business Profile to the https address, so nothing sends people the long way round.

Where this fits in our work

We handle this as part of Web design and hosting: A fast, conversion-first website built on your own accounts, then hosted, backed up and kept current.

Related reading

Related terms

Sources