HTTPS Migration SEO Checklist: 8 Critical Steps That Protect Traffic

By Istiak Ahmed Soikot, Founder and CEO, Rank OG

Last reviewed: November 11, 2026.

An HTTPS migration SEO checklist keeps your rankings safe while you switch from HTTP to HTTPS. Follow these eight steps in order: test your certificate, map every URL, set up one-hop 301 redirects, fix mixed content, update every signal, watch Search Console until traffic settles.

Who this is for: small business owners and marketing leads moving a WordPress site to HTTPS without losing rankings. This HTTPS migration SEO checklist walks through the eight steps in the order that keeps traffic safe.

What does an HTTPS migration change for SEO?

An HTTPS migration changes the protocol of every URL on your site, from http:// to https://, which means Google treats each page as a new address. Your content stays the same, but every link, canonical tag, and sitemap entry has to point to the new version.

Google lists HTTP to HTTPS as one of the site moves its guide covers, and it warns to expect temporary ranking fluctuation while it recrawls and reindexes your pages. For a medium-sized site, that can take a few weeks or more. The risk comes from mistakes in the move, not from HTTPS itself, because a 301 redirect passes ranking signals without a loss in PageRank.

HTTPS also encrypts the connection between your site and each visitor’s browser.

What should your HTTPS migration SEO checklist cover before launch?

Start with a full list of every URL that matters, because the whole HTTPS migration SEO checklist rests on that inventory. Google suggests finding them in your sitemaps, server logs, analytics, and the links report in Search Console. Back up the whole site first, and plan the move for a low-traffic window so fewer visitors meet any problem.

Google also gives two ground rules: change only one thing at a time, and split a large move into sections if you can. Do not redesign the site, change the CMS, and switch to HTTPS in the same week, or you will not know which change caused a problem.

Step 1: Is your SSL certificate installed and tested on every hostname?

Yes, before anything else. Install a valid TLS certificate that covers every hostname your site uses, including www and non-www, and test it on staging first. A certificate that covers only one version leaves the other version broken.

Open the HTTPS version in two browsers and check the padlock, then test the full certificate chain, not just the main certificate. Set up auto-renewal now, because an expired certificate stops traffic cold. This is the first item on any HTTPS migration SEO checklist for a reason: every later step depends on it.

Step 2: Have you mapped every old URL to its new HTTPS address?

Every HTTP URL needs a matching HTTPS destination with the same path, including images, PDFs, and scripts. Build the map from your sitemap, server logs, and analytics, and never send retired pages to the home page.

Google says to include embedded content in your move plans, so videos, images, JavaScript, and CSS files move the same way as pages. For content you are not moving at all, return a proper 404 or 410 status instead of redirecting it somewhere unrelated. A clean map turns this HTTPS migration SEO checklist from a wish list into a plan you can test.

Step 3: Are your 301 redirects sending each page to the same path?

Use server-side 301 redirects, one hop, from each HTTP URL to the same path on HTTPS. Google says 301 and other permanent redirects do not cause a loss in PageRank, and it advises redirecting straight to the final URL, not through a chain. That one rule carries most of the weight in this HTTPS migration SEO checklist.

A chain such as HTTP to HTTPS non-www to HTTPS www wastes crawl budget and slows every visit. Test the redirect on a sample of pages with a header checker, and confirm query strings survive the hop. Our guide to 301 vs 302 redirects explains why a 302 is the wrong tool here: it tells Google the move is temporary, so the old HTTP URL can stay in the index.

Step 4: Did you fix every mixed content warning before launch?

Mixed content means an HTTPS page loads a resource over plain HTTP. MDN explains that browsers block scripts and stylesheets loaded this way, so parts of the page can break or the padlock can vanish. Scan the whole site and serve every resource over HTTPS.

The usual culprits are hardcoded http:// links in the theme, old plugins, and third-party embeds. Check the browser console on your key pages, replace absolute HTTP links with relative or HTTPS links, and re-check after every fix. One insecure image can cost a page its padlock, so treat this step in the HTTPS migration SEO checklist as a launch blocker, not a cleanup task.

Step 5: Are your canonical tags, internal links, and sitemap pointing to HTTPS?

Every signal on the new site should name the HTTPS URL: self-referencing canonical tags, internal links, hreflang annotations, and structured data. Google’s site move guide lists these updates as part of preparing the new site, and relying on redirects for your own links sends every internal hop through a redirect.

Update the sitemap to HTTPS URLs and resubmit it, then check the robots.txt file on the HTTPS version to confirm it does not block pages you want indexed. Our canonical tags guide explains the self-referencing tag, and our robots.txt guide covers the rules that matter most during a move.

If this feels like a lot of moving parts, that is normal for an HTTPS migration SEO checklist. A careful technical SEO review before launch catches the missed canonical or stray HTTP link a redirect would have hidden.

Step 6: Have you added the HTTPS property in Search Console?

Add and verify the HTTPS property in Search Console, because Google treats HTTP and HTTPS as separate properties. Verify all variants, www and non-www, on both protocols, and carry over your verification file or meta tag so ownership keeps working.

You do not need the Change of Address tool for a protocol-only move, since that tool is for domain name changes. Submit the new HTTPS sitemap instead, and re-upload any disavow file under the new property. Treat the property setup as a required line on your HTTPS migration SEO checklist, not an afterthought.

Step 7: Should you turn on HSTS right away?

No, not yet. HSTS is a header that tells browsers to always use HTTPS for your domain, which removes the first insecure request for returning visitors. But the browser remembers the policy for as long as max-age says, and a certificate error on an HSTS host gives visitors no way to click through. That is why HSTS sits last in this HTTPS migration SEO checklist, not first.

Wait until every step above is verified and the site has run clean on HTTPS for a while. Start with a short max-age, raise it later, and only consider the preload list once every subdomain can serve HTTPS. Enabling HSTS early can lock in a mistake for months.

Step 8: Are you watching rankings, crawl errors, and traffic after launch?

Watch both Search Console properties daily for the first few weeks after your HTTPS migration SEO checklist is done. Impressions and clicks should move from the HTTP property to the HTTPS one while the total stays roughly steady. Check the Index Status and Sitemaps reports, and fix crawl errors as they appear.

Google says the move happens on a per-URL basis and is only complete when Googlebot has visited every URL on the old and new site at least once. Keep your 301 redirects live for at least a year. If traffic has not settled after two months, work through this HTTPS migration SEO checklist again from step one, because something above is still wrong.

Which redirect should you use for an HTTPS move?

The redirect choice is the one decision in this HTTPS migration SEO checklist that shapes the whole move.

Redirect	What it tells Google	Use it for HTTPS?
301 Moved Permanently	The move is permanent, and ranking signals pass to the new URL	Yes, the right choice
302 Found	The move is temporary, so Google keeps the old URL in its index	No, never for a migration
308 Permanent Redirect	Permanent like a 301, and it keeps the request method unchanged	Yes, a sound alternative

Verdict: use a 301 for the whole site, or a 308 if your server setup favors it. That choice sits at the center of any HTTPS migration SEO checklist. Never use a 302 for a permanent move, and never mix redirect types across sections of the same site.

What to do next

Run through the list, and do not skip a step. A missed redirect map or an untested certificate is how a routine HTTPS migration SEO checklist turns into a traffic problem.

1. List every URL on your site from the sitemap, server logs, and analytics, and build the redirect map.
2. Install and test the certificate on staging, then fix mixed content before launch day.
3. Switch on one-hop 301 redirects, update canonicals, links, and the sitemap to HTTPS.
4. Add the HTTPS property in Search Console and submit the new sitemap.
5. Watch both properties daily, keep redirects live for at least a year, and hold off on HSTS until the site has run clean.

Frequently asked questions

Will switching to HTTPS hurt my rankings?

No, not when you follow an HTTPS migration SEO checklist. Google says 301 and other permanent redirects do not cause a loss in PageRank, so a clean one-hop redirect for every URL keeps your signals intact. Expect short-term fluctuation while Google recrawls your pages, then rankings should settle.

How long does an HTTPS migration take to settle in Google?

Google says a medium-sized site can take a few weeks or more before new URLs largely replace old ones, and larger sites take longer. Speed depends on your URL count and server speed. Keep redirects live for at least a year while Google finishes the swap.

Do I need the Change of Address tool in Search Console for HTTP to HTTPS?

No. Google says you do not need the Change of Address tool for a protocol-only move on the same domain. That tool is for domain name changes. For HTTPS, add and verify the HTTPS property in Search Console, then submit a sitemap with HTTPS URLs.

What is mixed content and why does it break the padlock?

Mixed content is an HTTPS page that loads images, scripts, or stylesheets over HTTP. MDN explains that browsers block scripts and stylesheets loaded this way and may upgrade or block images, so parts of the page can break or the padlock can vanish. Serve every resource over HTTPS.

Should I use a 301 or a 302 redirect for HTTPS?

Use a 301. A 301 redirect tells Google the move is permanent, so ranking signals pass to the HTTPS version. A 302 says the move is temporary, so Google keeps the old HTTP URL in its index. A 308 is also permanent and works the same way.

When should I turn on HSTS?

Turn on HSTS only after every step above is verified and the site has run clean on HTTPS for a while. HSTS tells browsers to always use HTTPS for your domain. It is hard to reverse, so enabling it early can lock in a mistake for months.

Sources

Site Moves and Migrations (Google Search Central). Mixed content (MDN Web Docs). Strict-Transport-Security header (MDN Web Docs). Why HTTPS matters (web.dev). Sources checked November 2026.

Want a second pair of eyes on your move? Get a free SEO audit and we will review your redirects, canonicals, and Search Console setup before launch day, or contact Rank OG to talk it through.