Skip to content
Log inTest my visibilityStart free trial
Log in
Language English
Start free trial Test my visibility

Serve the page over HTTPS with a valid certificate

Authority Updated Oct 4, 2026

Description

This criterion checks that your page is served securely: its final address starts with https://; its certificate is valid, covers the site’s name and does not expire within 14 days; the http:// address redirects to https://; the Strict-Transport-Security header enforces HTTPS for at least six months; no resource of the page is loaded over http://.

A page without HTTPS or with an invalid certificate gets the “Poor” status, whatever the other points.

Why it matters for AI engines

AI engines send people to the pages they cite. If the address triggers a security warning, the visit is lost; if the content can be altered on the way, your text can no longer be trusted. HTTPS encrypts the exchange between your server and whoever reads the page, visitors and crawlers alike.

  • An expired certificate, or one that does not cover the site’s name, makes the secure connection fail: the browser shows a warning instead of the page.
  • Without HTTPS, an intermediary can read or alter the page on the way, for example to inject ads into it.
  • Browsers block scripts and stylesheets loaded over http:// on an HTTPS page: the page may display incompletely.

How to fix it

  1. 1 Serve the page over HTTPS Install a certificate on your website, or turn on the HTTPS option of your host or CMS. Let’s Encrypt issues free certificates, and many hosts obtain and manage them for you. Then update internal links, the canonical and the sitemap to the https:// addresses.
  2. 2 Keep the certificate valid The certificate must be issued by a trusted authority, with its full chain, and cover the site’s exact name, with or without www depending on the address you use. Automate its renewal: iPand flags a certificate that expires in less than 14 days.
  3. 3 Redirect http:// to https:// Set up your server or host so that every http:// address returns a permanent 301 redirect to the same address over https://. Visitors and crawlers who follow an old link then land on the secure version.
  4. 4 Turn on HSTS Add the Strict-Transport-Security header to HTTPS responses with a max-age of at least 15768000 seconds, that is six months, for example max-age=31536000 for one year. Browsers will then go straight to HTTPS on later visits. Test with a short duration first, then move to six months or more.
  5. 5 Load every resource over HTTPS Replace the http:// addresses of images, scripts, stylesheets, fonts and iframes with their https:// version, or with relative addresses for your own files. Your browser’s developer console reports any mixed content left.

Key takeaway

HTTPS lets visitors and crawlers read your page without warnings or tampering. iPand checks every day the address served, the certificate, the redirect, HSTS and the page’s resources.

Further reading