I did a migration from http:// to https:// for a big site with more than 2 million of URLs indexed on Google.
As others have mentioned I'm also experiencing a bit of fluctuation on organic traffic (-10% as measured by Google Analytics).
Things i did so far:
- 301 redirect from HTTP to HTTPS URLs
- Added
https://www
andhttps://
versions of the site on Google Webmasters Console. - Submitted new sitemaps with the new URLs and left other sitemaps with old
http://
URLs
I'm now considering implementing HSTS and including the site on the HSTS Chrome preload list to increase security, however since HSTS makes all traffic going to http://
redirect to https://
with a 307 Internal redirect, wouldn't that prevent Googlebot to see the 301 redirects?