HTTPS

What this check looks for

This per-page check reads the scheme of the crawled page's URL. Any page served over http:// fails. A page served over https:// passes.

Why it matters

HTTPS encrypts everything exchanged between a visitor's browser and your server, protecting against interception and tampering on the network in between — without it, anyone on the same network path can read or modify the page as it loads. Google has treated HTTPS as a ranking signal since 2014, and modern browsers actively warn visitors with a "not secure" label on HTTP pages, which drives people away before they even see your content. AI crawlers and answer engines increasingly weigh HTTPS the same way search engines do: it's a basic, table-stakes trust signal, and pages still served over plain HTTP look outdated in a way that colors how the rest of the site is evaluated.

How to fix it

Deploy a TLS certificate and serve every page over HTTPS:

# Most hosting platforms and CDNs provision certificates automatically
# (Let's Encrypt, managed TLS on Cloudflare/Vercel/Netlify, etc.)

# nginx: redirect any remaining HTTP requests to HTTPS
server {
  listen 80;
  return 301 https://$host$request_uri;
}

Check every page individually, not just the homepage — a partial migration that leaves some sections on HTTP is a common gap this check catches.