kweri

Field Guide

HTTPS and Security

HTTPS is the padlock in the address bar — it encrypts the connection between your site and your visitors. It's now the baseline browsers and search engines expect, and serving a page over plain HTTP actively marks it as 'not secure'.

Why it matters for your site

Browsers label any page served over plain HTTP as 'Not secure', right in the address bar. Visitors see that warning before they read a word of your content — and on a page asking for an email address or payment, it's enough to make many people leave immediately.

HTTPS has been a confirmed Google ranking signal since 2014. The effect is modest on its own, but combined with the trust impact, there's no upside left to staying on HTTP — it's a baseline expectation, not a competitive edge.

A subtler trap is 'mixed content': a secure HTTPS page that still loads an image, script, or stylesheet over insecure HTTP. Browsers flag or block these, breaking the page and undermining the padlock you've otherwise earned. Moving to HTTPS means moving everything.

How to check it yourself

  1. Look at your address bar. A padlock and 'https://' means you're secure. A 'Not secure' label or a warning icon means you're not — or something on the page is loading insecurely.
  2. Type your address with http:// at the front and press enter. A correctly configured site immediately redirects you to the https:// version. If it stays on http://, that redirect is missing.
  3. Open your browser's developer console (F12) and reload the page. Mixed-content warnings appear there, naming any resources still being loaded over HTTP.
  4. The Kweri audit flags pages not served over HTTPS in the Technical SEO section of your report.

Technical detail

HTTPS requires a TLS certificate for your domain. Certificates are free and automated through Let's Encrypt, and most modern hosts provision and renew them for you with no manual work.

Once HTTPS is live, every HTTP request should be permanently redirected (a 301 redirect) to its HTTPS equivalent, so old links and bookmarks land on the secure version. An HSTS header can then tell browsers to use HTTPS automatically on future visits.

Mixed content occurs when an HTTPS page references sub-resources over HTTP. Browsers block 'active' mixed content (scripts, iframes) outright and warn on 'passive' content (images). Auditing and updating those resource URLs is the final step of a clean migration.

For the why HTTPS is a baseline requirement, see web.dev — Why HTTPS matters →

Related

Trust Signals

Visitors need visible proof you're who you say you are, and that it's safe to deal with you.

Conversion Anxiety

At every point where a user is asked to commit — enter card details, hand over an email, start a free trial — a predictable anxiety spike occurs; unaddressed, it is the direct cause of the majority of checkout and sign-up abandonment.

See HTTPS and Security on your own site

Run a free Kweri audit — a plain-English review of your site’s speed, accessibility, SEO and design, ranked by what to fix first. No login, no jargon.

Run a free audit →