Technical eligibility · Branch T.C, Render, mobile, performance and security
T-09 HTTPS must be the baseline security standard
The public site must be served over HTTPS under a single canonical protocol. There must be no mixed content or certificate problems.
- Scope
- All public content
- Priority
- Gate. A FAIL stops publish or launch.
- Quality bucket
- Technical eligibility
- Legacy coverage
- SEO-44
Why it matters
Certificate errors and mixed content trigger browser warnings that put visitors off and can block parts of a page from loading. Serving the same pages over both HTTP and HTTPS splits signals between duplicate versions. Search engines and AI answer engines expect a secure, consistent site, as set out in Google's basic Search requirements.
How to implement
- Redirect all HTTP URLs to HTTPS with a 301.
- Find and remove mixed content by loading every resource over HTTPS.
- Set up monitoring so certificates are renewed before they expire.
- Use HTTPS as the only protocol in canonicals, sitemaps and internal links.
Checklist
- Redirect HTTP to HTTPS with a 301.
- Remove mixed content.
- Monitor certificate renewal.
- Use a single canonical protocol.
How to audit
- Check that every HTTP URL redirects to its HTTPS equivalent with a 301.
- Scan pages for mixed content and check the certificate is valid.
- Check that canonicals, sitemaps and links all use the HTTPS protocol.
How UltimateSEO checks this automatically
Automated. Checked automatically: https on every crawled URL, http-to-https redirect behaviour, HSTS header and mixed-content references.
States used: PASS, FAIL, UNKNOWN, NOT_APPLICABLE or BLOCKED. UNKNOWN is never shown as a pass. How states work.
Sources
Part of The UltimateSEO Framework v4.1, revised 2026-10-07. Evidence states, control states and the publish gate are explained on the hub.