HTTPS encrypts the connection between a visitor's browser and your server, so nobody in between can read or alter what is sent. Google confirmed years ago that it is used as a ranking signal — but by now the more important point is that it has become a baseline expectation rather than an advantage.
Browsers mark pages served over plain HTTP as "Not Secure" in the address bar. Forms on such pages trigger additional warnings. Some browser features — geolocation, camera access, service workers — are simply unavailable without a secure context.
The result is that the ranking benefit is almost beside the point. A visible security warning costs you visitors directly, and it does so at the exact moment someone is deciding whether to trust you with a form submission.
Certificates are free. Let's Encrypt issues them at no cost, and most hosting providers integrate it directly — often as a single toggle in a control panel, with automatic renewal handled for you. There is no longer a cost argument for staying on HTTP.
Installing a certificate is the easy part. What follows is where sites lose ground:
http:// version to the https:// one.http://. They will redirect, but every redirect is a wasted round trip, and it accumulates across a site.http:// and https:// as separate properties — data for the new one will not appear until it is added.After any HTTP-to-HTTPS migration, load the site and check the browser console for mixed-content warnings, then check that http://yoursite.com actually lands on the HTTPS version rather than serving a parallel copy. Both checks take a minute and catch the majority of migration problems.
A certificate encrypts traffic; it does not make a site secure. A site that gets compromised and starts serving spam or malware can be flagged with a warning in search results, or removed from them entirely — a far larger problem than any ranking factor.
The basics that prevent this are ordinary maintenance: keep the platform and any plugins updated, use strong unique passwords with two-factor authentication on admin accounts, remove software you no longer use, and keep backups you have actually tested restoring.