What is HTTPS?
HTTPS is the encrypted version of HTTP, securing data between a browser and a server using TLS. HTTPS is required for trust, is a lightweight Google ranking signal, and is mandatory for many modern browser features.
Why HTTPS matters
HTTPS encrypts the connection between the browser and the server, so nobody on the network can read or alter the page, inject ads, steal a session cookie or swap a download. Browsers now label plain HTTP pages 'Not secure', many APIs (geolocation, service workers, payment requests, camera) refuse to work without it, and HTTP/2 and HTTP/3 are HTTPS-only in practice. Google has used it as a light ranking signal since 2014.
Certificates are free from Let's Encrypt and automated by most hosts and CDNs, so the remaining work is doing it completely: redirect every HTTP URL to its HTTPS twin with a 301, update internal links and canonicals, serve every subresource over HTTPS to avoid mixed content, and add HSTS so browsers stop trying HTTP at all. Certificate expiry is the usual failure; monitor it.
Example
The redirect that makes HTTPS the only version:
# Nginx
server {
listen 80;
server_name example.com www.example.com;
return 301 https://example.com$request_uri;
}One permanent redirect, and every old link lands on the secure page.
Common mistakes
- •HTTPS available but HTTP still served without a redirect.
- •Certificates that expire because renewal was manual.
- •Canonicals and sitemap entries still pointing at http:// URLs.
How Webmatik checks it
Webmatik's HTTPS check confirms the site is served over TLS with a valid certificate and that HTTP redirects to HTTPS; the Mixed content check then looks for insecure subresources on the secure page.
Check your own site
Free Website Security Checker
HTTPS, HSTS, CSP and the other headers most sites are missing — with exactly what to add.
Related Security terms
See how your website scores across SEO, GEO, performance, and more
Run a free audit