Book a Growth Call

Blog

Why an http homepage still costs you trust (and how to fix it)

By Keith Motte, Topofmind.AI. Former AWS Enterprise Support Manager (Healthcare and Life Sciences). Last updated Nov 4, 2026.

Short answer: if your homepage still loads at http:// instead of https://, Chrome flags it as "Not secure," and a customer about to call you sees that warning first. [1][2] The fix is routine: turn on a free certificate from your host or Let's Encrypt, send every http address to its https version, update your canonical tags and sitemap, then recheck Google Search Console. [3][4][5]

What does "Not secure" actually mean?

HTTP and HTTPS are the two ways a browser can load your site. HTTPS adds encryption, which scrambles the data between the visitor and your site so others on the network can't read or change it. A certificate is the small file that proves your site is really yours and makes that encryption work.

Chrome shows a security symbol to the left of the web address. Its help page lists three states: "Default (Secure)," "Info or Not secure," and "Not secure or Dangerous." [1] Since Chrome 68 in July 2018, Chrome has labeled every plain HTTP page "Not secure." [2] So an http homepage gets the warning in the most visible spot on the screen.

Why does this matter for a local business?

Think about who's on your site. Someone with a broken AC in August. Someone booking a first med spa appointment. A homeowner checking out a contractor before letting them in the house. A buyer about to send a realtor their phone number.

These people are deciding whether to trust you, often in a few seconds and on a phone. A "Not secure" label next to your name works like a trust tax: a small extra doubt, charged on every visit, that they didn't have on the site of the competitor one result down. Nobody can measure how many calls you lose to it on your particular site, and I won't make up a number. But it's an easy doubt to remove.

There's a search side too, and I'll keep it accurate:

  • In 2014 Google announced it would use HTTPS as a ranking signal, calling it "a very lightweight signal" that carried "less weight than other signals such as high-quality content." [6]
  • Google's current page experience guidance asks "Are your pages served in a secure fashion?" among its self-check questions, and notes that aspects beyond Core Web Vitals "don't directly help your website rank higher" but make a site more satisfying to use. [7]
  • When the same page exists at both addresses, Google "prefers HTTPS pages over equivalent HTTP pages" as the main version, unless something like a bad certificate gets in the way. [5]

So HTTPS won't rescue weak pages. The main reason to switch is trust. Keeping Google's records tidy is a side benefit.

How do I move from HTTP to HTTPS?

Do these in order. On most small-business hosting this is an afternoon of work, much of it waiting.

  1. Get a certificate. Check your hosting control panel for "SSL," "TLS," or "Let's Encrypt." Let's Encrypt is a free certificate authority, and it notes that for many people "their hosting provider will get and manage certificates from Let's Encrypt for them," either automatically or with a setting you switch on. [3] If you run your own server, Let's Encrypt recommends the Certbot tool for most people. [3] Make sure the certificate covers both yoursite.com and www.yoursite.com. Google warns against a certificate for "the wrong host-variant." [5]
  2. Load the https version and look around. Visit https://yoursite.com. Check your homepage, contact form, booking widget, and any page that takes payments.
  3. Fix mixed content. Mixed content is when an https page still pulls images or scripts over plain http. Browsers may then show the page as not secure or block those files. [8] Update old image and script links to https. WordPress users can often fix this by updating the site address in Settings and running a search-and-replace plugin.
  4. Force the redirect. Set a permanent (301) redirect so every http address goes to the matching https address. Google recommends server-side permanent redirects such as 301 or 308, sending each URL straight to its final destination rather than through a chain. [4] Many hosts have a "Force HTTPS" switch for this.
  5. Update canonical tags. A canonical tag is a line in a page's code that tells Google "this is the main version of this page." Each page should point to its own https address. Google lists an HTTPS page with a canonical pointing back to HTTP as a conflicting signal. [5] SEO plugins usually update this once the site address is https.
  6. Update your sitemap. A sitemap is the file that lists your pages for search engines. Make sure it lists only https URLs. Google says not to include the HTTP versions of your pages in your sitemap. [5]
  7. Update the links you control. Your Google Business Profile website field, social profiles, email signature, and any ads. Google's site move guide suggests updating internal links, profile links, and ad landing pages. [4]
  8. Recheck Search Console. Make sure your https site is verified. Google suggests verifying all variants. [4] Then open the HTTPS report (it appears only for your https:// or Domain property). Google says ideally "your site should have no HTTP URLs" there, and lists fixes for errors such as "HTTP marked with canonical tag," "Sitemap points to HTTP," and "HTTPS has invalid certificate." [9] Submit the updated sitemap. [4]
  9. Keep the redirects. Google recommends keeping redirects "for as long as possible, generally at least 1 year." [4] For a local business, just leave them on.

Expect some ranking movement for a few weeks while Google recrawls. Google says this is normal during a site move. [4]

How I found this in the first place

I spent 30 years in corporate America, the last 7 at AWS, and the habit I brought with me is checking the boring stuff on a schedule. For Topofmind.AI, I automated a check for information gaps on the site, then wrote content to fill them. An http homepage is the kind of gap that shows up right away in a check like that, and it's one of the fastest to close. The automation spots it, and a person still decides what to fix and how to explain it to the owner.

Frequently asked questions

Do I have to pay for an SSL certificate?

Usually not. Let's Encrypt issues free certificates, and many hosts set them up for you or let you switch them on in the control panel. [3] Paid certificates exist, but a typical local service site doesn't need one to get rid of the "Not secure" label.

Will switching to HTTPS hurt my Google rankings?

Google says rankings can move around for a while during any site move as it recrawls, and that 301 and other permanent redirects "don't cause a loss in PageRank." [4] Google also says a small to medium-sized site can take a few weeks for most pages to move. Updating redirects, canonicals and your sitemap together keeps the signals clear. [4][5]

Does HTTPS make my site rank higher?

Google called HTTPS a very lightweight signal when it announced it in 2014, and says strong content matters more. [6][7] Switch for the trust and security your visitors get, not for a ranking boost.

My site already shows a padlock. Am I done?

Mostly. Also check that typing http://yoursite.com redirects to https, that your Google Business Profile links to the https address, and that Search Console's HTTPS report shows no HTTP URLs. [9]

Sources for this page

  1. Google Chrome Help: Check if a site's connection is secure. https://support.google.com/chrome/answer/95617
  2. Chromium Blog: A secure web is here to stay (Feb 8, 2018). https://blog.chromium.org/2018/02/a-secure-web-is-here-to-stay.html
  3. Let's Encrypt: Getting Started. https://letsencrypt.org/getting-started/
  4. Google Search Central: How to move a site (site moves with URL changes). https://developers.google.com/search/docs/crawling-indexing/site-move-with-url-changes
  5. Google Search Central: How to specify a canonical URL (Prefer HTTPS over HTTP). https://developers.google.com/search/docs/crawling-indexing/consolidate-duplicate-urls
  6. Google Search Central Blog: HTTPS as a ranking signal (Aug 7, 2014). https://developers.google.com/search/blog/2014/08/https-as-ranking-signal
  7. Google Search Central: Understanding page experience in Google Search results. https://developers.google.com/search/docs/appearance/page-experience
  8. web.dev: What is mixed content? https://web.dev/articles/what-is-mixed-content
  9. Google Search Console Help: HTTPS report. https://support.google.com/webmasters/answer/11396518

Next step

Your website is one half of the first impression. Your Google Business Profile is the other half, and often the part people see first. Run the free Google Business Profile audit to check it, or book a 30-minute Growth Call if you'd like help with the switch. More on how we handle local SEO and Google Maps. If you'd rather build checks like this yourself, join TopofmindAI Builders on Skool.

Book a Growth Call