HTTP to HTTPS migration playbook: The Complete 2026 Guide

Use a DV certificate from Let's Encrypt or a paid provider. Install it on your origin server and load balancers. Verify the certificate works on every subdomain and hostname the site uses. Run a full site scan with SSL Labs before proceeding SSL Labs SSL Test. Any certificate warnings at this stage signal configuration errors that will cause problems later. Do not start the migration until every certificate test passes.

Set up TLS 1.2 and TLS 1.3 support only. Disable TLS 1.0 and TLS 1.1. Configure secure cipher suites that support forward secrecy. Enable HTTP Strict Transport Security (HSTS) with a short max-age initially. The initial HSTS header should use max-age=300 to allow quick rollback if something breaks. Increase to a longer duration only after the migration stabilizes Mozilla TLS Guidelines.

Every HTTP URL must redirect to its HTTPS equivalent. Use 301 permanent redirects at the server level Google Redirects Help. The redirect must preserve the full URL path and query string. Example: http://example.com/page?q=1 redirects to https://example.com/page?q=1. Wildcard redirect rules in the server configuration (Nginx, Apache, or Cloudflare) handle this efficiently. Test redirect chains with redirect checker tools. Eliminate redirect chains longer than one hop.

Scan the entire codebase for hardcoded HTTP URLs. Update all internal links, canonical tags, hreflang tags, XML sitemaps, and RSS feeds. Search for http:// references in the database, templates, JavaScript files, CSS files, and image src attributes. A single mixed content reference can break the page security indicator in modern browsers. Use a crawling tool like Screaming Frog or Sitebulb to identify mixed content warnings.

Third-party services often reference your site URLs. Update Google Search Console, Google Analytics, Google Ads, Bing Webmaster Tools, social media platforms, payment gateways, and CDN configurations Google Search Console HTTPS Setup. Set up the HTTPS property in Google Search Console and submit the new sitemap. Keep the HTTP property active to monitor redirect traffic and detect issues.

Track 404 errors, redirect loops, and soft 404s in the first week after migration. Watch Google Search Console crawl stats for a drop in crawl rate. The migration can temporarily reduce crawl frequency as Google recalculates rankings for the new HTTPS URLs. This is normal and resolves within two to four weeks. Monitor core web vitals after the migration Google Core Web Vitals. HTTPS can slightly increase TTFB due to TLS handshake overhead. HTTP/2, which requires HTTPS, offsets this with multiplexing and header compression.

Notify high-value linking sites about the URL change where possible. Use Google Search Console's Change of Address tool if changing domain Google Change of Address. Most link equity transfers through the 301 redirects automatically. A 301 redirect passes about 90 percent of ranking signal according to Google. The remaining equity transfers as crawlers revisit and update their indexes.

The HTTPS migration audit checks every redirect, every resource URL, and every third-party integration. Note the gap between migrated pages and pages still serving over HTTP. Audit quarterly.