I would like to know if it is necessary, to avoid Google penalties and chrome warnings, by enabled HTTPS on a website that does not have a login page or a form.

In some cases the website can have a search field form that is needed just to enter a search term.

  • 1
    A search box is text input. Nov 16, 2017 at 12:54
  • 3
    security.googleblog.com/2017/04/… says "Eventually, we plan to show the 'Not secure' warning for all HTTP pages", so even if your HTTP site doesn't show warning messages now, it will eventually. Nov 16, 2017 at 12:58
  • 1
    I think it's an overkill to use HTTPS for a site that doesn't deal with personal information. And besides, HTTPS takes a bit longer to load than HTTP because of the extra handshake to create the secure connection. Nov 17, 2017 at 5:57
  • 1
    I think it's overkill to put a lock on a house that doesn't contain jewelery. And besides, locks take longer to open than knobs because of the extra turn required for the key. There are other important reasons for website encryption besides personal information. Governments and ISPs shouldn't be able to log every URL that gets requested over a monitored network. Nobody should be able to insert ads into pages without the user and the site knowing it. Webmasters should be able to know that their content isn't altered before it reaches users. Nov 17, 2017 at 19:08
  • Related: Force using SSL on site now?
    – unor
    Nov 23, 2017 at 0:19

2 Answers 2


Google just announced that ALL HTTP sites will be marked as insecure by Chrome starting in July 2018 with Chrome 68. Chrome will start showing warnings on your site unless it uses HTTPS, regardless of whether you have any form or ask users to input data.

Even today your HTTP site will be marked as insecure if users can type data into it (even into a search box). All HTTP sites are marked as insecure by Chrome in incognito mode.

There is also a Google search engine ranking factor tied so HTTPS. Google has said they give a very slight advantage to HTTPS sites over HTTP sites in the search results. The effect is so small, that migrating to HTTPS does not usually cause a ranking bump. In fact, in many cases there are temporary ranking drops as Google digests the redirects. I recommend introducing HTTPS and running it in parallel with HTTP initially. Set the canonical URLs to point to HTTPS during this period.


Since your site does not collect sensitive information Chrome will not display a warning about an unsecured connection.

As far as SEO goes a secured site tends ranks better than non-secured sites.

Consider securing your site anyways you can use Let's Encrypt

Let’s Encrypt is a free, automated, and open certificate authority (CA), run for the public’s benefit. It is a service provided by the Internet Security Research Group (ISRG).

  • 1
    I like your advice, but your first sentence is wrong. security.googleblog.com/2017/04/… says "Passwords and credit cards are not the only types of data that should be private. Any type of data that users type into websites should not be accessible to others on the network, so starting in version 62 Chrome will show the 'Not secure' warning when users type data into HTTP sites." That search box will cause a warning because users can type in it. Nov 17, 2017 at 19:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.