Google's announcement was brief. On August 6, it stated on its webmaster blog that it would begin using HTTPS as a ranking signal. Secure sites receive a small advantage in search, described by Google as very small. For now, it affects fewer than one percent of queries, and quality content still counts for far more.
Most small business owners are unlikely to react, if they hear about it at all. This is understandable: a certificate has a cost, the setup is technical, and "a very lightweight signal" does not create urgency.
We nevertheless recommend planning the switch. The ranking advantage is not the main consideration; the direction of the change is.
What did Google announce about HTTPS?
The announcement, HTTPS as a ranking signal, is worth reading for its measured tone. Google links it to a broader initiative called "HTTPS everywhere," the title of a presentation at its I/O conference in June. The ranking signal serves as an incentive, and Google states that it may strengthen it over time.
For readers less familiar with the subject: HTTP is how a browser communicates with a website. HTTPS is the same protocol, encrypted. With plain HTTP, anyone on the same network, such as café Wi-Fi or a hotel router, could in theory read or alter what passes between the visitor and the site. With HTTPS, this is not possible. HTTPS is indicated by the padlock in the address bar.
Most people associate HTTPS with banks and online stores, on the pages where credit card numbers are entered. Other websites generally run on plain HTTP, and this is rarely questioned.
We expect this perception to change after this year. In April, the Heartbleed bug led many people to change their passwords and brought encryption into the evening news. Now Google, which largely determines how businesses are found online, is stating that security applies to all sites.
Why should a small business site move to HTTPS?
The ranking advantage is minor, and adding a padlock will not double a site's traffic.
The more significant factor is browsers. Chrome is also developed by Google. At present, a plain HTTP page appears normal, with no warning. We do not expect this to remain the case for many more years. Once browsers begin flagging HTTP pages as unsafe, even discreetly, every site without a padlock will appear less trustworthy.
Consider a tourist comparing two guesthouses. One site displays a padlock; the other shows a warning next to its name. The tourist does not know what TLS is and has no reason to. They simply see the warning, and are likely to book with the other guesthouse.
If this assessment proves correct, businesses that switch now can do so gradually, on their own schedule. If it does not, the cost is modest: some money and a day of work, with the benefit that the contact form is encrypted. The risk is limited in either case.
How do you move a site from HTTP to HTTPS properly?
The switch is not difficult, but it is easy to complete only partially, and a partial migration can cause more harm than not switching at all.
How do you obtain a certificate?
This is currently the most cumbersome step. You purchase a certificate from a certificate authority or through your host, generate a request on your server, install the files, and renew the certificate every one or two years. Some hosts reduce this to a few clicks; many do not, and charge for the service. For a small business site, a basic domain-validated certificate is sufficient. The more expensive certificate displaying the company name in green is unnecessary unless you take payments and want to provide additional reassurance.
We expect this step to become less expensive and simpler. For now, we recommend asking your host what it offers before purchasing elsewhere.
How should HTTP pages be redirected?
This is the step where errors are most common. Every old HTTP address must point permanently (with a 301 redirect) to the same page on HTTPS, not to the homepage. Otherwise, all the links other sites have made to yours over the years lead to the wrong place, and search engines see two copies of your site competing with each other.
How are internal links and mixed content corrected?
The next step is to update the links within your site so they point directly to HTTPS rather than passing through a redirect each time, and to correct images, scripts and fonts that still load over HTTP. Otherwise, the browser reports "mixed content," and the padlock does not appear, or appears with a warning, which defeats the purpose of the switch.
WordPress sites are particularly prone to this issue, because image addresses are saved in posts with the full old URL. A careful search-and-replace in the database, performed with a backup, resolves the problem.
How do you inform Google?
Add the HTTPS version of your site in Google Webmaster Tools. Google treats it as a separate site, so both versions should be monitored for a period. Verify that the HTTPS pages are indexed and that the HTTP pages gradually disappear. Resubmit your sitemap with the new addresses.
Is it worth doing this year?
For a site with a contact form, a booking form or a login, yes. Any page where visitors enter their details should already be encrypted, regardless of ranking.
For a simple brochure site, the matter is less urgent. We nevertheless recommend adding it to the list for the next substantial update of the site, and confirming that your current host is able to provide HTTPS. If it cannot, this is useful to know now.
We expect most partially migrated sites over the next few years to share the same problems: pages that do not redirect, images still loading over HTTP, and a site that responds on both addresses. These issues appear in any thorough SEO audit, and they are inexpensive to correct once identified.
Google has stated its direction with unusual clarity.