HTTPS & mixed content explained: what we check & why it matters

Why HTTPS matters for SEO

HTTPS has been a confirmed Google ranking signal since 2014. But its impact goes beyond the algorithm:

• Ranking signal: HTTPS is a lightweight tiebreaker — between two pages with similar content, the HTTPS page ranks higher.
• Browser warnings: Chrome marks HTTP pages as "Not Secure" in the address bar. This drives users away before they even read your content.
• Referrer data: When an HTTPS page links to an HTTP page, the referrer header is stripped. HTTP sites lose referral data in analytics.
• Modern web features: HTTP/2, service workers, geolocation, and many modern browser APIs require HTTPS.

How our engine checks HTTPS and security

Check 1: HTTP-to-HTTPS redirect

ID: technical-http-to-https-redirect
Severity: Critical
Scope: Site-wide
Logic: If the target site is HTTPS, we probe the HTTP variant (same URL with http://) and check whether it returns a 3xx redirect to an HTTPS URL. If the HTTP version serves content instead of redirecting, the check fails. If the initial URL is HTTP, we check whether the crawl was redirected to HTTPS.

Why it's critical: Without an HTTP-to-HTTPS redirect, your site is effectively accessible at two different protocols — creating duplicate content. Old backlinks, bookmarks, and manual URL entries use HTTP. If those requests aren't redirected, link equity goes to the wrong protocol version and Google may index HTTP pages instead of HTTPS.

Check 2: Mixed content

ID: quick-mixed-content
Severity: Critical
Scope: Per page
Logic: For HTTPS pages, we scan the HTML for subresource references (images, scripts, stylesheets, iframes, fonts, media) that usehttp:// URLs. If any insecure subresources are found, the check fails. We report up to 25 offending URLs and the total count. HTTP pages are excluded (mixed content doesn't apply).

Why it's critical: Mixed content undermines your HTTPS migration:

• Browsers block "active" mixed content (scripts, CSS) entirely — breaking page functionality.
• Browsers may warn on "passive" mixed content (images) — showing security warnings to users.
• Google sees mixed content as an incomplete HTTPS migration — the security benefit is partially negated.

Check 3: www/non-www consistency

ID: quick-www-consistency
Severity: Info
Scope: Site-wide
Logic: We probe the alternate hostname variant — if your site is www.example.com, we probe example.com, and vice versa. The check passes if the alternate either doesn't resolve (only one variant exists) or redirects to the canonical variant. If both variants serve content without redirecting, the check fails.

Why we check it: www and non-www are different hostnames to search engines. If both serve content, Google sees two separate sites with identical content — splitting link equity, crawl budget, and indexing between them. Pick one and redirect the other with a 301.

How to read your HTTPS result

When you run a URL through our free checker:

• Pass (green): HTTP redirects to HTTPS, no mixed content, and www/non-www is consistent. Full marks.
• Critical (red) — no HTTPS redirect: HTTP version doesn't redirect to HTTPS. Set up a 301 redirect.
• Critical (red) — mixed content: HTTPS page loads insecure resources. Update resource URLs to HTTPS.
• Info (blue) — www inconsistency: Both variants serve content. Pick one and redirect the other.

How to fix HTTPS issues

Set up HTTP-to-HTTPS redirect

Configure your server to 301 redirect all HTTP requests to HTTPS:

# Nginx
server {
  listen 80;
  server_name example.com www.example.com;
  return 301 https://$host$request_uri;
}

# Apache (.htaccess)
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Most hosting providers and CDNs (Cloudflare, Vercel, Netlify) have a one-click "Force HTTPS" setting — use that instead of manual config.

Fix mixed content

• Search your HTML/CSS for http:// resource URLs and change them to https://.
• Use protocol-relative URLs (//cdn.example.com/file.js) as a fallback if you're unsure the resource supports HTTPS.
• Check browser DevTools Console for specific mixed content warnings.

Fix www consistency

Add a 301 redirect from the non-preferred variant to the preferred one:

# Redirect www to non-www (Nginx)
server {
  listen 443 ssl;
  server_name www.example.com;
  return 301 https://example.com$request_uri;
}

HTTPS and AI visibility

AI crawlers connect to your site using the same protocols as browsers. An HTTP-only site or one with mixed content may trigger security warnings in the AI system's fetcher, potentially causing it to skip your page. HTTPS with no mixed content ensures reliable retrieval by all AI systems.

For more on how security affects AI visibility, see our security headers guide and AI crawler list.

FAQ

Is HTTPS a Google ranking factor?

Yes. Confirmed since 2014. It's a lightweight tiebreaker — the HTTPS page ranks higher when content quality is similar.

What is mixed content?

When an HTTPS page loads subresources over HTTP. Browsers block or warn on these resources, breaking functionality and showing security warnings.

Does www vs non-www matter for SEO?

The choice doesn't matter. Consistency does — pick one and redirect the other. Both serving content splits link equity.

How do I fix mixed content?

Change all HTTP resource URLs in your HTML to HTTPS. Use browser DevTools Console to find specific mixed content warnings.