Ever notice a small padlock icon in your web browser’s URL bar? That means you’re on a site running HTTPS, a secure way to allow websites to handle personal and financial data. If you run an ecommerce business, the protocol behind that little padlock icon is also what’s protecting your customers’ personal information.
Using HTTPS signals to users and search engines that you’re a legitimate, trustworthy business that invests in protecting its customers. In addition, if you aren’t running HTTPS, Google and most other search engines will flag your site as “not secure”—not a great first impression for potential customers.
If your store is still running HTTP, this guide will walk you through how to successfully migrate your site to its more secure alternative and why doing so matters for anyone in business on the internet.
What is HTTP?
Hypertext Transfer Protocol (HTTP), is what the web uses to communicate. It lets users and their web browsers request information from web servers. It underlies the whole process of accessing and providing information on the web, from loading websites to clicking on links, submitting forms, or loading images.
When you access any website using HTTP, all the information transmitted to your browser is sent as plain text. There’s no security or encryption for your data, making it vulnerable to malicious parties between you and the server. There’s also no built-in system for verifying whether anyone is tampering with the data, nor is there any encryption to protect personal information.
Except for the most basic informational websites, HTTP has become fairly outdated as a way to transmit information. In fact, web browsers like Chrome, Safari, or Firefox, discourage people from visiting unsecured websites that only use HTTP.
What is HTTPS?
Hypertext Transfer Protocol Secure (HTTPS) builds on the standard HTTP protocol by adding encryption. It creates an encrypted communication channel through an SSL or TLS certificate as you make a connection between your browser and the website you’re accessing. That “S” at the end of HTTPS (and the little padlock in the browser’s address bar) signifies a world of difference, ensuring your customers feel safe sending credit card information or other private data through an ecommerce site.
All the data sent between your browser and an HTTPS website is encrypted, authenticated, and verified. HTTPS ensures data integrity, can prevent man-in-the-middle attacks (i.e., when someone inserts themselves between the browser and server) when properly configured, and ensures the website is actually the one you intended to visit.
Why convert to HTTPS?
Not only does HTTPS provide the necessary protection for your users, making sure they can trust your e-commerce site, but it can also help in other ways as well.
Security and data protection
Running a secure shop and protecting your customers’ data are by far the biggest reasons to migrate your website to HTTPS. Any private data you need from your customers is secure due to the encrypted protection of HTTPS. Any site that handles user logins, payments, or other personal data should use HTTPS for security.
SEO performance
Google has made HTTPS a priority since 2014. It wants any site its users find through Google search to be secure, so site security is an element of the Google Search algorithm. Factors like trustworthiness and page speed sit right alongside site security as a current ranking factor. Having a secure site makes it easier for potential customers to find it via search.
Credibility
Browsers use different signals to warn users of unsecure sites: the padlock icon, a page warning, or even red/green URL bar color coding (i.e., red means stop and green means go).
If you aren’t using HTTPS, potential customers getting a “not secure” warning via Firefox or Chrome is a red flag your business doesn’t prioritize security. When faced with an unsecure site, customers will likely bounce back to the search results to find a safer shop.
Site speed
While the basic encryption of HTTPS can introduce slight delays in loading, there are many ways to make your site faster to load, including features like HTTP/2, which optimizes resource usage and bandwidth efficiency and uses compression algorithms that make the content smaller and faster to download, and various compression techniques, like Brotli or HPACK compression.
How to migrate from HTTP to HTTPS
- Buy and install a Secure Sockets Layer (SSL) certificate on your server
- Check your internal and external links
- Verify your site via Google Search Console
- Redirect HTTP URLS to HTTPS
- Update your XML sitemap
All Shopify stores use SSL encryption for all pages, not just payment processing. If your ecommerce store still uses HTTP, you can enable HTTPS to create a secure connection and protect communication between your site and your customers.
Here’s how to migrate from HTTP to HTTPS on your own server.
1. Buy and install a secure sockets layer (SSL) certificate on your server
Purchase an SSL certificate from a trusted certificate authority, like DigiCert, GlobalSign, or Let’s Encrypt. You’ll typically get a .crt or .pem file and an intermediate certificate or .ca-bundle file. If you generate the Certificate Signing Request (CSR) yourself, you’ll get a private key. Make sure you store that securely and don’t share it.
You’ll then upload the files you receive to your server in the following locations, depending on the type of server you’re running:
-
Apache/Linux: /etc/ssl/certs/ and /etc/ssl/private/
-
Nginx: Often in /etc/nginx/
-
cPanel/Plesk: Use the built-in UI
-
Windows/IIS:. Use the Microsoft Management Console (MMC)
Next, edit your virtual host file using Apache or Nginx. DigiCert has a helpful guide that lets you generate a CSR with OpenSSL and configure Apache with SSL.
2. Check your internal and external links
Make sure every link on your site uses https://, including internal and outbound links. Review your website’s HTML code to replace all http:// links with https://.
Update external resources like images, scripts, and Cascading Style Sheets (CSS) files that might still reference non-secure URLs. Most web development tools offer a search-and-replace function to help with this, and automated tools like Screaming Frog SEO Spider, Apify, and Browse AI can scan your site for HTTP references, letting you replace them with HTTPS.
3. Verify your site with Google Search Console
Let Google know your site is secure by using Google Search Console to validate it. It’s a free tool that shows how your site appears in search results and flags issues that could hurt your rankings. Log into Google Search Console with the Google account associated with your website. Then add your site either as a Domain (recommended for full site coverage) or as a URL Prefix (usually used if you only want to validate a specific section of your site).
To verify your domain ownership, you’ll add a DNS TXT record provided by Google. Log in to your domain registrar (like Shopify, GoDaddy, Namecheap, or Squarespace), find the DNS Settings or DNS management section, and add the TXT record. Save it, go back to Search Console, and click Verify.
If you choose URL Prefix, you can either upload an HTML file to your site’s root folder (typically via FTP) or paste a meta tag into your site’s <head> section. WordPress has SEO plug-ins that can do this for you, or you can edit the web pages yourself. After that, you’ll go back to Search Console and click Verify.
4. Redirect HTTP URLS to HTTPS
If you’re using a website builder like Shopify, Squarespace, Wix, or similar, your site settings typically have a section for enabling automatic HTTP to HTTPS redirects. Shopify, for example, includes a “Force HTTPS” option under Settings > Domains.
For WordPress, you’ll want to make sure you have an active, valid SSL Certificate (step one above), and then force HTTPS using a plugin like Really Simple SSL. You can also edit your .htaccess file manually. Download the .htaccess file from your server (usually in the public_html folder) via FTP or your host’s file manager, open it with a text editor, and add the following code at the top:
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>
This code directs the server to change all incoming HTTP requests to HTTPS using a permanent 301 redirect, which helps preserve SEO value by passing “link equity” from the old HTTP URLs to the HTTPS secure ones.
5. Update your XML sitemap
A sitemap helps Google and site users understand and navigate your website more easily. Make sure all links in the sitemap point to HTTPS versions of your pages. You can regenerate your sitemap using your CMS (like WordPress), a sitemap tool (like Screaming Frog), or an SEO plug-in (like Yoast SEO).
Your sitemap is typically in the root directory of your site and named something like /sitemap.xml. Your robots.txt file might also refer to the URL where the sitemap is located on your server.
Once you’ve updated the sitemap, you can log in to Google Search Console and paste the sitemap’s URL into the Add a new sitemap field. Hit Submit, and you’re all set.
HTTP to HTTPS FAQ
Should you redirect HTTP to HTTPS?
It’s a good practice to use HTTPS on your site, and redirecting your older HTTP pages to HTTPS versions is a great way to do it. A permanent 301 redirect ensures that any rank or SEO benefits your older HTTP pages had will still be valid as an HTTPS page. It also makes sure that any older references to your HTTP pages from places you don’t control (like social media or emails) will end up sending your users to pages on your site that use the more secure HTTPS protocol.
How do I convert HTTP to HTTPS?
Start by purchasing and installing an SSL certificate, then update all your site pages and URL references to HTTPS. You’ll then set up your server for HTTPS redirection, update your profile on Google Search Console, and update and re-submit your XML sitemap.
What happens if you use HTTP instead of HTTPS?
Your site will likely show a warning to visitors. This warning could scare off potential customers, impact your sales and revenue, and result in lower traffic from search engines. In addition, some browsers will block forms or scripts from loading via HTTP, impacting your site’s functionality.
