Moving to https

If you’ve ever seen “https” or “http” in the web address of a website (e.g. https://www.cx-marketing.com), you might have wondered what it stands for. 

These are technology protocols that make it possible for website servers to transfer data through to your browser (such as Chrome), so that you can view and interact with websites and links.  Without these protocols the web would look very different from what we know now. 

HTTP stands for “Hyper Text Transfer Protocol” and is the technology used to talk between web servers (where website data is held) and web users (through their web browsers). 

HTTPS is similar to “Hyper Text Transfer Protocol” but it has something called a Secure Sockets Layer (SSL) that encrypts the data that is passed from the servers to your browser.  For example, if you entered your credit card details while making a purchase online, those details would be encrypted from the point of sending it from the form you had filled in until it reached the company or payment gateways that was using the data. Without the SSL, this data would not be encrypted as it passed from the browser to the company servers, and could be intercepted by hackers.  You will know when a site is using SSL because the web address will change from http to https at the beginning e.g. https://www.cx-marketing.com  It would be unusual now to find an online store or site asking for sensitive data that is not using SSL.  However, there are still lots of other sites that rely on http, even though these site owners are also making the move over to SSL as they realise the benefits, in particular too SEO.   The move from http to https SEO can cause considerable impact to the search performance of a site and the right steps should be taken to mitigate the negative risk.

There are various reasons to make the switch but the primary one is that it will ultimately make your site more secure and trustworthy.  There are legislative changes this year to the handling of customer data, with large penalties for misuse or negligence.  An https online environment will help you to make customer data and your site more secure in general.  You can learn more about the rationale behind https and SEO effects here.    

This has been humming in the background for some time now; but a recent blog post https://security.googleblog.com/2018/02/a-secure-web-is-here-to-stay.html by Emily Schechter (Chrome Security Product Manager) has given a date of July 2018 to start marking all HTTP sites as “not secure”, alongside the release of Chrome 68.   This means that your site will display the bottom message if still using just http protocol.  Obviously this doesn’t look particularly user-friendly and may put off visitors to your site.

Perhaps the most subtle but certainly not the least important is that Google takes https protocol into account when ranking sites in search results.  HTTPS was officially acknowledged as a ranking signal in 2014 and, although there are no plans to increase the weight of this signal, we do know that Google favours any site that gives trusted user signals and so it should be considered within any search strategy.    You can view some expert opinions on why https and SEO matters to your website here https://www.semrush.com/blog/https-just-a-google-ranking-signal/

Web users are increasingly bothered about what will happen to their data.  Studies have shown that, even with non-sensitive sites, users will trust those with https and secure signals more.  A big red warning sign from a web browser about a site being less secure will no doubt make users think twice about visiting, especially as more sites make the switch over and the message becomes less common.

http/2 is starting to be rolled out by content delivery networks and web hosting companies.  To get the vast performance benefits that come with http/2 you will need to be using https because of browser support.

Without an https site, referral data from other https sites is blocked within Google Analytics.  So, you just don’t see the source of all the traffic coming from https sites linking to your content, it just goes into “direct traffic”.

When not updated correctly, site migration from http to https can cause significant changes in how Google views and ranks your site.  The involved steps, such as updating your internal links and accessing htaccess files are not simple tasks and should only be carried out by someone who is experienced and trained in these particular disciplines.  You shouldn’t try to make these amends yourself if you are not professional.

When a site changes from http to https then this is viewed by Google as if the site has an entirely new domain e.g. changing from cxmarketing.com to wearecx.com.   By adding an SSL certificate to your site you are removing all the links and pages that Google finds familiar and, when it tries to send people to these pages, will return nasty 404 or similar errors, before eventually deranking these pages and no longer serving them in search results.

Google user searches for “ABC SEO Agency”

Google serves the web page it has crawled, indexed, knows and loves.  http://www.abcseo.com

When the user clicks, that page no longer exists, it has been replaced by https://www.abcseo.com instead.

But Google has no idea that this page exists.  The user gets a 404 error message.  Google logs this as a bad user experience and thinks… ‘Well, I won’t send anyone there again.”  Hey presto, your search rankings drop through the floor.  The http to https SEO impact can be seen straight away.

All of the work that you have done in helping Google identify and rank the pages on your current site could be undone overnight with a migration to https if the correct steps are not taken.

Of course, Google is not going to recommend something that is going to negatively impact sites that have taken the time and effort to create great user-friendly, content rich sites that perform well. With the right steps, and following Google’s guidance, you can ensure a smooth migration that does not impact your SEO (although it may wobble for a tiny bit so probably stay away from any big campaigns!)  Below are our recommended steps for an SEO-friendly https migration.  However, we would always recommend the use of a professional agency if you do not have the experience within this area.  At CX Marketing, we can complete your https migration and ensure that you do not lose that valuable search equity.  Talk to us about how we can help.    

1. Use some software like Screaming Frog to take a crawl of all of the urls that exist on your current http site as well as the links within them
2. Again, use some software like SEMRush or Moz to check your current keyword performance and make a record for future reference
3. When purchasing your SSL certificate, make sure that it is from a reliable source and that you have the necessary support package in case anything goes wrong . There are several types of certificates so you should ensure the right one for your needs an pick a reputable supplier. 
4. You should ensure that your SSL certificate is always up-to-date (an auto-renew option is best) and make sure that all of the variations of your domain name are covered by the certificate (e.g. www and non-www)
5. Your server will need to support SNI
6. Take a copy of the existing site and put on staging server to make all of your site changes and add your ssl certificate initially.  Don’t ever just go straight to your live site in case there are any irreparable issues.
7. Install your SSL certificate and use some software to check no issues with it
8. Take a crawl of your new https site, making a copy of all the pages and links, again using something like Screaming Frog
9. Using Excel or similar, map each url to outline which urls on the old http site are going to redirect to which urls on on the new https site for a redirect strategy  
10. Hold any content and design changes.  Now is not the time to start making other changes to your site as this is just something else for Google to contend with. 
11. Choose whether to do your site migration in sections or full site migration at the same time.  
12. Update all of your hard-coded links to https within your site (that you would have identified in your initial crawl).  Redirect users and search engines to the https pages with server side 301 redirects either using a plugin ur updating the htaccess file.
13. Make sure to scan your website for any non-secure content that might link to third party sites using http – Google will not like these and your visitors will see a nasty warning message on your site
14. Update your robots.txt file to remove any hard-coded links or blocking rules that may still be pointing to http directories or files.  
15. Don’t do your migration when it is a busy time for your site, there are bound to be a few impacts while Google get its head around your changes
16. Put the https version of your site live
17. Add https versions of your site to Google Search Console and set your preferred domain status
18. Submit your sitemap on Search Console for the new version of the site
19. Verify that site can be crawled and indexed correctly
20. Update your Google Analytics profile from http to https in Admin and Property Settings.  This way you won’t lose any history.
21. Check that correct status codes are being returned for the pages as you would expect
22. Monitor search performance for targeted keywords but expect fluctuation for a few weeks