Is there any significant ranking penalty for using 302 redirects to force HTTPS?

Question

We have a site with:

• Decent ranking on certain targeted keywords.
• An HTTPS-only policy, which uses 302 redirects to force clients onto the secure version of any URL.
• Internal links using HTTPS, so there is no redirection.
• Some, but not all, external links from other domains use HTTPS. The rest do not and will of course be subject to the 302.
• Google is only indexing the HTTPS version of each URL. Even if you search specifically for the HTTP URL, only the HTTPS URL is shown in the results.

Will there be any significant, immediate ranking benefit to changing our site to use 301 redirects to enforce HTTPS? Are there any statements from Google, Matt Cutts or other authorities on this specific situation?

Based on my research the difference should be minimal since we are already well indexed, and our internal links are fine, so Google is not going to apply a sitewide penalty for the 302s, which are, in effect, only the first link in the chain.

Answer 1

The problem with 302 redirects are that they are temporary, which often results in both pages being indexed in Google - The page you are redirecting from and the page you are redirecting to. If both pages are indexed in Google then that is problem as you have a duplicate page indexed.

As mentioned here: Google's page on HTTP status codes

302 (Moved temporarily). This code is similar to a 301 in that for a GET or HEAD request, it automatically forwards the requestor to a different location, but you shouldn't use it to tell the Googlebot that a page or site has moved because Googlebot will continue to crawl and index the original location.

So although you mention all your internal linking will use https, but external links inevitably will be with http, so Google is going to find some http links and 302 redirects, which could result in duplicate pages being indexed.

Here is video from Matt Cutts where he attempts to answer the question weather there are problems ranking sites that use https. Although he doesn't mention your question specifically, he does touch on the point that if doing this correctly, you should be using 301 redirects.

Can switching to HTTPS harm ranking?

So to summarise you should not be using 302 redirects to force http, you should be using 301 redirects.

Answer 2

I took a quick look at our latest keyword rankings report. This report is produced manually in-house based on the actual result rank we achieve for searches on Google for specific keyword phrases that we are targeting. (A top 10 rank is obviously desirable as it puts us on the first page of results, a top 6 is even better as it puts us above the fold on most monitors, and anything less than a top 50 is almost worthless because so few users click that far into the results.) Currently we are tracking 17 different phrases on a weekly basis. I think this report gives us the most direct way to measure our SEO results.

I compared our rankings on our August 2nd report to our August 15th report; the change went live on August 8th. The result is that out of 17 different phrases, only 2 improved in the rankings, 6 remained the same, and 9 decreased. Overall, the magnitude of the moves down and up were not terribly dramatic. Of course, in the time between the reports, we were also making the normal adjustments that any business makes to its content, and competitors were doing the same, so it's impossible to determine exactly how much difference the 301 made versus the 302 for us. But based on these results, the direct answer to my question about specific, immediate ranking benefit is that there probably is none. These results suggest that in the following situation, Google is smart enough to know that a 302 really means a 301:

• 302 is redirecting to the HTTPS version of the same URL
• HTTP version is no longer accessible
• Google search results are only showing HTTPS version, not HTTP
• Google site tools still show some residual PageRank for the HTTP version (I discovered this after posting the question) possibly because external sites are still widely linking to your HTTP version

If your situation matches all the above criteria, there is reason to believe that Google is not penalizing you for the 302's. That agrees with the opinion of at least one SEO consultant company, who says:

Google recognizes that many people use 302 when they really mean 301. Fortunately, Google isn't bound by any law to take people literally. For the sake of producing the best possible search results, Google can and should look at 302s and figure out if the webmaster really means 302, or if it's run-of-the-mill confusion and they really mean 301.

I would definitely like to see some more experiments situations where the 302 is consistently going to the HTTPS version of the exact same URL, and the HTTP version is no longer accessible. I found a similar experiment, with a slightly different situation, which proved that 302 does indeed confer some page rank, especially if the source and target pages are relevant to eachother. (In our situation, the pages were identical, which may explain why we were doing OK with the 302's.)

All that said, there is no good reason to use 302's for permanent redirects if you can help it, and we will be sticking with 301's. In our case, our ASP.Net code was doing the redirects via Response.Redirect(), and the default behavior in ASP.Net is to use a 302. Only with .NET 4.0 did Microsoft add a convenient Response.RedirectPemanent() method. Until then you had to manually write the 301 header, PHP-style, and most of our developers did not bother since they were used to redirects within application workflows, to which 302's are well suited. But we are happy to be using 301 redirects everywhere we can now.