Part of the Website Security Checklist for SEO series. This post goes deep on the single most common point of failure: HTTPS that's "technically on" but quietly broken.
Why HTTPS Mistakes Are More Common Than You Think
"We have HTTPS" is one of the most confidently wrong statements in SEO. A green padlock on the homepage doesn't mean the rest of the site is clean. I've audited sites that installed an SSL certificate years ago and never checked again — accumulating mixed content, broken redirect chains, and silent certificate issues the whole time.
None of these mistakes require an attacker. They're configuration drift: a plugin update that hardcodes an old HTTP image URL, a CDN that was set up before the migration, a redirect rule someone added and forgot about. Each one is small. Together, they add up to real ranking and trust damage.
Mixed Content Errors
Mixed content happens when an HTTPS page loads any resource — image, script, stylesheet, font, iframe — over plain HTTP. Modern browsers block "active" mixed content (scripts, stylesheets) outright and flag "passive" mixed content (images) with a warning icon in the address bar.
- Check every page type — homepage, blog posts, product pages — not just one sample
- Search your database or CMS for hardcoded
http://URLs, especially in older content - Update embedded third-party widgets (maps, video embeds, fonts) to their HTTPS versions
- Use protocol-relative or absolute HTTPS URLs going forward, never hardcoded HTTP
Expired & Misconfigured Certificates
Free certificates from Let's Encrypt auto-renew every 90 days — but only if the renewal automation is actually working. I've seen renewal cron jobs silently fail for months until the certificate finally expired and took the whole site offline with a browser security interstitial.
- Confirm auto-renewal is actually executing, not just configured
- Certificate covers every subdomain in active use (wildcard SSL if you have several)
- Certificate chain is complete — missing intermediate certificates cause errors on some browsers/devices even when others show no issue
- Set a calendar reminder to manually verify status every 60 days regardless of automation
Don't trust "it worked last time." Certificate automation is exactly the kind of thing that fails silently. A 5-minute manual check every two months catches it before visitors do.
Redirect Chain Problems
Every redirect hop adds latency and dilutes link equity. The classic failure pattern looks like: http://example.com → http://www.example.com → https://www.example.com → https://example.com. That's three redirects to reach the final URL, when it should be one.
- Pick one canonical version (HTTPS + your preferred www/non-www) and redirect everything else directly to it
- Test old URLs, old sitemaps, and backlinks — they often still point to outdated HTTP versions
- Use 301 (permanent) redirects, never 302, for protocol and domain canonicalization
- Re-check after any domain or hosting migration — this is when chains most often appear
Missing HSTS & Security Headers
HSTS (HTTP Strict Transport Security) tells browsers to never even attempt an HTTP connection to your domain again, closing the brief window where a user's first request could be intercepted before the redirect fires.
- HSTS header is present and includes subdomains if applicable
- Consider HSTS preload listing once you're confident the configuration is stable
- X-Content-Type-Options and X-Frame-Options headers are set as a baseline
How to Audit Your Site for HTTPS Issues
| Tool | What It Catches | Cost |
|---|---|---|
| SSL Labs Server Test | Certificate chain, protocol support, configuration grade | Free |
| Screaming Frog | Site-wide mixed content and redirect chains | Free up to 500 URLs |
| Browser DevTools Console | Mixed content warnings, per-page | Free |
| Google Search Console | Indexing issues tied to redirect problems | Free |
Run a full crawl, fix what surfaces, then fold a quarterly re-check into the broader security checklist routine. HTTPS isn't a box you tick once — it's a setting that quietly drifts if nobody's watching.
Need Help with SEO, AEO or GEO?
Let's build a visibility strategy that works across Google, AI answers and generative search.
Start a Free Consultation