Home/SEO Guide/Security
SEO guide · category 09 · trust

The padlock is the start, not the finish.

HTTPS is a confirmed ranking signal and a requirement for browsers not to warn your visitors. Mixed content, missing headers and a hacked page can undo it quietly.

Last reviewed · 1 Oct 2026Reference article · 17 sources →
Check my security free →Technical SEO Checker
$ curl -sI https://shop.com/HTTP/2 200
✓strict-transport-security:max-age=31536000; includeSubDomains
✓content-security-policy:default-src 'self'; img-src 'self' cdn.shop.com
✓x-content-type-options:nosniff
✕referrer-policy:missing
✕permissions-policy:missing
2 headers missing · illustrative
when https pages load http files

One insecure file can break the padlock.

A page served over HTTPS that pulls in resources over HTTP is mixed content. Browsers treat scripts and images differently.

httpsshop.com/trail/
https://shop.com/app.jsscript · same originloads
http://cdn.old.com/slider.jsscript · active contentblocked
http://img.shop.com/hero.jpgimage · passive contentupgraded
https://fonts.example/inter.woff2fontloads
illustrative
ACTIVE · BLOCKEDScripts, stylesheets and iframes over HTTP are blocked by browsers: features silently stop working.
PASSIVE · UPGRADED OR BLOCKEDImages, audio and video are upgraded to HTTPS by modern browsers, and blocked if the upgrade fails.
FIXReference every resource with https:// from a host that serves HTTPS.
the response headers worth sending

Each header closes one door.

None of these is a ranking signal on its own. They protect visitors, and a compromised site loses rankings fast.

Strict-Transport-Securitymax-age=31536000; includeSubDomainsForces HTTPS for future visits, so no one is sent over http first
Content-Security-Policydefault-src 'self'Limits where scripts and other resources may load from
X-Content-Type-OptionsnosniffStops browsers guessing file types: a common injection route
Content-Security-Policy: frame-ancestors'self'Prevents other sites framing your pages (clickjacking)
Referrer-Policystrict-origin-when-cross-originControls how much of your URLs leak to other sites
Permissions-Policycamera=(), geolocation=()Switches off browser features the page doesn’t use
rolling out HSTS safely

Climb slowly: HSTS is hard to undo.

Once a browser has seen the header, it refuses http for the whole max-age. Raise it in steps.

5 minmax-age=300Test on staging; easy to roll back
1 weekmax-age=604800Watch for anything still on http
1 monthmax-age=2592000Add includeSubDomains once every subdomain is ready
1 yearmax-age=31536000Required before preload
Preload+ includeSubDomains; preloadSubmitted to browsers’ built-in list
what happens when a site is compromised

Visitors see warnings before they see you.

Google flags unsafe sites in Search and Chrome. Recovery starts with cleaning the site and requesting a review in Search Console.

Malware
Code that harms visitors’ devices.WHAT USERS SEEBrowser interstitial warning; Search Console Security Issues
Social engineering
Pages that trick people into revealing data or installing software.WHAT USERS SEERed warning page before the site loads
Hacked spam
Injected pages or links, often hidden from the owner.WHAT USERS SEEPages demoted or removed from results
security questions, answered

True or false? Three common claims.

“HTTPS is a Google ranking signal.”

TRUEFALSE

Google confirmed it in 2014, describing it as lightweight.

“Security headers improve rankings directly.”

TRUEFALSE

They aren’t ranking signals; they protect users from attacks that do hurt rankings.

“A free certificate is as good as a paid one for SEO.”

TRUEFALSE

Search engines check that HTTPS works, not what the certificate cost.

Reference article · 17 sources

HTTPS, HSTS and mixed content: the documented record.

HTTPS is HTTP sent over an encrypted Transport Layer Security (TLS) connection, which protects the integrity and confidentiality of data between a browser and a website. Google has used HTTPS as a lightweight ranking signal since 2014, and browsers mark plain-HTTP pages as “not secure”. Related practices: avoiding mixed content, sending security headers and keeping a site free of malware: protect users and the site’s standing in search.

KALENUX REFERENCEHTTPS and website security for SEO
  1. 1Overview
  2. 2History
  3. 3Moving to HTTPS
  4. 4Mixed content
  5. 5HTTP Strict Transport Security
  6. 6Security headers
  7. 7Compromised sites
  8. 8Common misconceptions
17 references · cite-readyRead the article →
after security
CLGUIDE · 10Checklists
Every check, in the order to run them.
USE IT WHENYou want one list for the whole audit.
  • ✓Pre-launch
  • ✓Migration
  • ✓Monthly
Read the guide→
⤳GUIDE · 04Redirects
The http → https redirect, done once.
USE IT WHENYou’re moving to HTTPS.
  • ✓One-hop 301s
  • ✓No chains
  • ✓Updated links
Read the guide→
hlGUIDE · 08Localization
Every locale needs HTTPS too.
USE IT WHENSome language versions lag behind.
  • ✓Consistent protocol
  • ✓Reciprocal hreflang
  • ✓Valid codes
Read the guide→
TSFREE TOOLTechnical SEO Checker
HTTPS, headers and more on one page.
USE IT WHENYou want a quick read before a full audit.
  • ✓HTTPS
  • ✓Mixed content
  • ✓Headers
Open the tool→

Find mixed content and missing headers on every page.

Free to start. Each finding lists the exact resource or header to change.

Start my free audit →