Skip to content
SEOL

    HTTPS and website security

    HTTPS protects visitors and avoids browser warnings. Hacked sites lose trust and visibility fast. Learn what is documented about both, and how to monitor them.

    Time
    15 min
    Level
    intermediate
    Reviewed
    5 November 2026

    After this lesson you can

    • Serve every page over HTTPS with one preferred version.
    • Fix mixed content.
    • Use the Security issues report and respond to a hacked site.

    HTTPS encrypts the connection between visitors and your site. Today it is the baseline: browsers label plain HTTP pages as not secure, and many features only work over HTTPS.

    What is documented about HTTPS and ranking

    Older articles often call HTTPS a "ranking signal". That was Google's message in 2014. Teach and plan from the current documentation.

    Doing HTTPS properly

    1. Install a certificate. Let's Encrypt is free, and most hosts and Coolify set it up automatically. Make sure renewal is automatic.
    2. Redirect everything to one preferred version: http:// to https://, and one host (www or bare domain), in a single 301 hop.
    3. Fix mixed content: every image, script, stylesheet and font must load over HTTPS. Check the browser console on key templates.
    4. Update references: internal links, canonicals, hreflang, the sitemap and structured data should all use HTTPS URLs.
    5. Add the HTTPS property in Search Console. A Domain property already covers both protocols.
    6. Consider HSTS (the Strict-Transport-Security header) once HTTPS works everywhere, so browsers never try HTTP. Test it first, because it is hard to undo.

    Hacked sites and security issues

    Search Console's Security issues report tells you when Google finds that a site has been hacked or could harm visitors, through hacked content, malware and unwanted software, or social engineering such as phishing. Affected pages can show warnings in search results and in browsers, which destroys traffic and trust quickly.

    Prevention basics, especially for CMS platforms such as PrestaShop and WordPress:

    • Keep the core, modules, plugins and themes updated, and remove unused ones.
    • Use strong, unique admin passwords and two-factor authentication where available.
    • Restrict admin access, and rename the admin path where the platform supports it (PrestaShop does this by default).
    • Keep regular, tested backups stored off the server.
    • Watch for unexpected new pages in Search Console. A sudden rise in indexed URLs with spammy titles is a classic sign of a hack.

    Practice

    Read the lesson, pass the quiz and do the exercise to complete it.

    Knowledge check

    4 questions. Get at least 4 right to pass.

    1. 1. According to Google's page experience documentation, does HTTPS directly raise rankings?
    2. 2. An HTTPS page loads an image over http. What is that called?
    3. 3. Search Console's Security issues report shows hacked content. What must you do?
    4. 4. Is moving from http to https a site move that needs the Change of Address tool?

    Exercise: Check HTTPS and security on your site

    Use the page inspector on the http:// version and the non-preferred host version (www or not) of your home page and record the redirect chain. Open three key pages in a browser with the developer tools console open and look for mixed content warnings. Check Search Console's Security issues and Manual actions reports.

    Deliverable: A note with the redirect chains, any mixed content found, and the status of both Search Console reports. Problems go to the Issues tab.

    Check your work honestly against each point
    Write up your work and meet every point to finish.

    Sources

    Checked against these sources on 5 November 2026. Next review by 5 May 2027.

    Terms

    Checklist items

    Tools