How to Fix: Site uses HTTPS

Site uses HTTPS is an SEO check in the Technical Foundation category. This is a critical issue that should be fixed immediately — HTTPS is not an optimisation, it is the price of admission to the modern web, and its absence undermines everything else you do.

What this check is really about

HTTPS encrypts the connection between your server and your visitor so nobody in between can read or tamper with it. This check verifies that your site is served over HTTPS with a valid certificate — and, just as importantly, that HTTP requests redirect to HTTPS and that no pages load insecure “mixed content” (images, scripts, or stylesheets still requested over plain http://). A padlock that only half-works is its own failure, and this check is looking for the whole chain being clean, not just a certificate existing somewhere.

Why it matters for SEO

Google confirmed HTTPS as a ranking signal back in 2014, and the ecosystem has only hardened since: browsers now mark plain HTTP pages as “Not Secure,” which visibly scares visitors off before they read a word. Any page collecting a form entry, a login, or a payment over HTTP is a genuine security and trust failure, not a theoretical one. Beyond ranking, HTTPS is a prerequisite for HTTP/2 and modern performance features, and for browser APIs that simply refuse to run on an insecure origin. This is foundational — get it wrong and no amount of content or link work compensates.

How I would fix it

Difficulty Level: MEDIUM – This fix requires some technical knowledge or familiarity with WordPress settings and plugins.

Estimated Time: 1 hr

1. Install a valid certificate. Most hosts offer free Let’s Encrypt SSL with one click; if yours does not make it trivial, that is a signal about the host worth acting on.
2. Update the WordPress Address and Site Address to https:// under Settings → General, then force a site-wide redirect from HTTP to HTTPS (host panel, .htaccess, or a plugin like Really Simple SSL).
3. Fix mixed content. Run a search-and-replace across the database (WP-CLI, or Better Search Replace) to update hardcoded http:// asset URLs to https://. This is the step people skip, and it is why the padlock stays broken.
4. Update every external reference that points at your site — canonical tags, sitemaps, your Search Console property (add the HTTPS property), Google Analytics, and any hardcoded links in themes or ads.
5. Verify with an SSL checker and a crawl: valid certificate, HTTP redirecting cleanly to HTTPS, zero mixed-content warnings in the browser console.

Recommended Tools & Plugins

• Yoast SEO – Comprehensive SEO plugin with built-in checks
• Rank Math – Feature-rich SEO plugin with detailed analysis
• Google Search Console – Free tool to monitor your site’s search presence
• SEO Roadmap – Complete SEO audit and action plan tool

What I would not do

• Do not treat a plugin like Really Simple SSL as the permanent fix. It is an excellent bridge, but the right end state is HTTPS set properly at the database and server level, with the plugin no longer masking mixed content.
• Do not forget the redirect. A certificate without a forced HTTP→HTTPS redirect leaves both versions live — duplicate content and an insecure door still open.
• Do not skip the mixed-content sweep. One hardcoded http:// script is enough to break the padlock on the whole page.
• Do not migrate without a backup. Search-and-replace on the database is powerful and unforgiving; snapshot first, ideally test on staging.

This guide is part of the SEO Roadmap knowledge base – your complete resource for WordPress SEO optimization.