How to Convert Your Website from HTTP to HTTPS - a Step-by-Step Guide
Security is a top priority for Google, and a growing concern for savvy Internet users. HTTPS (HyperText Transfer Protocol Secure) uses encryption and authentication to protect the integrity and confidentiality of data shared between two Internet devices.
Google's pushing hard for website owners to migrate from HTTP to HTTPS, but as with any conversion, there comes a risk of messing up your Google search rankings. A successful HTTP to HTTPS migration involves more than just installing an SSL certificate. There are lots of details that can trip you up along the way.
This post will give you an outline of the process, along with an easy-to-use Excel HTTP to HTTPS conversion checklist, which you can use to walk through the key steps and make sure nothing falls through the cracks.
You'll save time, energy, and frustration - and importantly, you'll maintain your SEO rankings.
A Bit of Background
To encourage website owners to switch from HTTP to HTTPS, Google announced in August 2014 that it was starting to use HTTPS as a "lightweight ranking signal". The problem was, while they were dangling the lightweight ranking signal carrot, they were, at the same time, penalizing converters.
When you choose to convert from HTTP to HTTPS, you effectively change your Internet address. That means you should give Google (and other search engines) a permanent change of address in the form of a 301 redirect.
301 redirects, until recently, came with a 10-15%-of-your-SEO-equity (also known as PageRank) penalty. That deterred a lot of SEOs and website owners from wanting to convert. eCommerce website owners had to choose - lose SEO equity and its associated ranking potential, or risk the loss of customers because they might fear the loss of identity or transaction tampering. Most eCommerce site owners have chosen to convert. Most informational website owners have not.
Recognizing that everyone wasn't jumping on the bandwagon as quickly as perhaps Google would have liked, in September 2016 they announced they would soon start red flagging sites that had not yet converted to HTTPS. To sweeten the blow, they also let it be known that there would be no loss of PageRank when you provide the redirect (change of address) that tells Google you've converted. John Meuller, Webmaster Trends Analyst at Google, was asked if "link juice" would be lost on one of Google's hangouts, and he answered:
"No, for 301 or 302 redirects from HTTP to HTTPS no PageRank is lost."
Therefore, the time to convert is now.
Not a Job For Laypeople
It is however, not a job for laypeople. You're going to be making changes to your website database and file names - it's easy to make mistakes and it can be hard to recover. If you're not comfortable working with databases and files, bring in an experienced technician to help you and instead and spend your time doing other things to help grow your business. It would be a far better investment of your time.
How long and complicated a process is it?
The implementation process itself ranges from short and simple to long and complicated. It can take an hour, or days and weeks of effort and elapsed time. Large and complicated website owners have been known to convert their sites over in phases spanning months, and even years.
An Outline of the Checklist
The HTTPS conversion checklist below combines steps gathered from a from a variety of reputable sources including, but not limited to:
- Search Console Help - Site Moves With URL Changes (Google);
- Complete Guide - How To Migrate From HTTP to HTTPS (KeyCDN);
- HTTP To HTTPS: An SEO's Guide To Securing a Website (Search Engine Land); and
- The Big List of SEO Tips and Tricks For Using HTTPS on Your Website (Moz).
The checklist has 4 tabs:
- The first tab is a log for document version control and keeping track of the site you're working on (in case you're working multiples).
- The second tab contains the list of tasks to be performed, 36 items progressing from setup through to testing. On the right are columns where you can note who performed the task, when, it's status, and comments. At the bottom, there's a short list of reference articles and tools you can use to ease the conversion and confirm nothing was missed.
- The third tab has instructions for setting up redirects on Linux and cPanel, Windows & Plesk. (source - Godaddy)
- The fourth is a placeholder where you can create a list of external files that may need conversion. If post-conversion tests fail, the culprit is often in this list of external files.
You can download an Excel version of the complete HTTPS conversion checklist here.
If you run into problems or have questions, please note them for discussion in the comments below.
Follow Donna Duncan on Twitter