HTTPS as a Google ranking signal in 2026

Twelve years ago Google said HTTPS would help you rank, and hedged that statement so carefully it still reads as an understatement today. The company has never walked the announcement back, and it has never strengthened it in public either. What has changed is not Google’s language but the web underneath it: HTTPS went from a minority protocol to the default, which quietly settles the practical question even where the ranking question stays open.

What Google actually said in 2014#

The announcement is short and specific. On 7 August 2014, Google’s Search Central blog, under the byline of Zineb Ait Bahajji and Gary Illyes, confirmed that HTTPS had become a ranking factor after months of internal testing. The company’s own characterization of its strength has not been improved on since: “For now it’s only a very lightweight signal, affecting fewer than 1% of global queries, and carrying less weight than other signals such as high-quality content, while we give webmasters time to switch to HTTPS.” The post left the door open to strengthening the signal over time, as an incentive for adoption rather than a description of a current ranking mechanism.

Twelve years later, still lightweight#

Google’s current page experience documentation is the closest thing to an update. It asks site owners to self-assess whether “pages are served in a secure fashion” as one input among several, alongside Core Web Vitals, mobile-friendliness and the absence of intrusive interstitials. But the same documentation draws a sharp line: beyond Core Web Vitals, it states, other page experience aspects do not directly help a site rank higher in search results. HTTPS sits on the side of that line that Google says does not move rankings by itself. It still matters for user trust and for protecting the connection, which the documentation frames as aligned with what ranking systems reward indirectly, but that is a different claim than a direct ranking boost, and Google has not made the stronger claim since 2014.

What the adoption data shows now#

Whatever weight the HTTPS signal carries, it increasingly has little left to differentiate. Let’s Encrypt’s own stats page, sourced from Firefox Telemetry as a 14-day moving average, put the share of pageloads served over HTTPS at 83.67% globally as of 10 September 2026, rising to 96.23% for USA users and 94.48% for Japan users. Let’s Encrypt itself reported 683.5 million active certificates and roughly 7.65 million new certificates issued per day on that date. Separately, W3Techs’ SSL certificate authority survey, dated 11 September 2026, measured Let’s Encrypt as the certificate authority behind 64.2% of all websites it tracks, a 67.5% share of the certificate authority market once sites with no recognized authority are excluded. Both figures describe adoption near or above the point where a comparison between two competing pages would find them equally covered.

Why we care#

The honest summary has not changed in over a decade, only its practical stakes have. Google confirmed HTTPS as a ranking signal, called it very lightweight at launch, and has published no larger number since. That alone would argue against chasing HTTPS as a ranking lever. What has changed is the adoption curve: with most of the web already on HTTPS, the signal has less and less room to separate one page from another, because the comparison it was designed to break ties on is now a comparison between two pages that both qualify. Serve HTTPS because a plaintext site is a liability and a trust failure, not because it is a ranking strategy. If a site is still on HTTP in 2026, that is the finding worth acting on, not the size of the signal.