Move a live site to HTTPS in this order: install the certificate, redirect every http address to its https twin with one 301, update the addresses inside your pages, fix mixed content, tell Search Console, and only then consider HSTS. Done in that order, a switch normally passes without a visible ranking change. Whether HTTPS helps ranking at all is a separate question, covered in what SSL does for SEO.
Before you start
- Note your current traffic and the number of indexed pages, so you can compare afterwards.
- Take a full backup. If something breaks, you want a way back.
- Choose the address you want to keep: with or without www. Pick one and keep it.
The steps
- Install the certificate. On EuroVDC hosting the free certificate is enabled from the panel. For a certificate bought separately, see SSL certificates.
- Test the https address by hand. The padlock should show on every page type: home, article, checkout.
- Add one 301 redirect from http to the final https address, including the www choice, in a single hop. Test it with a command-line request such as
curl -I http://example.com/and read theLocationheader. - Update the addresses in your content. Canonical tags, hreflang, the XML sitemap, Open Graph tags and internal links should all use https. In WordPress, use a search-and-replace tool on the database, not on the files.
- Fix mixed content. Look for
http://in the page source. Images, scripts and fonts loaded over http must change to https or to relative addresses. - Tell Search Console. Add the https version as a property, or use a domain property that covers both. Submit the new sitemap and inspect a few URLs.
- Add HSTS last. The
Strict-Transport-Securityheader makes browsers refuse http for your domain. Start with a shortmax-age, such as one day, and raise it only when you are sure every subdomain works over https. A mistake here locks visitors out until the period ends.
What to expect for ranking
Expect Google to recrawl and swap the indexed addresses over a few weeks. A small, temporary fluctuation is normal. A big drop usually points to a broken redirect, a canonical that still says http or a blocked https page in robots.txt. Check those first.
Common mistakes
- Redirecting everything to the homepage instead of to the matching page.
- Leaving the sitemap on http.
- Using a 302 redirect, which signals a temporary move.
- Forgetting subdomains, images on a CDN or a payment page.
- Forgetting that the certificate expires. Lifetimes are shrinking, so put the date in a calendar.
Questions
Do I need to redo redirects when I change hosting?
Yes, if they are stored in the server configuration. Redirects kept in a plugin or in the site’s own files move with the site.
Should I enable HSTS preload?
Not at first. Preloading is hard to undo. Run plain HSTS for a few months before you consider it.
