**HTTPS — a site served over an encrypted connection with a valid SSL certificate — is the baseline for a trustworthy, modern site.** This check confirms your page loads over HTTPS and that its certificate is valid. Without it, browsers warn visitors that your site is "Not Secure", search engines treat it as a negative, and any data exchanged is unencrypted.
It checks that your site is served securely and that its certificate is in good standing. Specifically:
- HTTPS in use — the page loads over HTTPS, not plain HTTP.
- Valid certificate — the SSL/TLS certificate is valid, trusted and matches the domain.
- HTTP→HTTPS redirect — the insecure HTTP version redirects to the secure one rather than serving both.
HTTPS with a valid certificate passes; a minor issue (such as HTTP not redirecting) is a warning; no HTTPS or an invalid certificate is a fail.
GEObubbly checks whether the page is served over HTTPS and whether its certificate is valid. It's a core, scored Security check that runs partially, since certificate validity is confirmed against the live connection.
HTTPS encrypts the connection between the visitor and your server using an SSL/TLS certificate, so the data exchanged can't be read or tampered with in transit. It has been a confirmed (if lightweight) Google ranking signal for years, but the bigger reasons are trust and access. Modern browsers label plain-HTTP sites as "Not Secure" in the address bar — a visible red flag that erodes confidence and deters visitors — and some browser features are restricted to secure contexts. For users, the padlock is a baseline expectation; its absence signals an untrustworthy or outdated site. Getting HTTPS right means installing a valid certificate (free options like Let's Encrypt make this easy), serving all pages over HTTPS, and redirecting the HTTP version to HTTPS so there's one secure canonical. It also pairs with avoiding mixed content — secure pages that still load insecure resources. For GEO, HTTPS is part of the baseline credibility engines expect; an insecure site is a weak candidate to be trusted and cited. It's the foundation of Security & HTML Quality.
HTTPS is the secure version of HTTP: it encrypts the connection between a visitor's browser and your server using an SSL/TLS certificate, so the data exchanged can't be intercepted or altered in transit. It matters because it's a baseline of trust and security — a confirmed Google ranking signal, a requirement for the browser padlock that tells users your site is safe, and a prerequisite for some modern browser features. Without HTTPS, browsers flag your site as "Not Secure", which deters visitors. Today HTTPS is essentially mandatory for any credible site, not an optional extra.
Yes. Google has confirmed HTTPS as a ranking signal, used as a lightweight tie-breaker between otherwise comparable results. It's not a heavy-weight factor on its own — having HTTPS won't rocket you up the rankings — but lacking it puts you at a disadvantage and, more importantly, triggers the "Not Secure" browser warning that hurts trust and engagement. Given that valid certificates are free and easy to obtain, there's no reason to forgo the ranking benefit and the user trust. Treat HTTPS as a required baseline rather than an SEO tactic.
The "Not Secure" label that browsers show in the address bar means the page is being served over plain HTTP without encryption, or that its SSL certificate is invalid. It warns users that data they enter could be intercepted and that the connection isn't protected. To visitors it reads as a clear signal that the site is untrustworthy or poorly maintained, which deters them from interacting — especially on any page with a form. Resolving it means serving the page over HTTPS with a valid certificate and redirecting the insecure HTTP version to the secure one.
Obtain and install an SSL/TLS certificate for your domain — free, automated options like Let's Encrypt are widely supported, and many hosts provide certificates with one click. Once it's installed, ensure every page is served over HTTPS and set up a site-wide 301 redirect from the HTTP version to HTTPS so there's a single secure canonical address. Then check for mixed content — secure pages that still reference insecure HTTP resources — and update those references to HTTPS. Finally, update internal links and your canonical tags to the HTTPS URLs so everything points to the secure version.
Indirectly but meaningfully. HTTPS is part of the baseline credibility and security that engines — including AI crawlers — expect from a trustworthy site, and an insecure site flagged as "Not Secure" is a weaker candidate to be trusted and cited. While HTTPS isn't a direct GEO ranking factor on its own, it contributes to the overall signals of a legitimate, well-maintained site that AI engines favour when selecting sources. Given it's free and expected, serving your site securely removes a basic trust obstacle for both search and GEO.