How to Move Your Website from HTTP to HTTPS (Without Losing Rankings)

The short answer

Here is how to move your website from HTTP to HTTPS: install an SSL/TLS certificate that covers every hostname, redirect every HTTP URL to its HTTPS version with a permanent 301 redirect, and update canonical tags, internal links and XML sitemaps to HTTPS. Then add the HTTPS version to Google Search Console and watch crawling for a few weeks.

Done in that order, an HTTP-to-HTTPS migration keeps your URLs’ ranking signals. Google treats it as a site move and expects some short-term movement while it recrawls. The steps below show how to convert HTTP to HTTPS with an SSL certificate and avoid the mistakes that cause real losses.

Key facts

Item	What to do
Certificate	Covers every hostname you serve, including www and non-www
Redirects	Server-side 301 (or 308), one hop, same path, kept for at least a year
Site signals	Canonicals, internal links, sitemaps and hreflang point to HTTPS
Search Console	Verify the HTTPS version and submit the new sitemap
HSTS	Only after everything works over HTTPS; preload last, if at all

Prepare before you switch

A good migration starts with a list of what you have. Crawl the HTTP site and export every indexable URL, so you can check later that each one redirects correctly. Note your current traffic and top pages in Search Console as a baseline.

Next, make sure the certificate covers every hostname that serves content. A common gap is a certificate for example.com that does not include www.example.com. If you have not set up the certificate yet, follow our guide to install an SSL certificate on your server or hosting panel, then load a few pages over HTTPS by hand before you redirect anything.

Tip: Run the HTTPS site in parallel for a short time without redirects. You can then fix broken resources and test forms, logins and checkout before search engines and visitors are sent there.

Set up 301 redirects the right way

Use permanent, server-side redirects from each HTTP URL to the identical path on HTTPS. Google’s site move guidance names 301 and 308 redirects and states that permanent redirects do not cost PageRank. Avoid redirect chains: send http://www.example.com/page straight to the final HTTPS host, not through two or three intermediate URLs.

On Apache, a rule in the virtual host or .htaccess handles the whole site:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

On Nginx, use a separate server block that listens on port 80 and returns a 301 to the HTTPS host plus the original request URI. On managed hosting, look for a “force HTTPS” setting, and confirm with a header check that it sends a 301 rather than a temporary 302.

• Keep the path and query string unchanged.
• Redirect to your preferred host (www or non-www) in the same hop.
• Keep the redirects in place for at least a year; in practice, leave them permanently.

Update canonicals, internal links and sitemaps

Redirects catch old links, but your own site should point to HTTPS directly. Every signal that still names an HTTP URL makes Google pick between two versions.

Signal	What to change
Canonical tags	Each page’s rel="canonical" points to its own HTTPS URL
Internal links	Navigation, content and footer links use HTTPS or relative paths
XML sitemaps	List only HTTPS URLs; submit the new sitemap
hreflang and structured data	All URLs inside them switch to HTTPS
robots.txt	Available on HTTPS and not blocking the new URLs
Third-party settings	Analytics, ad platforms, CDN and social profiles use the HTTPS address

Images, scripts and stylesheets that still load over HTTP trigger browser warnings on the new pages. Our guide shows how to find and fix mixed content across templates and databases.

Do I need to update Google Search Console?

Yes. Add and verify the HTTPS version of your site in Search Console, or use a domain property that covers both protocols and all subdomains. Then submit your HTTPS sitemap so Google discovers the new URLs quickly.

Keep the HTTP property verified as well. Google recommends verifying both the old and new versions during a move, including www and non-www. If your verification uses an HTML file or meta tag, make sure it is reachable on HTTPS.

You do not need the Change of Address tool. Google’s documentation states that it is meant for moves to a new domain or subdomain, not for switching from HTTP to HTTPS.

Will moving to HTTPS affect my SEO?

Expect some short-term fluctuation, but no lasting ranking loss when the migration is done right. Google’s site move documentation says rankings can be unstable during a move and that this settles over time; on medium-sized sites, replacing old URLs in results can take several weeks.

Lasting drops almost always trace back to technical mistakes rather than HTTPS itself. HTTPS is a positive signal for users and search engines; the background is covered in our article on SSL and SEO.

Mistake	Effect	Fix
302 instead of 301	Google may keep the HTTP URL as canonical	Change to a permanent redirect
Redirect chains	Slower crawling, diluted signals	Redirect in one hop to the final URL
Canonicals still on HTTP	Conflicting signals, slow switchover	Update templates and plugins
Certificate missing a hostname	Browser errors on www or non-www	Use a certificate covering both
robots.txt blocks HTTPS	New URLs not crawled	Publish a correct robots.txt on HTTPS

Should I enable HSTS right away?

No. Enable HSTS only after the whole site, including every subdomain you plan to cover, works over HTTPS and you have tested it. HSTS tells browsers to use HTTPS only for your domain for a set time, so a mistake cannot be undone quickly for returning visitors.

Start with a short max-age, raise it once nothing breaks, and add includeSubDomains only when all subdomains support HTTPS. Be most careful with preloading: as of October 2026, the preload list at hstspreload.org requires a max-age of at least one year, includeSubDomains and the preload directive, and it warns that removal can take months to reach users. Read our explainer on HSTS before you set the header.

Verify the migration

Check the result from the outside. Run each hostname through our SSL checker to confirm the certificate, chain and covered names, then re-crawl your old URL list and confirm that every HTTP URL returns one 301 to the matching HTTPS page.

Spot-check templates in a browser for padlock warnings, test forms and logins, and compare Search Console data with your baseline for the next several weeks.