Serve the site over HTTPS
The padlock in the address bar — table stakes for trust, SEO, and browser features.
What it means
HTTPS encrypts traffic between the visitor and your site. Without it, browsers label the page 'Not secure' and networks between the visitor and you can read or alter the traffic.
Why it matters
Chrome and Firefox warn visitors away from non-HTTPS pages, Google uses HTTPS as a ranking signal, and payment or login flows are effectively impossible without it.
How to fix it
- Get a free certificate from Let's Encrypt — most hosts (and Cloudflare) issue and renew them automatically in the dashboard.
- Redirect all http:// traffic to https:// with a permanent (301) redirect.
- Update any hardcoded http:// links inside your pages and CMS to https://.
- Re-run the audit to confirm the padlock and check for mixed-content warnings (see our mixed content guide).
Helpful tools
- Let's Encrypt
- SSL Labs Server Test
- Cloudflare
Not sure if this affects your site? Analyze your website for free or compare it with a competitor.
Related guides
- Fix mixed content warnings: Some assets on your HTTPS page are still loaded over insecure HTTP.
- Add a privacy policy: Legally required in most jurisdictions, and a visible honesty signal.
- Add missing security headers: A few lines of server config that block common attacks and remove browser warnings.