Based on conflicting reports in other answers, I decided to test it myself. I started up Firefox with the Live HTTP Headers.
Then I went to Google (logged in, over https) and did a search for: https only website example
The first result in the search results is https://httpsnow.org/. Which is secure only. I clicked on it in the search results and used live http headers to record what happened:
https://www.google.com/search?q=https+only+website+example
https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0CDMQFjAA&url=https%3A%2F%2Fhttpsnow.org%2F&ei=6pJiUfLiMc_D4AOk_IGIBA&usg=AFQjCNF6xzmxiw4ko_9pC0KHSDU7qpcjmQ&sig2=RDWH8xFkPO2S1g_O1f7K7w
http://ocsp.startssl.com/sub/class2/server/ca
https://httpsnow.org/
Referer: https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0CDMQFjAA&url=https%3A%2F%2Fhttpsnow.org%2F&ei=6pJiUfLiMc_D4AOk_IGIBA&usg=AFQjCNF6xzmxiw4ko_9pC0KHSDU7qpcjmQ&sig2=RDWH8xFkPO2S1g_O1f7K7w
By the time the referrer reaches the web site that I clicked on, it no longer contains the query. The q=
parameter is blank. Google does not provide the keyword, even to https only sites.
This article outlines an easier way to test whether keywords are sent by search engine referrals:
- Search on Google for "what is my referrer" or "what is my secure referrer"
- Click on one the results that will tell you what referrer is passed
- See if the keywords are in the referrer URL
Using this methodology, I have once again confirmed that Google is not passing keywords to either insecure or secure sites.