HTTPS and SEO: Why SSL Certificates Still Matter for Rankings

Most sites migrated to HTTPS years ago. But having an SSL certificate installed is not the same as having HTTPS configured correctly. Four categories of SSL misconfiguration — mixed content, redirect chains, HSTS gaps, and certificate errors — silently drain rankings on sites that believe their HTTPS migration is complete.

A 2023 Semrush study of 300,000 websites found that 45.8% of HTTPS sites had at least one SSL-related issue affecting crawlability or indexation. The padlock icon in the browser bar masks problems that Google still penalizes. If you haven't audited your SSL setup since the original migration, the damage may already be accumulating.

The four problems below are ordered by how frequently they appear in site audits. Each one costs rankings through a different mechanism, and each requires a different fix.

Mixed Content Bleeds Authority From Every Insecure Resource

Mixed content happens when an HTTPS page loads images, scripts, or stylesheets over plain HTTP. Browsers handle this in two ways: "active" mixed content (scripts, iframes) gets blocked entirely, and "passive" mixed content (images, video) triggers a warning that downgrades the padlock icon. Either outcome signals to Google that the page has security problems.

The frequency is striking. A 2022 W3Techs survey reported that roughly 30% of HTTPS websites contained at least one mixed content element. When the UK's National Health Service (NHS) migrated nhs.uk to HTTPS in 2019, their post-migration audit found mixed content on over 3,000 pages — mostly hardcoded HTTP image URLs in legacy CMS templates. After fixing them, they reported a measurable improvement in page indexation rates across the affected sections.

Common sources of mixed content:

• Hardcoded http:// image URLs stored in database content (CMS posts, product descriptions)
• Third-party widgets and ad scripts still served over HTTP
• CDN configurations that default to HTTP origin pulls
• Legacy CSS files referencing http:// font or background-image URLs

To find mixed content, open Chrome DevTools, go to Console, and filter for "Mixed Content." For a site-wide scan, use a crawler and flag any resource URL starting with http:// on pages served over HTTPS. Fix by updating resource URLs to HTTPS, using relative paths, or running a database search-and-replace for http://yourdomain.com to https://yourdomain.com in stored content. On WordPress sites, plugins like Better Search Replace can handle this in bulk. For other CMS platforms, a SQL query against the content tables is typically the fastest approach. Audit tools that generate the corrected resource URLs per page save hours of manual search-and-replace — see a sample fix.

Redirect Chains Leak Link Equity at Every Hop

After an HTTP-to-HTTPS migration, the correct setup is a single 301 redirect: http://example.com → https://example.com. What happens in practice is often a chain:

http://example.com → http://www.example.com → https://www.example.com → https://example.com

Each hop loses an estimated 10-15% of link equity based on PageRank damping. A four-hop chain means roughly 40% of inbound link value never reaches the destination page. Google's John Mueller confirmed in a 2018 webmaster hangout that while Googlebot follows redirect chains, "there is some loss of signals through redirects," and he recommended minimizing hops.

Wayfair's engineering team documented their experience during a large-scale HTTPS migration in a 2019 engineering blog post. They discovered redirect chains averaging 3-4 hops across their product catalog and traced a measurable drop in PageRank flow to key category pages. After flattening chains to single-hop 301s, they recovered the lost link equity within one crawl cycle.

Audit for redirect chains by crawling your site and flagging any URL that passes through more than one redirect before reaching the final destination. Use a tool like Screaming Frog's redirect chain report or check individual URLs with httpstatus.io. Pay attention to:

• HTTP → HTTPS redirects that also change www/non-www, creating two hops instead of one
• Old vanity URLs that redirect through multiple intermediate pages
• Trailing-slash and case normalization rules that stack with protocol redirects

The fix is straightforward: update your server configuration so that every HTTP URL redirects to its final HTTPS canonical in a single 301. If you use both www and non-www, pick one as canonical and redirect everything else to it in one hop. Test after each change — stacking multiple rewrite rules in .htaccess or nginx config is the most common way chains get re-introduced.

Missing HSTS Headers Add Latency That Compounds Across Every Visit

HTTP Strict Transport Security (HSTS) tells browsers to skip the HTTP version entirely and go straight to HTTPS. Without it, every first visit from a new browser session starts with an HTTP request that gets 301-redirected to HTTPS — adding 100-300ms of latency before the page even begins loading.

That latency adds up. A 2017 Akamai study found that a 100ms delay in load time decreased conversion rates by 7%. For SEO, Google's Core Web Vitals specifically penalize slow time-to-first-byte (TTFB), and an unnecessary redirect is pure wasted TTFB.

Scott Helme's 2023 analysis of the Alexa Top 1 Million domains found that only about 25% of HTTPS sites had a valid HSTS header. Among those that did, many used a max-age value under 6 months — too short for the HSTS preload list and weak enough that browsers reset the policy between infrequent visits.

The recommended HSTS configuration:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Once you set this header and verify it works across all subdomains, submit your domain to hstspreload.org for inclusion in the browser preload list. Preloaded domains never make an HTTP request at all — the browser knows to use HTTPS before the first connection, eliminating redirect latency permanently.

Certificate Errors Block Crawling and Kill Trust Instantly

An expired or misconfigured SSL certificate is the most damaging HTTPS problem because it does not degrade gradually — it produces a full-page browser interstitial that stops all organic traffic cold. Googlebot also stops crawling pages behind invalid certificates.

In September 2021, Let's Encrypt's DST Root CA X3 certificate expired, affecting millions of websites that relied on older certificate chains. Sites running outdated server configurations suddenly showed certificate warnings to visitors on older devices and operating systems. The event exposed how many site owners treated SSL certificates as "set and forget" — they had auto-renewal in place for the leaf certificate but never updated their intermediate chain.

Common certificate misconfigurations beyond expiration:

• Name mismatch — the certificate covers www.example.com but not example.com, or vice versa
• Incomplete chain — intermediate certificates are missing, causing validation failures on certain browsers and devices
• Weak protocol — TLS 1.0 and 1.1 are deprecated; servers still offering them may trigger browser warnings

Test your certificate configuration at SSL Labs (ssllabs.com/ssltest). An A rating means the certificate, chain, protocol, and cipher suite are all correctly configured. Anything below B requires immediate attention. Set a calendar reminder 30 days before certificate expiration, or better yet, use a certificate monitoring service that sends automated alerts. Auto-renewal through Let's Encrypt or your hosting provider handles the leaf certificate, but you still need to verify the intermediate chain after each renewal.

The four issues above account for the vast majority of HTTPS-related ranking problems — they form the security layer of a full technical SEO audit. Use the checklist below to audit each one systematically:

Check	Pass Criteria	Tool
SSL certificate valid	Not expired, correct domain, complete chain	SSL Labs, browser DevTools
TLS version	TLS 1.2+ only (1.0 and 1.1 deprecated)	SSL Labs server test
No mixed content	Zero HTTP resources on HTTPS pages	Chrome DevTools, crawl tool
Single-hop redirects	HTTP → HTTPS in one redirect, no chains	Redirect checker, crawl tool
HSTS configured	max-age ≥ 31536000, includeSubDomains	Security headers check
Canonical tags use HTTPS	All canonical URLs start with https://	Crawl tool, manual check
Sitemap URLs use HTTPS	Every URL in sitemap.xml starts with https://	Read sitemap directly
Internal links use HTTPS	No internal links pointing to HTTP versions	Crawl tool
HTTPS in Search Console	HTTPS property verified, not just HTTP	Google Search Console

MendMySEO checks SSL configuration, mixed content, redirect chains, HSTS headers, and canonical consistency as part of every technical audit — with paste-ready fixes for each issue found. Start your 14-day free trial — cancel anytime.

Frequently Asked Questions

Does fixing HTTPS issues produce a ranking lift or just prevent losses?

Both, depending on the issue. Fixing mixed content and redirect chains recovers link equity that was being lost — sites typically see the affected pages climb within 2-4 weeks after a full crawl cycle. HSTS improvements primarily affect page speed metrics (TTFB), which feed into Core Web Vitals scores. Certificate fixes are binary: a broken cert means zero organic traffic; fixing it restores what you had before.

How do I check if my SSL certificate is correctly configured?

Run your domain through SSL Labs' free server test at ssllabs.com/ssltest. It grades certificate validity, chain completeness, TLS version support, cipher strength, and known vulnerabilities. Aim for an A or A+ rating. If you score below B, prioritize fixing the flagged items — incomplete certificate chains and TLS 1.0/1.1 support are the most common causes of low scores.

Can HTTPS actually make my site faster than HTTP?

Yes. HTTP/2, which requires HTTPS, enables multiplexing (loading multiple resources over a single connection), header compression, and server push. TLS 1.3 reduces the handshake from two round trips to one. A properly configured HTTPS + HTTP/2 + TLS 1.3 setup consistently outperforms HTTP/1.1 on plain HTTP in real-world benchmarks, especially for resource-heavy pages with many CSS, JavaScript, and image files.