Migrating a Website to HTTPS Without Losing Traffic
Key takeaway
The two failures that cause trouble are mixed content — secure pages loading insecure assets — and incomplete redirects that leave both versions of the site accessible. Fix all internal references to relative or https URLs before switching, then redirect every http URL once, to its exact https equivalent.
HTTPS is now expected rather than optional: browsers mark insecure pages, and it's a confirmed if modest ranking signal. The migration is routine, and the handful of things that go wrong are predictable.
Before the switch
- Obtain a certificate covering every hostname you serve, including www and any subdomains, and set up automatic renewal — expired certificates cause outages with no warning to anyone who wasn't monitoring.
- Crawl the site and list every internal link, image, script, and stylesheet using an absolute http URL.
- Check that third-party embeds, fonts, analytics, and advertising tags all support https.
- Confirm your CDN, load balancer, and any reverse proxy terminate or pass through TLS correctly.
Fix mixed content first
A secure page that loads an insecure script will have that script blocked by the browser, which frequently breaks functionality silently. Convert internal references to relative URLs or https, update anything stored in the database or the CMS content, and use the browser console and a crawl to find what remains. This is the step most often left half-done.
Redirect and canonicalise properly
- Permanently redirect every http URL to the same path on https — one hop, no chains, and never everything to the homepage.
- Update canonical tags, the sitemap, and internal links to the https versions rather than relying on the redirect.
- Decide on www or non-www at the same time and canonicalise that too; deciding it later means a second migration.
- Update the property in your search console, analytics settings, and any API callbacks or webhooks pointing at http.
After cutover
- Enable HSTS once you're confident everything works, starting with a short max-age and increasing it. It's difficult to reverse, so don't enable it on day one.
- Re-crawl for mixed content and broken redirects, and watch server logs for http requests still arriving.
- Expect brief ranking fluctuation while the new URLs are recrawled; it settles within weeks.
- Monitor certificate expiry with an alert, and verify the renewal actually works before the first renewal is due.