A green padlock in the address bar looks like a technical detail, but to Google it’s a real trust signal. HTTPS encrypts the data exchanged between browser and server, and since 2014 Google has officially counted it as a ranking factor, though with less weight than content and authority.
Why it matters beyond SEO
A site without HTTPS shows a “Not secure” warning next to the address on Chrome, visible to anyone visiting the page, especially on contact or payment forms. It’s a signal that discourages visitors before they even read the content, regardless of Google rankings.
Security headers
Beyond the certificate, a few lines in the server’s response (HTTP headers) strengthen protection without needing any code on the site itself:
- Strict-Transport-Security Tells the browser to always use HTTPS for that site, even if someone types the address without
https://. - X-Content-Type-Options Stops the browser from interpreting a file differently than declared, blocking a common type of attack.
- X-Frame-Options Prevents the site from being loaded inside a hidden frame on another site, a technique used for clickjacking attacks.
- Content-Security-Policy Restricts which sources scripts and other resources can load from, reducing the risk of third-party injected code.
How to check your own site
The certificate can be checked by clicking the padlock in the browser’s address bar. Security headers need a dedicated tool, since they aren’t visible in the page itself: our free audit checks them all together, in the Trust category.
FAQ
Is HTTPS enough without extra security headers?
Yes, for the basic ranking signal an active certificate is enough. Extra headers strengthen protection against specific attacks, but they aren’t required for the HTTPS signal Google counts in rankings.
They’re still worth adding: many hosts and CDNs turn them on with a single toggle, no code required.
Is a free SSL certificate as good as a paid one?
For SEO, yes: Google doesn’t distinguish between a free certificate (like Let’s Encrypt) and a paid one. Both encrypt the connection the same way.
Paid certificates add extras like insurance guarantees or company identity verification, useful in some industries, but they don’t affect rankings.
What happens if the certificate expires?
The browser shows a full-screen error warning that blocks access to the site for most visitors until they manually click through it. It’s one of the most serious technical issues a site can have: few visitors proceed past that warning.
Most hosts renew Let’s Encrypt certificates automatically every 90 days, but it’s worth checking periodically that renewal is actually working.
Is mixed content (HTTP and HTTPS together) a problem?
Yes. If an HTTPS page loads even just one image or script from an HTTP address, the browser may block the resource or still show a partial security warning.
This often happens with old images uploaded years ago with the full address typed by hand. Checking the page’s code catches these cases.
Do security headers slow down a site?
No, their performance cost is nearly zero: they’re a few lines of text added to the server’s response, not code the browser has to execute.
They’re configured once at the server or CDN level, and stay active on every page without ongoing maintenance.
This article is for informational purposes. SEO results depend on many factors and timelines vary by site.