Currently look after 3 websites. I changed one of them to be HTTPS as it's ecommerce, however have seen a huge drop in organic traffic since this was implemented. Went from around 800 impressions to 400.

Any ideas as to why?

Very concerning as I expected it to improve if anything!

I set up 301 redirects to carry through to old pages to http://www.example.com/product1 would go to https://www.example.com/product1

I also set up a separate webmaster account for the HTTPs version as our integration wasn't working well with Google Merchant Centre, and data is flowing correctly but unsure why/if this would cause conflict.

Very confused!

  • 1
    How long ago did you flip the switch to HTTPS? – nathangiesbrecht Apr 2 '15 at 15:31
  • 1
    Rant: The google "SSL Everywhere will get you better rankings" is yet another one of their empty promises designed to expedite a much needed change in practices of the web-o-sphere. We will see the EXACT same thing happen in April with "Mobile Everywhere". Empty promise of better rank....they just want more mobile webs, thats all. The same ol crappy un-optimized sites will dominate first slots regardless of if they are mobile. Lets not even talk about all the "We are reducing spam results" talk. Love to hear Muellers input on this: Google say is not Google do ;) – dhaupin Apr 2 '15 at 18:00
  • 2
    @dhaupin Your opinion flies in the face of all facts. Mobile is now a major factor in online usage and, in many cases, dominates the landscape. Malicious and spam attacks have always been a problem. Both SSL and mobile-friendly addresses both those issues whether Google was around to support it or not. – Rob Apr 3 '15 at 13:05
  • 2
    @Rob Facts, oh really? Show me proof of your facts ;) I see no rank change....and actually most OPs who went SSL have less impressions according to the many many forum posts and things. As far as spam, SERPS are full to the brim of spammer sites like this one taking slot #2 woodstove-fireplaceglass.com Check out all those spam keywords. So if the SSL and SPAM updates didnt change the habitat, i think that the mobile ranking promise is a white lie too. The SERPS wont really change much. Indeed that is opinion – dhaupin Apr 3 '15 at 14:00
  • 1
    Did you notice a corresponding drop in income? – MrWhite Apr 30 '15 at 15:21

I've supported HTTPS on my websites for about two years now, but I'm just starting to experiment with the HTTPS versions in search engines. For my sites, I have always had the HTTP version as the canonical (using link rel canonical tags) but allowed users to navigate to either HTTP or HTTPS.

On March 18th, I switched that for one of my sites. I made HTTPS the canonical, but still allow users to use HTTP. So far it looks like there is a slight drop.

HTTP

The HTTP site has fallen out of the search results over the course of a week.

HTTP site search queries in Google Webmaster Tools

HTTPS

The HTTPS site has come up in the search results, but it is not getting quite as many impressions as the HTTP site got.

HTTPS site search queries in Google Webmaster Tools

Keep in mind that these graphs are measuring different time periods. The HTTP site was averaging about 225 impressions per week. The HTTPS site is getting about 178 impressions per week.

I'm planning to continue to monitor this site for a couple months, but at this point I'm hesitant to roll out HTTPS for search engines on my larger sites because it appears that getting Google fully switched over may be problematic.

EDIT:

After letting it run for a month, traffic is back up to where it was before the HTTPS migration:

enter image description here

EDIT:

By 2018 I have moved all my sites to HTTPS. My largest site was the last to move and I found a way to do it without losing traffic. I would now suggest the following procedure for moving from HTTP to HTTPS:

  1. Make the site available under both HTTP and HTTPS simultaneously. Don't implement redirects to start with.
  2. Point the canonical tags to HTTPS.
  3. Google will switch over, but slowly. Monitor progress in Google Search Console. Verify both HTTP and HTTPS properties in Google Search Console.
  4. Once Google has indexed almost the entire site on HTTPS, redirect HTTP to HTTPS. For my largest site it took Google about 8 months to index 90% of the URLs as HTTPS. At that point I implemented the redirects. The pages that were left to move over didn't have enough traffic that I noticed any drop at that point.
  • Very interesting, thanks. Though not entirely the answer I was hoping for! When you mention 'allowed users to navigation' - what exactly do you mean by this? As in, if they type in https:// it'll take them through as normal? – Adam301 Apr 2 '15 at 15:51
  • I don't redirect users to one or the other. Whichever the user is on, they stay on. So if they visit the HTTPS site they get encryption, but if they visit the HTTP site, they don't. I point search engines to the one that I want them to index with the canonical link tags. – Stephen Ostermiller Apr 2 '15 at 15:55
  • 2
    Google has way more secret herbs and spices than the colonel we can only guess what Google is doing with our site profiles. Its been many years since penguin first hit and I still see thousands of sites that are worthy of top rankings outranked by old sites that lay dormant for years, that offer out of date information, lack user experience and are slow as hell. Content is king is only true once you have an audience. – Simon Hayter Apr 2 '15 at 18:38
  • 2
    I'd love to answer the question of "why", but I'm not sure that its possible. The best I can do is provide evidence that they may have done everything right and that it could just be the way that Google works. – Stephen Ostermiller Apr 2 '15 at 23:57
  • 1
    I do not use 301 redirects between HTTP and HTTPS. A user would have to type it, or find a link to be able to use the one that isn't in Google. Here is my site that has canonical tags for HTTPS: passwordcreator.org. Here is my largest site that still has rel canonical tags for HTTP: coinmill.com. I don't have any canonical tags on my personal site ostermiller.org. Google started indexing the HTTPS version of it instead of the HTTP version in the last few weeks without me doing anything. Traffic to it is down as well, but that may be seasonal. – Stephen Ostermiller Apr 7 '15 at 10:19

So you support all the bleeding edge encryption, got an A+ on Qualys, that is awesome. But did ya'll check your analytics for XP users, specifically using IE or Chrome? Its no secret that XP is a dog that dies slow when connecting to modernized sites. Its also no secret that IE and Chrome on XP (or even old version of android browser) are very much limited to what they can do with SSL.

Here are some examples of situations that would cause reduced HTTPS traffic:

  • You didn't set up GWT, analytics, and other services to correctly see the HTTPS change and its not actually dropping off. False positive, this is the most common error.

  • You run multi-tenant server and rely on server name indicator (SNI) to serve your certs. Old IE and Android browsers will not connect. Bots might not understand what it is.

  • Because of all the exploits this summer, you have turned off SSL2/3 support and opt only for TLS. Fringe or un-updated browsers may fail.

  • You wanted to enable forward secrecy to get unique keys during handshakes. Heck make it "robust" forward secrecy. Very old IE on XP will be asking "WTF is that" and prob fail.

  • You are supporting only the most badarse ciphers and have ousted the old ones. Cloudflare is a great example of this -- because of ECDHE neither IE nor Chrome will be able to connect on XP. Must use Firefox in this case, which often, XP users (senior citizens, indian colleges, enterprise call centers) do not know how, or are not allowed to install.

  • You have a yellow lock on too many pages. This makes people scared and they run away to a site that is actually secure (green lock). Can attempt to amend this by HSTS below (hides the asset instead of making broke lock), but then you risk broken site instead of just broken lock.

  • You are enforcing HSTS and XP users might not be able to use it. Also, if HSTS is blocking an insecure source, it completely removes it from the page. Perhaps there is a critical blocked element (such as a piece of content loaded with script/AJAX) and you might not even realize its gone.

  • You have implemented a CSP but XP users might not be able to use it, or its error'd out causing a similar issue as the HSTS blocked content above. Your lock looks green, you might not even realize all your inline styles are disabled so a critical script such as add to cart becomes broken or blocked.

Possible other causes:

  • Certain search engines, directories, scanners, etc are unable to crawl your site with such security. Example, BingBot only recently (Jan 2015) started to understand SNI and [P]FS. There are TONS of directories and things that simply do not understand how to crawl your SSL site -- example seobook.com. If there are errors, they may remove your backlink, even though its their fault for not updating their crappy CURL schema.

  • You got a ton of traffic from badbots, but now they are staying away for the same reason: they run XP, use IE6 wrapper, crappy CURL, unable to crawl, unable to spam. Or perhaps they are an exploit scanner, they see HTTPS and they leave immediately. Dont underestimate the amount of traffic from badbots, its huge.

  • You have an SSL cert in the RSA128 sunset realms and certain browsers are displaying the warnings that you are using weak encrypt. The browser may still allow them to connect, but will do the "something is wrong" flag on the address bar. Try your site through all the latest version browsers.

  • You have SSL implemented -- but poorly, inconsistent, and switches are too slow. This is a pretty common error of judgement: Folks think that you can just redirect with htaccess, set a canonical, and be good to go. What about all your assets like dynamic menus, image sources, etc? What about your feed generators? What about just about anything else your platform does? Make darn sure that your platform is rendering EVERY link/src as HTTPS or relative url at the least...otherwise bots will be confused and/or double connecting causing increased handshakes, increased redirects, and more lag (de-ranked due to pagespeed).

  • Too many redirects chained together. Google hates redirects when they chain over 2-3. So if you are using 301 SSL, this eats one off the bat. If you redir to WWW mode, thats another. If you then redirect to new content, thats another. If there is anything in between, youre playing with fire. Check the 3 minute mark of this vid: https://www.youtube.com/watch?v=r1lVPrYoBkA

  • Google is blatantly lying about the ranking signal from SSL and it actually doesn't effect anything at all. All my cards are in on this bet.

  • That is a good checklist of things that could go wrong with HTTPS. There doesn't seem to be any ranking benefit for HTTPS as far as I can tell despite what Google has said. As far as mobile goes, I'm willing to bet that the mobile friendly change will have a bigger impact on rankings. Google is planning to start rolling that out in a couple weeks, so we'll know more then. – Stephen Ostermiller Apr 9 '15 at 15:48
  • @StephenOstermiller I really hope so my friend :) We have trouble with spam/scrape sites in our niche holding 1-3 positions through every single update that is supposed to knock them lower. The one in particular looks/acts/feels like some keyword inject from the 90's, stuffed scraped content, run insecure, not mobile...They actually raised rank after the last round of anti-spam refreshes. The mobile de-rank is the last hope to knock their piece of crap (and semi-useless) sites out of top results....at least in the mobile queries. – dhaupin Apr 9 '15 at 16:09
  • Keep in mind that Google has said that the mobile friendly algorithm will only effect search results for mobile devices, so unfortunately it shouldn't knock your spam problem out for desktop users. – Stephen Ostermiller Apr 9 '15 at 16:19

HTTPS doesn't send the referrer header. Such traffic will therefore be lumped in with 'direct' traffic.

  • 1
    Thanks - this may explain some of the drop off, though overall traffic has still fallen. – Adam301 Apr 7 '15 at 8:19
  • That should only effect Google Analytics data and not data from Google Webmaster Tools. – Stephen Ostermiller Apr 9 '15 at 15:49
  • 1
    "HTTPS doesn't send the referrer header." - This isn't strictly true. The browser may default to not sending the Referer header when navigating from HTTP to HTTPS. If you are navigating from a site that is also HTTPS then the Referer will probably be sent. – MrWhite Mar 12 at 17:12
  • @MrWhite when you say "probably be sent" is circumstances where it is / isnt sent ? Or is it random ? – sam Aug 20 at 10:30
  • @sam Computers are never "random" ;). The user can prevent the HTTP Referer header being sent by the browser. And the Referrer Policy allows websites to prevent the Referer header being sent (or restricted) as well. – MrWhite Aug 20 at 12:06

Time for an update!

It's not 100% resolved, however having updated the sitemap and robots.txt to ensure that all were pointing to HTTPS, traffic is now at about 85% of what it was.

It seems to be gradually climbing again, and one explanation for lower traffic/searches is due to seasonal demand. So I think for now the issue is resolved, though I'm certainly in no rush to change over sites in future to HTTPS where not needed...

I changed three of my websites from http to https and all of them entirely different niche aswell. 301 redirects and google webmaster tools site change and even all the internal links that were posted using http in the url were changed to https over night.

New https pages started appearing in serps within a few days and all http pages were gove in a months time and all the pages showed up with https. Traffic dies for a few weeks then recovered after a month or so but even after waiting for a good 5 months the traffic never reached to levels at the time of changing. In total a drop of more then 40% as compared to http version after 5 months of waiting.

I changed this site back to http and redirected all the https pages back to http. Took about a month for traffic to reach the orignal levels.

Lesson learnt : Google is lying about ranking boost for ssl pages. I do not sell anything and have no money transactions or personal info changing hands on any of my websites so I dont need ssl.

  • 1
    Worth noting, that site has several SSL issues which aren't going to do you any favours. – Andrew Lott Apr 9 '15 at 9:57
  • I do not have any ssl on this site any more. As mentioned in my reply above, I removed it after 5 months and brought back the site to non ssl. – Parminder Singh Chahal Apr 9 '15 at 16:50

I could imagine (by a far stretch here) that the "bots and spammers" people don´t like https because it drains more resources on there end (too) so they just crawl and visit http.

  • Is there any evidence for this? – Andrew Lott Sep 18 '15 at 7:30

HTTPS does not improve traffic in any way, shape or form. It's a secure protocol and nothing else. No different, otherwise, from HTTP. If you want Google to combine the results for both http and https, you have to do that in webmaster tools AND, better, redirect your http traffic to https. Then your totals will be added together instead of separately tracked.

  • 1
    All HTTP traffic is being directed to the HTTPS site which is why I'm slightly confused by the drop off! – Adam301 Apr 7 '15 at 8:20
  • Using HTTP is a small ranking factor in Google, so potentially it could improve traffic. Although most people report it doesn't. – Max Apr 7 '15 at 10:22

You may want to test if your webserver is configured properly to serve HTTPS. If not configured correctly, it is possible that the browsers are throwing a warning page to the users and the users are choosing not to visit your site.

Tools such as this one from Qualys SSL Labs can tell you if there is an issue. Aim for an A rating

  • Having looked into this the certificate we were running seems to be poor, however is being updated. Unfortunately it's handled by our agency so not something I can update directly. – Adam301 Apr 17 '15 at 7:59

protected by Community Sep 18 '15 at 7:42

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.