Based on conflicting reports in other answers, I decided to test it myself. I started up Firefox with the Live HTTP Headers.
Then I went to Google (logged in, over https) and did a search for: https only website example
The first result in the search results is https://httpsnow.org/. Which is secure only. I clicked on it in the search results and used live http headers to record what happened:
By the time the referrer reaches the web site that I clicked on, it no longer contains the query. The
q= parameter is blank. Google does not provide the keyword, even to https only sites.
This article outlines an easier way to test whether keywords are sent by search engine referrals:
- Search on Google for "what is my referrer" or "what is my secure referrer"
- Click on one the results that will tell you what referrer is passed
- See if the keywords are in the referrer URL
Using this methodology, I have once again confirmed that Google is not passing keywords to either insecure or secure sites.