HTTPS Migration SEO Checklist: Move from HTTP to HTTPS Without Losing Rankings

14 min read · Technical SEO · Last updated July 2026

Quick answer: HTTPS migration requires: valid SSL certificate, 301 redirects from every HTTP URL to its HTTPS equivalent, mixed content audit and fix, Google Search Console re-verification as a new property, sitemap update, and a 28-day monitoring period for ranking changes. Done correctly, you maintain or improve rankings.

Introduction

If you are still running a site on HTTP in 2026, you are dealing with active ranking suppression, Chrome’s “Not Secure” warning in the address bar, and browser blocking of features like geolocation, camera access, and payment APIs. HTTPS migration is not optional — it is table stakes.

The migration itself is straightforward. The complexity is in the details: ensuring every HTTP URL redirects to its exact HTTPS equivalent, eliminating mixed content errors that break the secure context, re-verifying your GSC property, and monitoring rankings during the transition period.

Most ranking drops after HTTPS migrations are caused by incorrect redirect configurations — specifically, redirect chains that go HTTP → HTTPS → WWW → new URL, adding latency and bleeding PageRank at each hop. Get the redirects right and the migration is almost always ranking-neutral or positive.

What you’ll learn:
– Pre-migration preparation steps that prevent ranking loss
– How to configure 301 redirects correctly
– What mixed content is and how to fix every type
– Google Search Console re-verification and property setup
– Impact on backlinks and what to do about it
– The 28-day post-migration monitoring protocol

Why HTTPS Affects Rankings
Pre-Migration: Baseline and Backup
SSL Certificate Setup
Configuring 301 Redirects
Mixed Content: What It Is and How to Fix It
Updating Internal Links and Sitemap
Google Search Console Re-verification
Backlinks and HTTPS Migration
Post-Migration Monitoring Protocol
Common Mistakes That Cause Ranking Loss
Frequently Asked Questions

Why HTTPS Affects Rankings

Google confirmed HTTPS as a lightweight ranking signal in 2014. It is not a major ranking factor — content quality and authority still dominate — but all else equal, an HTTPS site outranks an HTTP equivalent.

The more significant impact is on user trust. Chrome labels HTTP sites as “Not Secure” in the address bar. Firefox and Safari do the same. This browser warning actively increases bounce rate for HTTP sites, particularly on pages that ask for any user input (contact forms, login pages, checkout pages). Higher bounce rate has indirect negative effects on rankings through lower engagement signals.

Beyond SEO, HTTPS is required for:
– Modern browser features (geolocation, camera, service workers, Web Bluetooth)
– HTTP/2 and HTTP/3 (which deliver significant performance improvements)
– Google Chrome’s newer security features like mixed content blocking

Pre-Migration: Baseline and Backup

Before touching anything, record your baseline so you can compare post-migration.

Baseline data to capture:
1. Organic traffic by page (GA4 export, last 90 days)
2. Keyword rankings for your 50 most important keywords
3. GSC impressions and clicks by page (last 90 days)
4. GSC Coverage report — current indexed page count
5. Full site crawl export from Screaming Frog (all HTTP URLs, response codes, meta data)

Store this data in a spreadsheet. You will compare against it at days 7, 14, and 28 post-migration.

Backup:
– Full database backup
– Server configuration backup
– DNS records export

Notify your team: Coordinate the migration timing. Avoid launching on Fridays (leaves no workday to respond if something breaks), and avoid major marketing campaign windows.

SSL Certificate Setup

You need a valid SSL certificate before the migration. There are three tiers:

Free certificates (Let’s Encrypt): Suitable for almost all sites. 90-day certificates that auto-renew. Supported by most hosting providers. DV (Domain Validated) certificates — they verify domain ownership but not business identity.

Commercial DV certificates: From Comodo, DigiCert, Sectigo. Similar to Let’s Encrypt in validation level but typically issued for 1–2 years. Costs $50–$200/year. No SEO advantage over Let’s Encrypt.

OV/EV certificates (Organization Validated / Extended Validation): Verify business identity in addition to domain ownership. EV certificates used to show the company name in a green bar in browsers — this feature was removed by Chrome in 2019. No current SEO or trust advantage for most sites. Required for some enterprise and financial applications.

For an SEO migration, Let’s Encrypt via your hosting provider is the correct choice. It installs in minutes and auto-renews.

Verify the certificate is valid:
– No SSL errors in the browser
– Certificate covers both www and non-www variants (or your canonical version)
– Expiry date is set correctly
– Strong cipher suite (TLS 1.2 or 1.3)

Configuring 301 Redirects

This is the most critical technical step. Every HTTP URL must redirect to its HTTPS equivalent with a 301 (permanent) redirect. A 302 (temporary) redirect does not pass full PageRank.

For Apache servers (.htaccess):

# Force HTTPS on all requests
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

For Nginx:

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;
}

Avoid redirect chains. A redirect chain is when multiple redirects occur before reaching the final URL:

http://example.com → http://www.example.com → https://www.example.com
(This is a chain — fix it so HTTP redirects directly to HTTPS in one hop)

Every hop in a redirect chain:
– Adds latency (50–200ms per hop)
– Reduces the PageRank passed through the redirect
– Increases the chance of redirect loops

The correct configuration: one 301 from any HTTP variant to the canonical HTTPS URL. No intermediate steps.

Test every major URL template:
– Homepage: http://example.com → https://example.com (301)
– Category page: http://example.com/category/ → https://example.com/category/ (301)
– Product page: http://example.com/products/name/ → https://example.com/products/name/ (301)

Use a tool like Redirect Checker or Screaming Frog’s redirect mapping to confirm all redirects return exactly 301 status and arrive at the correct HTTPS destination.

HTTPS Migration Progress Checklist

Track your migration progress. Check off each item as you complete it.

Migration Progress
0/18 complete

Mixed Content: What It Is and How to Fix It

Mixed content occurs when an HTTPS page loads resources (images, scripts, CSS, iframes) over HTTP. It breaks the secure context and triggers browser warnings.

Types of mixed content:

Active mixed content (blocked by browsers): Scripts, stylesheets, iframes loaded over HTTP on an HTTPS page. Chrome blocks these entirely. The script does not execute, the stylesheet is not applied. This can break your site visually.

Passive mixed content (warning shown): Images, videos, audio loaded over HTTP. Chrome allows these but shows a warning icon in the address bar.

How to find mixed content:
1. Open Chrome DevTools → Console tab on each page. Mixed content errors appear as warnings with the offending URL.
2. Use Screaming Frog’s “Page Source” feature to scan for http:// URLs in page source code.
3. Use the Why No Padlock? tool (whynopadlock.com) for a quick scan of individual pages.

How to fix mixed content:

For your own resources: Update all HTTP URLs in your HTML, CSS, and database to HTTPS or protocol-relative URLs (// instead of http://):

<!-- Before: mixed content -->
<img src="http://example.com/images/photo.jpg">
<script src="http://example.com/js/app.js"></script>

<!-- After: HTTPS -->
<img src="https://example.com/images/photo.jpg">

<!-- Or protocol-relative (adapts to current protocol) -->
<img src="//example.com/images/photo.jpg">

For CMS databases (WordPress): Run a database search-and-replace to convert all http://yourdomain.com references to https://yourdomain.com. Use the Better Search Replace plugin or WP-CLI:

wp search-replace 'http://yourdomain.com' 'https://yourdomain.com' --all-tables

For third-party resources: Most third-party providers (Google Analytics, font providers, CDNs) now serve content over HTTPS by default. Simply update your embed codes to use their HTTPS URLs or protocol-relative references.

Updating Internal Links and Sitemap

After the redirect is live, update your internal links. Technically, HTTP internal links will redirect to HTTPS (following your 301 setup), but each redirect adds latency. Direct HTTPS links are faster and avoid unnecessary redirect hops.

Internal links: Update all href, src, action, and other link attributes to use HTTPS explicitly. For WordPress, a database search-replace handles most of this.

XML Sitemap: Update every URL in your sitemap from http:// to https://. Resubmit the updated sitemap in Google Search Console.

Canonical tags: Every <link rel="canonical"> tag must use the HTTPS URL. An HTTP canonical on an HTTPS page tells Google to index the HTTP version — a common post-migration issue.

OG tags and structured data: Social sharing and schema markup often contain absolute URLs. Update these to HTTPS as well.

Google Search Console Re-verification

This is the most commonly missed step. Google Search Console treats http://example.com and https://example.com as completely separate properties. Your existing HTTP GSC property is not automatically updated to include HTTPS data.

Steps:
1. Add https://example.com as a new property in GSC
2. Verify ownership using the same method as your existing property (HTML tag, DNS record, or Google Analytics)
3. Set the preferred domain (www vs non-www) in the new property
4. Submit your updated HTTPS sitemap in the new property
5. Keep the HTTP property active — you may need it for disavow files and historical data

GSC will begin reporting data for your HTTPS property within 48–72 hours of verification. It takes 28 days of data before you get a complete picture in the Core Web Vitals and Performance reports.

Backlinks and HTTPS Migration

External backlinks pointing to HTTP URLs will redirect to HTTPS through your 301 setup. The PageRank from those backlinks passes through the redirect (301s pass approximately 99% of PageRank per Google’s John Mueller).

However, if your highest-value backlinks point to HTTP URLs and those sites never update their links, you have perpetual redirect chains for every backlink. This is not a catastrophic problem — 301 redirects are efficient — but updating high-value backlinks to point directly to HTTPS is worth doing for your top 20–30 most-linked pages.

Contact referring site owners for your top backlinks and ask them to update to the HTTPS URL. This eliminates the redirect hop and marginally improves PageRank flow from those links.

Mixed Content Finder — URL Checker

Paste in your page HTML to identify HTTP resource URLs that need to be converted to HTTPS.

Post-Migration Monitoring Protocol

Day 1–3: Check that all redirects are working. Use Screaming Frog to crawl the live site and confirm all HTTP URLs return 301 to their HTTPS equivalents. Check GSC new property for crawl errors.

Day 7: Compare organic traffic in GA4 against the pre-migration baseline. Minor traffic variance (±5%) is normal. Larger drops warrant investigation.

Day 14: Check keyword rankings for your top 50 terms. Some rankings may temporarily drop and recover as Google recrawls and re-evaluates URLs. Check GSC Coverage for unexpected “Excluded” pages.

Day 28: Full ranking and traffic comparison against baseline. By now Google should have recrawled most of your important pages. CrUX data in GSC will have a full 28-day window for the HTTPS property.

If you see significant ranking drops:
1. Verify redirects are correct (no chains, correct 301 status)
2. Check for mixed content blocking functionality
3. Confirm canonical tags are all pointing to HTTPS
4. Verify GSC is receiving data from the HTTPS property (not just the HTTP property)

Key takeaway: A correctly executed HTTPS migration is ranking-neutral to positive. Ranking drops after migration are almost always caused by redirect chains, incorrect canonical tags pointing to HTTP, or mixed content blocking functionality.

Common Mistakes That Cause Ranking Loss

Redirect chains: HTTP → HTTP/www → HTTPS. Every intermediate step dilutes PageRank and adds latency.

Canonical still pointing to HTTP: After migration, if <link rel="canonical"> still says http://, Google will try to index the HTTP version, which then redirects to HTTPS. This creates a canonical/redirect conflict.

Sitemap not updated: Submitting an HTTP sitemap to your new HTTPS GSC property confuses Google and delays recrawling.

Missing www redirect: If https://www.example.com and https://example.com both exist without one redirecting to the other, you have a duplicate content situation.

Noindex tags on HTTPS pages: Some CMS implementations add noindex to the HTTPS version temporarily during setup. Check that no pages have inadvertent noindex meta tags after migration.

Frequently Asked Questions

How long do rankings take to recover after HTTPS migration?
For a correctly executed migration, most rankings stabilize within 4–8 weeks. Google needs time to recrawl and re-index your URLs under the new HTTPS addresses. During this window, some fluctuation is normal.

Will I lose all my Google Search Console data?
Your HTTP GSC property retains its historical data indefinitely. The new HTTPS property starts fresh from zero. You will not lose historical data — it is accessible in the old property. After 12 months, you will have a full year of HTTPS data in the new property.

Do I need separate SSL certificates for subdomains?
Your main domain certificate may or may not cover subdomains depending on the certificate type. A wildcard certificate (*.example.com) covers all subdomains. Let’s Encrypt issues wildcard certificates via DNS challenge. If you have SEO-important subdomains (blog.example.com, shop.example.com), ensure they are covered.

What is HSTS and should I enable it?
HTTP Strict Transport Security (HSTS) tells browsers to always use HTTPS for your domain, even if the user types http://. After confirming your HTTPS migration is working perfectly for at least 30 days, enabling HSTS is recommended. Add your site to the HSTS Preload list for maximum protection.

My site is on Shopify/Wix/Squarespace — does any of this apply?
These hosted platforms handle SSL and HTTPS redirects automatically. The main migration tasks for hosted platforms are: enabling HTTPS in the platform settings, updating any hardcoded HTTP URLs in your custom code or embed codes, and verifying the new HTTPS property in GSC.

Conclusion

HTTPS migration is one of the least risky technical SEO projects when done correctly, and one of the riskiest when done carelessly. The SSL certificate and redirect configuration take under an hour. The preparation, mixed content audit, and post-migration monitoring are where most teams cut corners.

Follow the checklist, test every redirect, eliminate every mixed content instance, and monitor for 28 days post-migration. Done correctly, you will see no ranking loss and will likely see modest improvements from the HTTPS ranking signal and better Core Web Vitals scores from HTTP/2 performance improvements.

Let Ignited Nepal Handle This

We manage HTTPS migrations end-to-end — redirect configuration, mixed content audit, GSC setup, and 28-day monitoring with weekly ranking reports.

→ Request a Free Technical SEO Audit

Written by the Ignited Nepal SEO team. We build organic search systems for businesses across Nepal, Australia, UAE, USA, UK, and beyond. ignitednepal.com