HTTPS for Small Business Websites: What Is True Now

The padlock is now standard on the web. Here is what HTTPS does, what changed, and what to check on your site this week.

HTTPS, shown as https:// in the address bar, is now the standard for websites. If any page on your site still loads over plain HTTP, fix it this week. Most web hosts make this a simple setting. The steps below show you what to check.

What HTTPS does

HTTP is the basic set of rules the web uses to send pages. HTTPS is the secure form of it. A tool called Transport Layer Security, or TLS, makes it secure. According to MDN Web Docs, TLS lets a browser talk safely with a server across a network you cannot trust. First, the two sides do a short "handshake." They agree on a secret key. Then they use that key to scramble, or encrypt, every message.

This guards against what MDN calls a "manipulator in the middle" attack. That is when someone sits between a visitor and your site. They can read or change what passes through. CISA says that without https://, anyone with the know-how can see what data people share with a site. A CISA fact sheet adds that encryption is especially important on pages with forms or logins.

Your site also needs a digital certificate. It proves to the browser that it is talking to your real domain name. CISA explains that certificate authorities check the site and issue the certificate. These are trusted third parties. Visitors can view the certificate by selecting the padlock next to the web address.

What changed, and what is true now

CISA notes that as recently as the early 2010s, many websites began with http://. Today, all major websites start with https://.

Search played a part. In 2014, Google announced it would start using HTTPS as a ranking signal. At the time, the signal was very light. It affected fewer than 1% of global queries. It also carried less weight than signals such as high quality content. Google said it may make the signal stronger over time. That post is from 2014; Google did not share newer numbers there.

Browsers changed too. Here is what is true now, based on MDN:

• Browsers do not let a secure page load insecure parts, such as scripts, images or fonts. They either upgrade the request to HTTPS or block it. This problem is called mixed content.
• Many powerful browser features only work in a "secure context." MDN's defenses guide says this usually means the page came over HTTPS.
• Public logs list issued TLS certificates. This is called Certificate Transparency. It makes it easier to spot certificates issued by mistake or for harm.
• Modern web hosts support HTTPS by default or through a setting. They likely manage the certificate for you.
• MDN names a widely used nonprofit certificate authority that issues free TLS certificates.

What HTTPS does not do

HTTPS protects data on its way between the visitor and your site. CISA points out a limit. Someone watching network traffic can still see which sites a person visits. They cannot see what the person shares there.

HTTPS also does not cover what happens to data after it arrives. MDN's privacy guide advises sites to collect as little data as possible. It says to use data responsibly and to move and store it securely.

Steps to take this week

1. Check the lock. Open your site in a browser. Look for https:// and the padlock. Select the padlock to view your certificate.
2. Check your host. Log in to your hosting account. Look for an HTTPS or certificate setting. Turn it on if it is off.
3. Redirect plain HTTP. People may still type http:// by hand. MDN says to answer those requests with a 301 redirect. This tells the browser the page has moved for good. Google Search Central also says to use 301 redirects for permanent moves.
4. Fix mixed content. Make sure images, scripts, stylesheets and fonts all load from https:// addresses. MDN warns that an attacker could change an insecure script to do harm. Can you not edit old code? Your server can send a content security policy with the upgrade-insecure-requests rule. Browsers will then upgrade those requests to HTTPS.
5. Update your sitemap. A sitemap is a file that lists your important pages. Google says sitemaps help it find your pages and decide which to crawl first. Make sure it lists your https:// addresses.
6. Look at your forms. Ask only for the details you truly need.
7. If you run your own server, follow Mozilla's TLS Recommended Configurations, which MDN points to. Mozilla also offers a tool that writes settings files for many web servers.

How I can help

AppWT is based in Livonia, Michigan. AppWT has built more than 600 websites. For help with HTTPS, redirects and mixed content, the service is Website Security Services, starting price $497.

Have a question about anything here? Email me at sales@appwt.com or call (888) 565-0171, and I will answer it.

Sources

• Transport Layer Security (TLS) - Security | MDN, MDN Web Docs, 2026-02-28
• Tips to Stay Safe while Surfing the Web, Part 2: Accessing Websites Securely | CISA, Cybersecurity and Infrastructure Security Agency
• Hyper Text Transfer Protocol Secure (HTTPS) | CISA, Cybersecurity and Infrastructure Security Agency, 2023-07-17
• HTTPS as a ranking signal | Google Search Central Blog | Google for Developers, Google Search Central, 2014-08-07
• Defenses - Security | MDN, developer.mozilla.org
• Privacy on the web | MDN, MDN Web Docs, 2025-12-03
• Technical SEO Techniques and Strategies | Google Search Central | Documentation | Google for Developers, Google Search Central
• Website Security Services at AppWT, AppWT