How to Move to HTTPS in 12 Hours Without Losing Organic Traffic

Using HTTPS means to be secure and trusted as it guarantees protection of the privacy and integrity of the exchanged data. Moreover, trying to encourage people to move to HTTPS, Google offers some significant benefits like indexing HTTPS websites firstly and marking HTTP sites that collect sensitive information like passwords and credit cards as non-secure. The algorithm I'm going to describe includes 4 main steps, let's start.

Before you start moving to HTTPS, I strongly recommend you to replace all internal absolute paths on your website by relative ones. Thus, for example, the link to this article

https://serpstat.com/blog/how-to-move-to-https-in-12-hours-without-losing-organic-traffic/

should be replaced with/how-to-move-to-https-in-12-hours-without-losing-organic-traffic/

If there are remarketing tags or different scripts on your site, you have to change their paths to relative ones with domain name but without https, i.o.

//serpstat.com/blog/how-to-move-to-https-in-12-hours-without-losing-organic-traffic/

The same works for the media content.

Don't use free SSL-certificates as it's insecure, which is exactly the opposite of what we intend to do. The browsers may warn your visitors that the website's security certificate is not trusted:

There are three types of SSL-certificates that offer 3 levels of user trust:

Certificates are also classified by functionality:

• Common certificates;

• Wildcard certificates — are used to install HTTPS on subdomains;

• SAN certificates — used for several domains.

We used the common one. You should have no trouble moving to HTTPS as hosting sites usually help here. But, unfortunately, not all hosting providers support HTTPS, thus some domains have to change the hosting provider. Note if you change the hosting while moving to HTTPS, the website will be available at the old ip address. Thus you have to set 301 redirect to the new one. Double check whether the certificate is installed correctly. There are tons of services to help you here. Besides performing a deep analysis of the configuration of the SSL web server, they also give recommendations on how to correct the existing errors. We used SSL Server Test.

Hooray, your website is already secure, but it's not the finish yet.

Add HTTPS to your domain name to the host and sitemap lines:

Host: https://site.com

Sitemap: https://site.com

As your site is now running on HTTPS, you need to create a new Google Search Console profile. Then, you need to update the sitemap.xml file, set the region if necessary. And don't forget to update the links at the disavow tool if required.

Setting 301 redirects (permanent redirection) is probably the most crucial step while moving to HTTPS. Failing this, your site will be available both at HTTP and HTTPS versions, and as you know, two completely similar duplicates is one of the worst things you can do for SEO.

If you don't want your site to drop out of SERPs overnight, don't miss this step. Double check whether all page types are redirected to HTTPS (filter pages, product pages, categories, website search results pages and etc). Note that robots.txt and sitemap.xml files must be available both at HTTP and HTTPS. While setting redirects you can exclude robots.txt file at htacess using this:

RewriteCond %{REQUEST_FILENAME} robots.txt$ [NC]

Seems you've done everything possible and it's time to wait until search engines will re-index your website. But in reality, no matter how hard you try to prepare your site for moving, you'll face that some links are still available at HTTP. In our case it happened with the links at link rel="canonical", thus all website pages were referred to 301 redirect. The same happened with the absolute pagination links. Note, if your website has several language versions, replace

"<link rel="alternate" hreflang="ru" href="http://site.com/" />"

by

"<link hreflang="ru" href="https://site.com/" />"


Although all mentioned steps are completed, you still may see a warning at the address bar. Most likely, it has to do with the scripts that parse data from pages. Replace the links on these pages by the relative ones without protocol. Then check whether all existing pages response 200 code and all non-existing 404/410 ones. That's finally it! Relax and wait until search engines will re-index your website.

Using this method we moved the website dealing with the seeds sales to HTTPS. The work was finished at February, and as you may see the visibility did not drop but rather grew up.

The same with organic traffic: