HTTPS: the ranking signal Google called lightweight, twelve years ago

What Google actually said in 2014, and what it never promised

Google announced HTTPS as a ranking signal on 7 August 2014, on its Search Central blog, then still called Webmaster Central. The announcement itself is careful about scale: as TechCrunch reported the same day, quoting Google directly, "Initially, HTTPS will only be a lightweight signal, affecting fewer than 1% of global queries," and the new signal "won't carry as much weight as other factors, including the quality of the content." Google framed the move as encouragement toward a safer web by default, not as a ranking lever site owners should expect to feel. Twelve years later, that is still the only official weighting Google has ever put a number on. No later announcement revised it upward, and nothing in Google's current developer documentation claims a stronger effect than the original post did.

The push that actually moved adoption wasn't the ranking signal

If the 2014 announcement had been the only incentive, HTTPS adoption might have crept forward slowly for years. What actually moved it was a browser decision four years later that had nothing to do with search rankings. On 24 July 2018, Google's Chrome team shipped Chrome 68, which began marking every plain HTTP page "Not secure" in the address bar for every user, not a test group. Google's own announcement of the change, published the same day, cited the adoption numbers already in motion: 76% of Chrome traffic on Android was encrypted, up from 42% the year before, 85% of ChromeOS traffic was encrypted, up from 67%, and 83 of the top 100 sites on the web were using HTTPS by default, up from 37. A visible warning in a billion browsers did more to move site owners than a ranking announcement that promised under 1% of query impact ever could.

Where adoption stands now, and why the ranking question stopped mattering

By the third quarter of 2026, HTTPS is no longer a signal that separates anyone from a competitor, because almost nobody is left on the other side of it. Cloudflare's Radar dashboard, pulled 1 October 2026, puts human web traffic at 98.86% HTTPS and automated or bot traffic at 88.26%, for a combined figure of 95.10% across all request types. W3Techs separately puts the share of websites that default to HTTPS at roughly 90%, though the exact pull date behind that figure was not visible to us in the reporting we could access. Google's own Transparency Report is widely cited elsewhere as showing close to 99% of Chrome page loads over HTTPS, a figure we could not pull directly ourselves this run, so take that number as commonly cited, not independently confirmed by us. However you measure it, every source agrees on the shape of it: the web crossed from mostly insecure to mostly secure years ago, and a signal built to nudge a minority toward the majority has nothing left to nudge. It is the same pattern our piece on whether Domain Authority still matters runs into from the other direction: Google names a number once, site owners keep asking about it for a decade, and the real answer stops being about the signal and starts being about what everyone else already did.

What switching still breaks, because this is a migration like any other

The remaining reason to take an HTTP-to-HTTPS switch seriously has nothing to do with the ranking signal. Changing a site's protocol changes every URL on it, which makes the move a real migration, with the same mechanics and the same risks as any other. Search Console still treats http:// and https:// as separate properties, so a site that switches without re-verifying and watching both can lose weeks of visibility data without losing any actual traffic. Mixed content, meaning an HTTP image, script or stylesheet still loading on an otherwise HTTPS page, is the most common way a site owner undoes their own migration, since modern browsers block or strip those resources outright rather than quietly tolerating them. Our guide to website migration without losing rankings covers the redirect and canonical mechanics in full, including the fact that Google's own documentation gives three different answers for how long to keep redirects live. And the stakes for getting the sequencing wrong are higher than most plans account for: our breakdown of what 1,052 real migrations show about recovery found that only 23% of sites recovered their traffic within 90 days, with a median recovery time of 304 days. A protocol switch is smaller than a full domain move, but the data above is about migrations in general, and nothing in it suggests a protocol-only change gets a pass.

What we could not verify

Google's Transparency Report is commonly cited as showing close to 99% of Chrome page loads over HTTPS, but we could not pull the dashboard directly this run to confirm the current figure or its date, so treat that number as widely repeated rather than independently checked by us. W3Techs' roughly 90% website-level figure reached us through a secondary source that did not show its own pull date, so read it as a rough snapshot rather than a precise one. And we found no official Google statement, before or after the 2014 post, that puts a specific updated number on how much HTTPS affects rankings today. "Lightweight, under 1% of queries" remains the only figure Google itself has published, and it describes 2014, not 2026.

A check worth running this week

1. Open your own site in an incognito window and look at the address bar. If it reads "Not secure," that is the thing actually costing you something right now, not a missing ranking signal.
2. Confirm the https:// property, not the http:// one, is what Search Console is reporting from. The two are tracked separately, and a site that switched years ago can still be watching the wrong property.
3. Check Chrome DevTools' console on your most important pages for mixed content warnings. One HTTP image or script sitting on an HTTPS page is still the most common way a site quietly undoes its own switch.

Sources

Google's original announcement is HTTPS as a ranking signal, Google Search Central Blog, 7 August 2014; the "lightweight signal" and "fewer than 1%" wording is quoted directly in Darrell Etherington, Google Says Website Encryption, Or Lack Thereof, Will Now Influence Search Rankings, TechCrunch, 7 August 2014. The Chrome 68 rollout and its adoption figures come from A milestone for Chrome security: marking HTTP as "not secure", Google Blog, 24 July 2018. The 2026 adoption figures come from HTTPS Adoption 2026: 98.6% of Human Traffic Is Encrypted, TechnologyChecker, reporting Cloudflare Radar data pulled 1 October 2026 alongside W3Techs figures.

Common questions