HTTPS Migration SEO: How to Move to SSL Without Losing Rankings

By Guy Sheetrit, CEO of Over The Top SEO

Why HTTPS Migration Is a High-Stakes SEO Event

Migrating from HTTP to HTTPS is one of the most impactful—and most risk-laden—technical SEO operations a site can undergo. When executed correctly, an HTTPS migration strengthens security, consolidates PageRank on canonical HTTPS URLs, and eliminates Chrome’s “Not Secure” warning that suppresses click-through rates. When executed incorrectly, it fragments PageRank across HTTP and HTTPS URL variants, breaks internal linking, invalidates canonical tags, causes ranking drops that take months to recover from, and triggers crawl budget waste from serving duplicate content on two URL schemes.

Despite being a mature SEO procedure, HTTPS migration errors remain common—particularly on large sites with complex link graphs, CMS platforms with hardcoded URLs, and e-commerce sites with dynamic URL structures. This guide provides a complete, ordered checklist for executing HTTPS migration without ranking loss.

Pre-Migration Checklist

1. Audit Your Current HTTP Baseline

Before any migration action, document your baseline metrics: current organic traffic by page (Google Search Console Performance report, 16-week view), current Google Search Console coverage report (indexed pages, excluded pages, errors), current ranking positions for target keywords (exported from GSC or ranking tool), and current inbound backlink profile (Ahrefs or Semrush—note the distribution of HTTP vs. HTTPS links pointing to your domain).

This baseline is your benchmark for post-migration monitoring. Without it, you cannot distinguish normal ranking volatility from migration-caused damage.

2. Obtain and Install Your SSL Certificate

SSL certificate types: Domain Validation (DV) certificates are sufficient for most websites and are issued within minutes by Certificate Authorities including Let’s Encrypt (free), DigiCert, Sectigo, and GlobalSign. Organization Validation (OV) and Extended Validation (EV) certificates provide additional identity verification for e-commerce and financial sites. Let’s Encrypt’s free DV certificates are functionally equivalent to paid DV certificates for SEO purposes—Google does not differentiate certificate issuers or validation levels in its ranking signals.

Install the certificate on your server and verify: the certificate covers your primary domain (www and non-www if applicable), the certificate is valid (not expired), the certificate chain is complete (no intermediate certificate errors), and HTTPS is accessible at your domain (test with https://www.yourdomain.com).

3. Update Your CMS and Template URLs

Before implementing redirects, update internal URLs to HTTPS at the source: CMS settings (WordPress: Settings > General—update WordPress Address and Site Address to HTTPS), theme and template files (update any hardcoded HTTP URLs in theme CSS and PHP files), plugin/widget configurations (embedded media, iframe sources, API endpoints), and database URL references (WordPress sites should run a search-replace of HTTP to HTTPS in the database using WP-CLI: wp search-replace 'http://yourdomain.com' 'https://yourdomain.com' --dry-run first, then without –dry-run).

This step prevents mixed content errors before HTTPS goes live and ensures internal links point directly to HTTPS URLs rather than relying on redirect chains.

4. Update All Canonical Tags

Every canonical tag on your site must reference the HTTPS URL. A canonical tag pointing to an HTTP URL on an HTTPS page creates a conflicting signal—the page says “I’m HTTPS” but declares “my canonical is HTTP.” Google resolves this ambiguity by favoring the HTTPS URL in most cases, but the conflicting signals slow canonicalization and can cause temporary ranking instability. Audit all canonical tags with Screaming Frog (Directives > Canonicals) before migration day.

5. Update XML Sitemaps

Regenerate XML sitemaps with HTTPS URLs. Submit the updated HTTPS sitemap to Google Search Console under your new HTTPS property (step covered below). If you submit an HTTP sitemap to an HTTPS property—or vice versa—Google Search Console will report the sitemap as an error. Verify all URLs in the sitemap return 200 status codes via HTTPS before submission.

6. Update hreflang Tags (International Sites)

International sites using hreflang must update all hreflang href attributes from HTTP to HTTPS. Inconsistent hreflang (some HTTP, some HTTPS) creates international targeting confusion in Google’s indexing. Audit hreflang implementation with Screaming Frog’s hreflang tab post-migration to confirm all values reference HTTPS URLs.

Migration Day: Redirect Implementation

Implementing 301 Redirects

All HTTP URLs must 301 redirect to their HTTPS equivalents. Implement at the server or CDN level—not via meta refresh, JavaScript, or CMS plugins that may not trigger before Googlebot reads the page. Implementation varies by server:

Apache (.htaccess):

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Nginx:

server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;
    return 301 https://$server_name$request_uri;
}

Cloudflare: Enable HTTPS rewrites under SSL/TLS > Edge Certificates > Always Use HTTPS. Add a Page Rule: URL “http://*yourdomain.com/*” → Forwarding URL (301) → “https://yourdomain.com/$2”. Cloudflare handles the redirect at the edge, reducing server load during the migration period.

Implementing HSTS

After redirects are live and verified, implement HTTP Strict Transport Security (HSTS). HSTS tells browsers to never attempt HTTP access to your domain—eliminating the HTTP→HTTPS redirect for returning visitors and providing protection against protocol downgrade attacks. Add to your HTTPS server configuration:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Start with a short max-age (300 seconds) to test, then increase to 31536000 (one year) once you’ve confirmed everything works. Submit your domain to the HSTS preload list (hstspreload.org) only after you’re certain every subdomain supports HTTPS—HSTS preloading is very difficult to reverse.

Post-Migration Checklist

Verify Redirect Implementation

Test every redirect pattern, not just a sample: homepage (HTTP → HTTPS), a blog post URL, a category page, a product page, the /wp-admin path (for WordPress), and any subdomain. Use curl -sIL http://yourdomain.com/sample-page/ to trace the full redirect chain and confirm it terminates at a single HTTPS URL with 200 status. Flag any chains longer than one hop for optimization.

Fix Mixed Content

After HTTPS goes live, Chrome DevTools (F12 > Console) will show mixed content warnings for any HTTP resources on your pages. Automated scanning: use WhyNoPadlock.com for quick checks, or Screaming Frog with HTTPS configuration to crawl for mixed content. Common sources: hardcoded image URLs in post content, embedded YouTube/Vimeo iframes, third-party scripts loading via HTTP, CSS background-image URLs, and font sources. Fix by updating URLs to HTTPS or protocol-relative (//yourdomain.com/image.jpg).

Set Up HTTPS Properties in Google Search Console

Google Search Console treats HTTP and HTTPS as separate properties. After migration, add and verify your HTTPS property (both www and non-www if applicable). Submit your HTTPS sitemap to the HTTPS property. Use the URL Inspection tool to request indexing of your most important pages under the HTTPS property to accelerate recrawling. Monitor the old HTTP property—traffic should decline as Google migrates its index to HTTPS URLs; complete disappearance from the HTTP property (over 8-12 weeks) confirms successful migration.

Update Google Analytics and Other Tracking

Update your Google Analytics property default URL from HTTP to HTTPS (Admin > Property Settings). Update any UTM-tagged campaign URLs referencing HTTP to prevent session attribution issues. Update conversion tracking in Google Ads—conversion action URLs must match the HTTPS landing page. Failure to update tracking URLs causes cross-domain referral issues where HTTPS pages appear as referral traffic from your own HTTP domain, breaking attribution.

Notify Backlink Sources of HTTPS Change

The 301 redirects preserve PageRank from HTTP-linking domains, but direct HTTPS backlinks are marginally more efficient (no redirect hop). For your highest-authority backlinks (easily identified via Ahrefs or Semrush), reach out to site owners to update their links from HTTP to HTTPS directly. This is most impactful for editorial links on high-DA sites; the marginal PageRank improvement from converting redirect links to direct links is small but measurable on competitive queries.

Post-Migration Monitoring Protocol

Set up a 12-week post-migration monitoring schedule:

Week 1-2: Daily checks. Monitor: Google Search Console Coverage report (new errors?), Search Console Performance report (traffic anomalies?), HTTPS URL return rates in crawl testing, mixed content errors via DevTools spot-checks. Any significant error spike in the first two weeks indicates a critical migration issue requiring immediate remediation.

Weeks 3-8: Weekly checks. Monitor: organic traffic vs. pre-migration baseline (expect ±10% normal variance; >15% drop warrants investigation), keyword ranking changes for target terms, GSC index count (should stabilize within 10% of pre-migration indexed pages), crawl stats (crawl rate, average response time).

Weeks 9-12: Bi-weekly checks. By this point, Google should have substantially completed indexation of HTTPS URLs. Monitor for any remaining HTTP-indexed pages in GSC’s HTTP property and submit them for recrawling via HTTPS URL Inspection. Document the complete migration as a baseline for future technical audits.

HTTPS Migration for Large Sites and Enterprise

For sites with 100,000+ URLs, phased migration reduces risk. Approach: migrate lower-traffic sections first (blog, resource library), validate redirect implementation and Search Console behavior over 2-4 weeks, then migrate higher-traffic sections (product catalog, landing pages), then the homepage and primary navigation. Phased migration allows early detection of implementation issues without risking the entire site’s ranking simultaneously.

Large e-commerce sites on platforms like Magento, Shopify, or Salesforce Commerce Cloud should engage platform-specific technical SEO expertise—each platform has unique considerations for session handling, canonical generation, and URL architecture that affect HTTPS migration complexity.