# R9 | anthropic/claude-opus-5 | run 2

## Prompt

Explain the practical difference between HTTP and HTTPS for a website owner, and cite a source.

## Response

HTTPS is HTTP wrapped in TLS encryption, and for a site owner the practical consequences are trust signals in the browser, protection of visitor data, access to modern performance features, and a small search-ranking edge. In 2026, running plain HTTP is effectively a liability — certificates are free and browsers actively shame unencrypted sites.

## What Actually Changes

| Factor | HTTP | HTTPS |
|---|---|---|
| Data in transit | Plain text, readable by anyone on the network | Encrypted between browser and server |
| Browser UI | "Not Secure" label in the address bar | Padlock, no warning |
| Search ranking | No credit | Minor positive signal |
| Referral analytics | Referrer stripped on HTTPS→HTTP hops, inflating "direct" traffic | Referrer preserved |
| Modern protocols | No HTTP/2 or HTTP/3 in practice | Required for HTTP/2, HTTP/3, service workers, geolocation |
| Payment/form handling | Unsuitable; fails PCI DSS | Required baseline |

## The Ranking Question

Google confirmed HTTPS as a ranking factor in 2014, but was explicit about its weight: it was described as a very lightweight signal affecting fewer than 1% of global queries and carrying less weight than signals such as high-quality content [Google Search Central](https://developers.google.com/search/blog/2014/08/https-as-ranking-signal). That weight has not meaningfully increased. HTTPS remains a ranking factor without additional weight since 2014, and sits alongside other UX signals in Google's page experience considerations [AIOSEO](https://aioseo.com/https-and-seo/).

Importantly, Google has confirmed HTTPS is not considered when indexing a site — it is only a lightweight ranking signal and has no effect on whether a page enters the index [Radd Interactive](https://raddinteractive.com/the-impact-of-http-vs-https-in-seo/). Treat SEO as a bonus, not the reason to migrate.

## The Bigger Practical Drivers

**Browser warnings kill conversions.** Chrome began flagging HTTP sites as "not secure" in 2018, and other browsers followed with their own visual warnings [AIOSEO](https://aioseo.com/https-and-seo/). A visitor who sees that label on a checkout or contact form frequently leaves.

**Analytics accuracy.** Referral data is lost when traffic passes from an HTTPS source to an HTTP destination, so migrating preserves referral attribution in your analytics and allows accurate tracking of user behavior [Indexsy](https://indexsy.com/switch-from-http-to-https/).

**Speed, not slowdown.** HTTPS unlocks HTTP/2 and HTTP/3, which multiplex requests. This enables faster load times that can improve user experience and Core Web Vitals [Diffuse Digital](https://diffusedigitalmarketing.com/https-vs-http-seo/).

**Network eavesdropping is real.** On unencrypted public Wi-Fi, anyone on the same local network can packet-sniff and extract sensitive information about your visitors [SangFroid Web](https://www.sangfroidwebdesign.com/search-engine-optimization-seo/google-https-ranking/).

## Migration Checklist

- Get a free certificate via [Let's Encrypt](https://letsencrypt.org/) or your host's one-click SSL
- 301-redirect all HTTP URLs to their HTTPS equivalents
- Update all internal links — content, menus, and widgets — to HTTPS to avoid mixed-content warnings [Webstacks](https://www.webstacks.com/blog/https-and-seo-why-secure-websites-rank-higher)
- Update canonical tags, sitemaps, and hreflang to HTTPS
- Add the HTTPS property in Google Search Console, verify ownership, and declare it canonical [Webstacks](https://www.webstacks.com/blog/https-and-seo-why-secure-websites-rank-higher)
- Add an HSTS header once you've confirmed everything works
- Update Google Analytics and ad platform property URLs

One caveat on the numbers you'll see quoted elsewhere: claims like a "12% bounce rate reduction" from HTTPS circulate widely in marketing content but are correlational at best. The defensible case for HTTPS rests on security, browser trust indicators, and protocol access — not on precise conversion-lift figures.

Are you migrating an existing site, or setting up HTTPS on something new?
