HTTPS Migration Guide: Move to SSL Without Losing Rankings

1. Choose the Right SSL Certificate

Certificate types: Domain Validation (DV), Organization Validation (OV), Extended Validation (EV).

For most sites: DV certificate sufficient--free options like Let's Encrypt work perfectly for SEO.

For ecommerce/corporate: OV or EV certificate provides green address bar and higher trust signals.

Wildcard consideration: If you have subdomains, get wildcard certificate to cover *.yourdomain.com.

2. Crawl Your Entire Site

Purpose: Document every URL, internal link, external link, and resource before migration.

Tools: Screaming Frog (up to 500 URLs free), Sitebulb, Ahrefs Site Audit, SEMrush Site Audit.

Export data: Save complete URL list, internal link structure, external links, images, CSS, JavaScript files.

Baseline metrics: Document current rankings, traffic, backlinks--you'll compare these post-migration.

3. Backup Everything

Critical step: Full site backup before making any changes--migrations can go wrong.

Backup components: Database export, all files (code, images, CSS, JS), server configuration files, .htaccess or nginx.conf.

Test restoration: Verify backups work by restoring to staging environment--broken backups are useless.

Keep backups accessible: Store off-server in case of catastrophic failure during migration.

4. Install SSL Certificate

Installation process: Generate CSR (Certificate Signing Request), purchase/obtain certificate, install on server.

Server configuration: Configure web server (Apache, Nginx) to serve site over HTTPS on port 443.

Test HTTPS: Visit https://yoursite.com manually--verify green padlock appears and certificate is valid.

SSL Labs test: Run SSL Labs SSL Server Test--aim for A or A+ grade before proceeding.

5. Update Internal Absolute URLs

Critical fix: Change all internal absolute URLs from http:// to https:// in database and templates.

Database search-replace: Use WP-CLI (WordPress) or SQL find-replace to update all http:// references.

Template updates: Hardcoded http:// links in theme files, header, footer, navigation must be updated.

Best practice: Use protocol-relative URLs (//) or relative URLs to avoid this problem in future.

6. Implement 301 Redirects

Most critical step: Redirect all HTTP URLs to HTTPS equivalents with 301 (permanent) redirects.

Apache (.htaccess):
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

Nginx:
server { listen 80; return 301 https://$host$request_uri; }

Test redirects: Verify every HTTP URL redirects to HTTPS equivalent--no redirect chains or loops.

7. Update XML Sitemap

Critical update: Regenerate XML sitemap with all HTTPS URLs instead of HTTP.

Sitemap location: Ensure sitemap.xml is accessible at https://yoursite.com/sitemap.xml.

WordPress: Yoast SEO and Rank Math auto-update sitemaps--verify URLs are HTTPS.

Submit new sitemap: Submit HTTPS sitemap to Google Search Console and Bing Webmaster Tools.

8. Update Canonical Tags

Purpose: Canonical tags must point to HTTPS versions to prevent duplicate content issues.

Check implementation: View page source, find <link rel="canonical"> tag, verify it uses https://.

Common mistake: Canonical tags still pointing to HTTP versions after migration--confuses Google.

Automated check: Use Screaming Frog to crawl site and verify all canonicals use HTTPS.

9. Fix Mixed Content Warnings

Problem: HTTPS pages loading HTTP resources (images, CSS, JS) trigger browser security warnings.

Detection: Open Chrome DevTools Console--mixed content warnings appear in yellow/red.

Fix method 1: Update all resource URLs to use HTTPS instead of HTTP.

Fix method 2: Use protocol-relative URLs (//example.com/image.jpg) for external resources.

Third-party content: Update embeds (YouTube, Twitter) to use HTTPS versions--most support it now.

10. Update Google Search Console

Add HTTPS property: Add https://yoursite.com as new property in Google Search Console.

Verification: Verify ownership using DNS, HTML file upload, Google Analytics, or Tag Manager.

Submit sitemap: Submit HTTPS sitemap to new property--helps Google discover HTTPS versions faster.

Address change tool: Google Search Console has "Change of Address" tool for migrations--use it.

11. Update Google Analytics

Default URL update: Change Default URL in Google Analytics property settings from HTTP to HTTPS.

View settings: Update Website URL in each View settings to use https://.

Annotation: Add annotation in Google Analytics noting date of HTTPS migration for future reference.

Referral exclusions: Add both HTTP and HTTPS versions to referral exclusion list to prevent self-referrals.

12. Enable HSTS (HTTP Strict Transport Security)

Security enhancement: HSTS forces browsers to only connect via HTTPS--prevents downgrade attacks.

Implementation: Add header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Preload list: Submit site to HSTS preload list at hstspreload.org--browsers will enforce HTTPS permanently.

Warning: Only enable HSTS after confirming entire site works perfectly on HTTPS--it's irreversible.

13. Monitor Rankings Daily

Tracking period: Monitor rankings daily for 30 days post-migration--fluctuations are normal.

Key metrics: Track position changes, impressions, clicks, CTR in Google Search Console.

Expected behavior: Temporary fluctuations (±5 positions) for 1-2 weeks, then stabilization.

Red flag: If traffic drops 20%+ for more than 7 days, investigate immediately for migration issues.

14. Check for Indexation Issues

Index coverage: Monitor Google Search Console Index Coverage report--ensure HTTPS pages get indexed.

Check deindexation: Use site:yoursite.com search--verify HTTP pages disappear and HTTPS pages appear.

Request indexing: For critical pages, manually request indexing via Google Search Console URL Inspection tool.

Timeline: Full reindexation takes 2-4 weeks for most sites--be patient but vigilant.

15. Update External Backlinks

Link equity: While 301 redirects pass 90-99% of link equity, direct HTTPS links are better.

Identify backlinks: Export backlink list from Ahrefs, Majestic, SEMrush, or Google Search Console.

Outreach priority: Contact sites with high-authority backlinks and request URL updates to HTTPS.

Social profiles: Update all social media profiles, directories, and business listings to use HTTPS URLs.