An SSL certificate solves the "site is not secure" problem. It lets your site load over HTTPS, so browsers stop labeling it "Not secure", visitors' data is encrypted, and your pages get Google's HTTPS ranking signal. If you're answering a quiz or certification question, that's the answer: an SSL certificate fixes a website that isn't secure (served over HTTP instead of HTTPS).
In practice HTTPS also enables faster protocols (HTTP/2 and HTTP/3), keeps referral data from other secure sites, and, now that Chrome is switching its default in October 2026, avoids a warning screen before visitors reach your site. It does not fix slow pages, thin content or crawl errors, and a careless move to HTTPS can create new SEO problems. Both sides are below.
Key takeaways
- The quiz answer: an SSL certificate fixes an insecure (HTTP) website by enabling HTTPS, which browsers require to drop the 'Not secure' label and which Google uses as a ranking signal.
- HTTPS is a lightweight ranking signal. When Google announced it in 2014, it affected fewer than 1% of global queries.
- From Chrome 154 (October 2026), Chrome turns on 'Always Use Secure Connections' by default and asks before opening public sites without HTTPS.
- Certificates now last at most 200 days (since March 15, 2026), falling to 100 days in March 2027 and 47 days in March 2029. Automate renewal or expect outages.
- A move to HTTPS needs single-hop 301 redirects, HTTPS canonicals, an updated sitemap and no mixed content, or it can cost rankings for weeks.
The short answer
A quick vocabulary note: "SSL" is the old name. Every certificate issued today is a TLS certificate, but the industry still calls them SSL certificates. HTTPS is simply HTTP over a TLS-encrypted connection, and the certificate is what proves to the browser that the server really is your domain.
The six problems an SSL certificate actually solves
| Problem without a certificate | How HTTPS fixes it | How much it matters for SEO |
|---|---|---|
| Browsers label the site "Not secure" | A valid certificate removes the label, and from October 2026 avoids Chrome's warning before an HTTP site opens | High, through trust and visitors who leave |
| No HTTPS ranking signal | Pages served over HTTPS get Google's HTTPS signal | Low: a lightweight tie-breaker |
| No HTTP/2 or HTTP/3 | Browsers only use these faster protocols over encrypted connections | Medium, through page speed |
| Referral traffic shows up as "Direct" | Secure sites pass referrer data to other secure sites | Medium, for measuring what works |
| Modern browser features are blocked | Geolocation, service workers and installable web apps require a secure context | Depends on the site |
| Pages can be tampered with in transit | Encryption stops networks from injecting ads or scripts into your pages | Indirect, through trust and safety |
1. "Not secure" warnings and Chrome's new HTTPS default
Every major browser marks HTTP pages as "Not secure" in the address bar. In October 2025, Google announced that with Chrome 154, scheduled for October 2026, Chrome enables "Always Use Secure Connections" by default: it tries HTTPS first and asks the user's permission before opening a public site that only works over HTTP. Google had already turned this on in April 2026 (Chrome 147) for more than a billion users of Enhanced Safe Browsing.
For a site still on HTTP, that's no longer a small grey label. It's a warning screen between a searcher and your page.
2. The HTTPS ranking signal
Google confirmed HTTPS as a ranking signal in 2014, describing it as a very lightweight signal that affected fewer than 1% of global queries at the time. HTTPS is also one of the things Google lists in its page experience guidance. It's a tie-breaker, not a lever: switching to HTTPS won't move a weak page up, but staying on HTTP is a needless disadvantage.
3. Access to HTTP/2 and HTTP/3
HTTP/2 lets a browser fetch many files over one connection at once, and HTTP/3 does the same over the QUIC protocol. Browsers only use HTTP/2 over encrypted connections, and HTTP/3 has TLS 1.3 built in. So an HTTP site is stuck on HTTP/1.1. Most hosts and CDNs turn the newer protocols on automatically once HTTPS works, which helps load times on pages with many files. Speed itself is a separate job; see our technical SEO audit checklist for the Core Web Vitals thresholds.
4. Lost referral data
Browsers don't send the referring page when a visitor goes from an HTTPS page to an HTTP page. Since nearly all of the web, including Google, social networks and most blogs, is on HTTPS, an HTTP site sees much of its referral traffic arrive with no referrer, and analytics files it under "Direct". You can't tell which links and mentions send visitors. On HTTPS, those referrals show up correctly. Our guide to organic search vs direct traffic explains how misattribution distorts reports.
5. Blocked browser features
Browsers only allow powerful features in "secure contexts": geolocation, service workers (needed for offline support and push notifications), installable web apps, camera and microphone access, and more. A store locator that asks for location, or a site that wants to work offline, needs HTTPS.
6. Tampering in transit
Without encryption, anyone on the network path (public Wi-Fi, some ISPs, compromised routers) can read or change your pages, including injecting ads or scripts. HTTPS guarantees visitors get the page your server sent.
What an SSL certificate won't fix
HTTPS is table stakes, not a strategy. It doesn't fix:
- Slow pages. HTTP/2 helps with many small files; it doesn't fix a slow server, huge images or heavy JavaScript.
- Thin or unhelpful content. No certificate makes a weak page rank.
- Duplicate HTTP and HTTPS versions. A certificate alone means your site now exists twice. Only 301 redirects and HTTPS canonicals make HTTPS the single version Google indexes.
- Mixed content. If HTTPS pages still load images, scripts or stylesheets over
http://, browsers block or upgrade them and may show warnings. That's a code fix, not a certificate fix. - Crawl and indexing errors. Broken links, noindex tags and robots.txt mistakes are unaffected. Our technical SEO best practices cover those.
What changed in 2026: shorter certificates
The other big change is certificate lifetime. Under the CA/Browser Forum's ballot SC-081, approved in April 2025, the maximum validity of a public TLS certificate is shrinking in steps:
| Certificates issued from | Maximum validity |
|---|---|
| March 15, 2026 | 200 days |
| March 15, 2027 | 100 days |
| March 15, 2029 | 47 days |
Manual renewal once a year is over. An expired certificate shows visitors a full-page error and stops crawlers too, so treat it as an outage. Use a host, CDN or tool that renews automatically through the ACME protocol (Let's Encrypt and most commercial certificate authorities support it) and set an expiry alert as a backstop.
How to move to HTTPS without losing rankings
Most hosts and site builders (Shopify, Wix, Webflow, Squarespace, Vercel, Netlify, Cloudflare) issue and renew certificates for free. The certificate is the easy part; the migration is where rankings get lost. Work through this list. Your progress is saved in your browser.
Interactive checklist
HTTP to HTTPS migration checklist
0/16
Before the switch
0/3Redirects and signals
0/5Mixed content
0/2Search Console and analytics
0/3After launch
0/3Your progress is saved in this browser, so you can come back to it later.
Expect some ranking movement for a few weeks while Google recrawls and consolidates signals on the HTTPS URLs; Google treats HTTP to HTTPS as a site move. With clean single-hop redirects it usually settles quickly. If you're changing domains or URL structure at the same time, do one change at a time.
How to check your HTTPS setup
- Redirects: run
curl -I http://yourdomain.com/some-pageand confirm a single301with aLocationheader on the final HTTPS URL. - Certificate and TLS configuration: Qualys' free SSL Server Test grades your setup and flags chain errors, weak protocols and missing hostnames.
- Site-wide: Search Console's Experience → HTTPS report lists URLs Google couldn't load over HTTPS, and a crawler shows any remaining
http://links. For the broader security review, our website auditing checklist includes a security and privacy section, and cybersecurity SEO covers the overlap between the two fields.
FAQ
What technical SEO issue can you solve with an SSL certificate?
An SSL certificate solves the problem of an insecure website served over HTTP. It enables HTTPS, which removes the browser's "Not secure" label, encrypts data between visitors and your server, and gives your pages Google's lightweight HTTPS ranking signal. It also allows HTTP/2 and HTTP/3 and keeps referral data from other secure sites.
Does an SSL certificate improve SEO?
Slightly and indirectly. HTTPS is a confirmed but lightweight Google ranking signal, so it won't lift a weak page on its own. The bigger effects are trust (no "Not secure" label and, with Chrome 154's new default, no warning screen before an HTTP site opens), faster protocols and accurate referral data.
Is HTTPS a Google ranking factor?
Yes. Google announced HTTPS as a ranking signal in 2014 and described it as very lightweight, affecting fewer than 1% of global queries at the time. It acts as a tie-breaker between otherwise similar pages and is part of Google's page experience guidance.
Will switching to HTTPS hurt my rankings?
Not if the migration is done properly. Use single-hop 301 redirects from every HTTP URL to its HTTPS equivalent, update canonicals, internal links and the sitemap, and fix mixed content. Some fluctuation for a few weeks while Google recrawls is normal; lasting drops usually come from redirect chains, missing redirects or canonicals still pointing to HTTP.
Do I need to pay for an SSL certificate?
Usually not. Let's Encrypt issues free certificates, and most hosts, CDNs and site builders, including Shopify, Wix, Webflow, Squarespace, Vercel, Netlify and Cloudflare, include free certificates with automatic renewal. Paid certificates add organization validation or warranties, which don't affect SEO.
