HTTP to HTTPS and host migrations

Three related changes

This guide covers three common technical moves that change how your site is reached, without necessarily changing its content:

• HTTP to HTTPS: moving to a secure connection.
• www to non-www, or the reverse: choosing one hostname.
• Changing hosting provider: moving the site to a new server.

Each is usually straightforward, but mistakes can make pages unreachable or create duplicates.

Moving to HTTPS

HTTPS encrypts the connection between the visitor and your site. Browsers label plain HTTP pages as "Not secure", and Google uses HTTPS as part of its page experience considerations. Any site taking enquiries or payments should use it.

Steps

1. Get a certificate. Many hosts provide free certificates through Let's Encrypt. Install it for every hostname you use, including www and non-www. 2. Update internal links to use https://, or relative links. 3. Fix mixed content. Images, scripts and stylesheets loaded over http on an https page trigger browser warnings and can break the page. Update them to https. 4. Redirect all HTTP URLs to their HTTPS equivalents with permanent (301) redirects, page by page, not to the home page. 5. Update canonical tags to the HTTPS versions. 6. Update your XML sitemap to list HTTPS URLs. 7. Add the HTTPS property in Search Console if you use URL prefix properties. A Domain property covers both automatically. 8. Consider HSTS, a header telling browsers to always use HTTPS. Only add it once everything works, as it's hard to undo quickly.

Google treats an HTTP to HTTPS move as a site move with URL changes. Its site move guide applies.

Choosing www or non-www

Neither is better for SEO. What matters is choosing one and sticking to it:

• Redirect the other version to your chosen one with permanent redirects.
• Use your chosen version in canonical tags, sitemaps and internal links.
• Use it on your Business Profile and directory listings.

If both versions load without redirecting, you have duplicate content and split signals.

Changing hosting provider

Moving hosts without changing URLs is the least disruptive type of move. Google's guidance on moving a site without URL changes covers it.

Steps

1. Set up the site on the new host and test it fully using a temporary address or hosts file. 2. Check the new server's speed and reliability. 3. Lower the DNS TTL in advance so the change takes effect faster. 4. Switch DNS to the new host. 5. Keep the old host running for a short period, in case some visitors and bots still reach it. 6. Monitor Search Console's Crawl stats for errors and response time changes.

You may see a temporary change in crawl rate as Google adjusts to the new server. That's normal.

What to check after any of these moves

• Every old URL redirects directly to the right new one, without chains.
• No redirect loops. Test http://, https://, www and non-www combinations.
• The certificate is valid for all hostnames.
• No mixed content warnings in the browser.
• Forms, payments and logins still work.
• Analytics still records visits.
• Search Console shows no spike in errors in the Page indexing report.

A worked example

A dental practice moved its website to HTTPS using its host's free certificate. The home page loaded securely, so the practice assumed the job was done.

A month later, the practice noticed patients reporting "Not secure" warnings on the booking page. The page loaded an old booking widget over HTTP. Several older pages also weren't redirecting: the host had redirected only the home page.

The developer set up a site-wide rule redirecting every HTTP URL to its HTTPS version, updated the booking widget to load securely, ran a crawl to find other mixed content and updated the canonical tags and sitemap. Search Console showed the HTTPS URLs being indexed and the HTTP ones dropping out over the following weeks.

Timing your move

Pick a quiet period for any of these changes. Avoid your busiest season, the run-up to a big campaign or a week when the person who manages your site is away. Make the change early in the week so problems can be fixed during working hours. Take a full backup first, and write down the current settings for DNS, redirects and certificates so you can roll back if needed.

Common mistakes

• Redirecting all HTTP URLs to the HTTPS home page.
• Forgetting the www or non-www version when installing the certificate.
• Leaving canonical tags pointing to HTTP.
• Chaining redirects: http://www to http:// to https://.
• Letting a certificate expire. Set up automatic renewal and a reminder.

Questions