Fix library · Security

HTTPS: the padlock, and why browsers insist on it

Without HTTPS, browsers put the words “Not secure” next to your address, in front of every visitor, permanently. Certificates have been free and automatic for years now, so this is no longer a budget question — it is usually a switch in your hosting control panel that nobody has turned on.

Security Critical at worst 1 finding covered

Critical

The site is not using HTTPS

What SEOPert detected

Your site is served over http rather than https.

What this means

Your site isn’t using HTTPS. Browsers label it “Not secure”, visitors lose trust, and Google prefers secure sites.

How to fix it

Turn on a free SSL certificate with your web host (often called AutoSSL or Let’s Encrypt).
Then redirect all http:// visits to https:// (see the next check).

On Shopify, Wix, Squarespace and Webflow

Your platform provides HTTPS for connected domains. In your domain settings, make sure SSL/HTTPS is turned on, then re-run the audit.

If you are handing this to a developer

Install a valid TLS certificate and 301-redirect all HTTP requests to HTTPS.

Check it worked. Open http://yoursite.com: it should move to https:// and show a padlock with no warning.

Tell a secure site from an unsafe one A 30-second exercise. One line is the problem — see whether you would catch it.

Guides

Guides that cover this

What is a website health score?Every audit tool gives you a number out of 100, and no two agree. What a health score is actually measuring, and how to use one without being misled.

See which of these apply to you.

The free audit checks up to 10 pages and tells you exactly what it found, in the same plain language as these guides. No account, no card.