2

I have a decision to make:

Option 1: Require HTTPS only on sensitive pages, and support both HTTP and HTTPS on other pages

Option 2: Require HTTPS on all pages without exclusions.

From security perspective option 2 would be the best choice of course. What I want to know is what this does to search engine ranking. Will HTTPS-only connection have any negative effects on SEO?

3

Any migration carries some degree of risk and short-term consequences; a move to HTTPS is no exception.

Rand Fishkin wrote an interesting post on Moz's experience moving to HTTPS. The short version of that story is that they initially lost about 11% of their organic search traffic, but recovered within 3 months. So yes, there can be at least some short-term negative effects.

It depends on your circumstances, but usually if I was considering a move to HTTPS I'd want to migrate the whole thing. It's very easy to end up in the situation where the 'secure' pages carry insecure elements, such as images served from a different (http) URL on the site. Users will see messages in the browser about not every element being secure, and you've left an attack vector of sorts there. So if you're doing a partial migration only, you do have to be particularly careful.

  • Nicely said!! I would add that the traffic loss could be more significant for the same period if the site depends more heavily on search as opposed to direct traffic. I know that is obvious, but sometimes you have to state the obvious! ;-) – closetnoc Jan 19 '16 at 13:17
  • @Stephan, are you saying that there are negative effects bound to changing/migration, but absolutely no negative effects of HAVING a https-only connection? – Alph.Dev Jan 19 '16 at 15:02
  • @Alph.Dev, yes: I've never come across any evidence that an HTTPS-only connection would inherently have negative effects. That would make very little sense. Google has been a big part of the push towards a more secure web and encourages all webmasters to move to HTTPS. The short-term negative effects you might see are down to the migration itself -- they're not an attempt to punish HTTPS-only connections. – Stephan Jan 20 '16 at 1:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.