HTTPS Gets a Ranking Nudge, and the Last Excuse Gets Smaller

Google formalized on August 6 what its security engineers have been advocating from conference stages for a year. HTTPS is now a ranking signal.

The announcement is a model of calibrated disclosure and deserves reading at its actual size before the industry inflates it. The signal is described as lightweight, affecting fewer than one percent of global queries, carrying less weight than content quality. And, in the sentence doing the strategic work, Google ‘may decide to strengthen it’ over time, as it wants to encourage all site owners to move to encrypted connections.

Translation: this is a policy statement with a grace period attached. The speed-update pattern of 2010, re-run for encryption. The trajectory, not the current weight, is the news.

For readers of our security coverage, the strategic argument was settled in 2010 when a Firefox extension made session hijacking a café party trick. Encrypt everything, because your users’ sessions were always worth protecting. Google has now added an SEO incentive to a case that was already closed on the merits. This post treats it accordingly: a migration refresher, a myth patrol, and the updated defaults.

The case, restated in its correct order

Do not migrate for the ranking signal. Migrate for what the signal exists to encourage, and let the rankings be the bonus.

The merits, accumulated over the years. Full-session TLS protects your users’ credentials and sessions on the open networks they actually use. The Firesheep lesson. It protects the integrity of your content in transit, against the injection and tampering that unencrypted connections permit. And, this year’s addition, the Heartbleed spring demonstrated both how central the encryption layer is and how professionally the ecosystem can respond when it must.

Meanwhile the objections have continued their decade-long deflation. Certificates cost tens of dollars, with credible efforts underway to push that to zero. The performance tax has shrunk to rounding, and modern protocol work is turning encryption into a performance enabler, a story our infrastructure coverage will tell as it matures. The mixed-content cleanup is tedious, finite, and now well-tooled.

What the ranking nudge changes is the meeting. The stakeholder who was unmoved by user protection, ‘has anyone actually been hurt?’, tends to move for visibility. We have long since made peace with taking the yes on whatever grounds it arrives.

The migration, in the order that avoids the traffic scare

• Certificate deployment across the full site. Every property and subdomain that will serve users, with the certificate covering what it claims. Modern deployment via your host or CDN has made this the easy step.

• The 301 map, complete and tested. Every HTTP URL permanently redirecting to its HTTPS twin. One hop, no chains. The redirect layer is where sloppy migrations leak equity and where our canonical-hygiene work does its work.

• Mixed-content cleanup, the real labor. Every asset, script, and embed on a secure page must itself be secure, or browsers warn and block. The audit is days of methodical work on a mature site. Crawl for hard-coded HTTP references. Fix to explicit HTTPS. Chase the third-party embeds. It doubles as the asset-hygiene pass most sites owe themselves regardless.

• The reference layer updated. Canonicals pointing HTTPS. Sitemaps regenerated. Webmaster Tools re-verified for the HTTPS property, since Google treats it as a distinct site. Expect reporting discontinuity and annotate it, per measurement practice. Analytics and campaign tags checked so the migration does not shed tracking.

• Monitoring through the transition. Crawl errors, index coverage, and organic traffic watched across the cutover weeks. Done in this order, the dips that populate migration horror stories mostly decline to appear. The horror stories, audited, are almost always missing steps two or three.

The myths, patrolled while they’re young

The announcement is a week old and the misreadings are already in circulation, so the patrol, briefly.

‘HTTPS will boost our rankings.’ Calibrate. A sub-one-percent, lightweight signal moves almost nobody’s rankings this quarter. Vendors selling migration as an SEO growth tactic are selling the wrong product for the right reason. The case is protection plus trajectory, with rankings as garnish.

‘Migration will tank our traffic.’ The horror stories are real and almost uniformly self-inflicted. Missing redirect maps, half-done mixed-content work. The sequenced version above ships cleanly in practice. ‘HTTPS migration risk’ is mostly a rebranding of ‘sloppy migration risk,’ which was always available at any protocol.

‘We only need it on the login page.’ The Firesheep lesson, apparently still requiring annual re-teaching. Partial encryption protects the credential and abandons the session. The signal, note, rewards sitewide HTTPS, because sitewide is what protection means.

‘Certificates are complicated.’ They were. The tooling matured. The hosting tier now treats provisioning as a checkbox, and the industry’s free-certificate efforts will likely finish the argument within a year or two.

Each myth has a half-life. Patrol them now and the migration conversation stays on the merits, where it wins.

The defaults, updated

Policy positions, stated plainly for citation in your own planning documents.

New builds: HTTPS-only, from day one, no discussion. Provisioning a new site on unencrypted foundations in late 2014 is commissioning a migration project along with the site, and no estimate we write does so anymore.

Existing sites with logins or donations: migrate this cycle, on the sequencing above, because the user-protection case was always yours specifically.

Everything else: migrate within the planning horizon. Deliberately rather than panically, in whatever order your site inventory suggests. You have one, per the governance series.

And the prediction, filed with the usual terms. The ‘lightweight’ signal strengthens within a couple of years. Browsers escalate from rewarding HTTPS to warning about its absence. The organizations treating this announcement as the project calendar it is will experience that future as a series of anticlimaxes.

The web is going encrypted. August 6 was the memo’s SEO edition. The excuse inventory, already thin, just lost another entry. Schedule the migration. Collect the bonus. Protect the users, who were, before the algorithm agreed, always the point.

And keep the announcement in the pattern file beside its 2010 sibling. Twice now, Google has converted a security-or-speed virtue into a small signal with a strengthening clause attached. The clause is the announcement. The calendar has spoken.