Skip to content
Browse all guides

Issue #1 · critical

Issue 1

What is this issue?

This issue checks whether your website forces secure connections over HTTPS and has a valid, trusted SSL/TLS certificate installed.

What this issue checks

  • Your site is accessible over HTTPS (not just HTTP)
  • The SSL/TLS certificate is present, valid, and trusted by major browsers
  • The certificate is not expired (or expiring within 14 days)
  • The server uses modern TLS protocols (TLS 1.2 or higher)
  • HTTP traffic automatically redirects to HTTPS

What is considered a passing implementation

A passing implementation means:

  • Your site responds over HTTPS
  • A valid SSL/TLS certificate from a trusted Certificate Authority is installed
  • The certificate is not expired or about to expire (within 14 days)
  • The server uses TLS 1.2 or TLS 1.3
  • HTTP requests redirect to HTTPS

Real-world example

When a user visits http://example.com, they should be automatically redirected to https://example.com, and the browser should show a padlock icon indicating a secure connection. The certificate should be issued by a trusted Certificate Authority like Let's Encrypt, DigiCert, or Sectigo.

Why does it matter?

HTTPS is fundamental to website security and SEO for several reasons:

Crawlability

If browsers block access due to certificate errors, search engine crawlers cannot access your pages, leading to deindexing.

Indexability

Similar to crawlability issues, if your HTTPS configuration is broken, search engines cannot properly index your pages.

Rankings

Google uses HTTPS as a ranking signal. Sites with secure connections get a slight ranking boost over equivalent HTTP sites.

User Experience

Modern browsers display "Not Secure" warnings for HTTP sites, which scares away visitors and increases bounce rates. When certificate validation fails, browsers show hard-blocking errors that prevent access entirely.

AI Search / AEO

AI-powered search engines and assistants prioritize secure sites, as they rely on HTTPS to verify content authenticity and protect user data during retrieval.

SEO Health Score Impact

Resolving this issue improves your overall SEO health score by ensuring your site is accessible, trustworthy, and compliant with modern web standards. A valid SSL certificate is the foundation of website security.

How to fix it

Follow these steps to enable HTTPS with a valid SSL certificate:

Step 1: Obtain a trusted SSL/TLS certificate

Obtain a trusted SSL/TLS certificate from a Certificate Authority (CA) such as:

  • Let's Encrypt (free)
  • DigiCert
  • Sectigo

Step 2: Install the certificate

Install the certificate on your web server, load balancer, or CDN according to your hosting provider's instructions.

Step 3: Configure HTTP-to-HTTPS redirect

Ensure all HTTP traffic automatically redirects to HTTPS using a 301 or 302 status code.

Step 4: Enable automatic certificate renewal

Set up automatic certificate renewal to prevent expiration. For Let's Encrypt, use Certbot or similar tools to automate renewal.

Step 5: Use modern TLS protocols

Enable modern TLS protocols (TLS 1.2 or TLS 1.3) and disable deprecated protocols like TLS 1.0, TLS 1.1, and SSLv3.

Step 6: Test your configuration

Test your configuration using SSL Labs to verify the certificate is valid, trusted, and properly configured.

Step 7: Monitor certificate expiry

Set up alerts at least 30 days before expiration to ensure timely renewal.

Examples

Example 1: Missing HTTPS

Problem: A website only serves content over HTTP, not HTTPS.

What fails:

http://example.com (no HTTPS available)

What passes:

https://example.com (HTTPS enabled with valid certificate)

Example 2: Expired Certificate

Problem: The SSL certificate has expired.

What fails:

Certificate expired on 2024-01-15

What passes:

Certificate valid until 2025-01-15

Example 3: No HTTP to HTTPS Redirect

Problem: HTTPS is available, but HTTP doesn't redirect to HTTPS.

What fails:

http://example.com (serves content over HTTP)
https://example.com (serves content over HTTPS)

What passes:

http://example.com → 301 redirect → https://example.com

How PixyScan detects this

PixyScan checks whether your website forces secure connections over HTTPS and has a valid, trusted SSL/TLS certificate.

Detection process

PixyScan follows these logical steps to identify HTTPS and SSL certificate issues:

  1. Check HTTPS accessibility - PixyScan attempts to access your website over HTTPS to verify it's available and responding.

  2. Validate SSL/TLS certificate - If HTTPS is accessible, PixyScan checks the SSL/TLS certificate to confirm:

    • A certificate is present
    • The certificate is valid and trusted by major browsers
    • The certificate expiration date is valid (not expired or expiring within 14 days)
    • The certificate is issued by a trusted Certificate Authority

  3. Verify TLS protocol version - PixyScan checks which TLS protocol version your server uses to ensure it meets modern security standards (TLS 1.2 or TLS 1.3).

  4. Check HTTP to HTTPS redirect - PixyScan verifies that HTTP traffic automatically redirects to HTTPS, ensuring all visitors use secure connections.

When the issue is flagged

The issue is flagged when any of these conditions are met:

  • Your site cannot be accessed over HTTPS
  • No SSL certificate is detected
  • The SSL certificate is invalid or untrusted
  • The certificate expires within 14 days
  • The server uses outdated TLS protocols (TLS 1.0, TLS 1.1, or SSLv3)
  • HTTP traffic does not redirect to HTTPS

When the issue passes

The issue passes when:

  • Your site is accessible over HTTPS
  • A valid SSL/TLS certificate from a trusted Certificate Authority is installed
  • The certificate is not expired or about to expire within 14 days
  • The server uses TLS 1.2 or TLS 1.3
  • HTTP requests automatically redirect to HTTPS

References