HTTPS & Web Security
TL;DR
HTTPS encrypts your site's traffic and is a confirmed Google ranking factor. Security headers like HSTS and CSP protect users and signal trustworthiness.
Explain Simply
HTTPS is like sending a letter in a locked box instead of a postcard — nobody can read it along the way. The padlock icon in your browser means the website is using this locked box.
HTTPS (HTTP Secure) uses TLS/SSL to encrypt data between browser and server. Key security headers: HSTS (forces HTTPS), CSP (Content Security Policy, prevents XSS), X-Frame-Options, X-Content-Type-Options.
Beyond encryption, security headers form a defense-in-depth strategy. HSTS tells browsers to always use HTTPS, preventing downgrade attacks. CSP restricts which scripts can execute, blocking cross-site scripting (XSS). X-Frame-Options prevents clickjacking by controlling iframe embedding.
Mixed content — loading HTTP resources (images, scripts) on an HTTPS page — breaks the security chain. Modern browsers block mixed active content and may warn about mixed passive content.
⚡Why It Matters
HTTPS has been a Google ranking factor since 2014. Chrome now warns 'Not Secure' on HTTP pages. HSTS prevents downgrade attacks, CSP protects against XSS — both are AI trust signals. Over 95% of pages in the top 10 Google results use HTTPS.
🔍How AiSEO Checks
AiSEO checks HTTPS redirect, SSL certificate, HSTS header, CSP policy, mixed content (HTTP resources on HTTPS page), and other security headers.
AiSEO Score Impact
Up to 5 points in the Security category (5% of total score)
Fix Difficulty
Editor: N/A | Developer: Easy | AI Agent: Easy