Check 21 of 23 · Does it deliver?

Your site uses https

https is the padlock in the browser bar. Every modern browser and every AI system treats a site without it as untrusted. Most hosts turn it on free.

  • Who fixes itYou can do this
  • TimeAbout 10 minutes
  • Worth5 of 100 points
  • How sure we areProven

What this is

Look at the address bar in your browser. A site address starts with either http:// or https://. The “s” means secure. It is the padlock icon.

With https, everything between the visitor and your site is scrambled so nobody in the middle can read or change it. To get the “s,” your site needs a certificate. That is a small file that proves your site is really yours. Most hosts issue one free and renew it for you.

Why it matters to you

This is a 5-point check, and it is one of the few where the evidence is solid.

Browsers show a “Not secure” warning on plain http. Google has preferred https for years. AI crawlers and live agents follow the same rule: plain http is treated as untrusted, and some will not fetch it at all.

There is a second problem. If your site answers on both http and https, the same page exists at two addresses. Links, citations and mentions get split between the two copies. See Plain http sends people to https.

What we look for

We load your homepage and see where we end up.

  • Pass: the final address starts with https://.
  • Fail: the final address starts with http://. You keep 1 point of 5.

There is no warn. Either the padlock is there or it is not.

Whether you can fix this yourself

Yes, usually. For most site owners this is a switch in the hosting control panel, and it is free.

Wix, Squarespace, Shopify and SimplePractice all include https on every site. If you are on one of those and failed this check, the most likely cause is a custom domain that was not fully connected. Search your platform’s help for “SSL” or “connect domain.”

If your host does not offer free certificates, it is time to ask why. Nearly every host has since 2018.

How to fix it

WordPress

  1. Log in to your hosting control panel (cPanel, or your host’s own dashboard). Look for “SSL,” “Let’s Encrypt” or “AutoSSL.” Turn it on for your domain.
  2. In WordPress, go to Settings, then General. Change both the WordPress Address and Site Address from http:// to https://. Save.
  3. Old links inside your pages may still say http://. A plugin such as Really Simple SSL fixes those in one click.

Squarespace or Wix

Both are https by default. Open your domain settings and confirm the domain shows as connected and secure. If it says pending, wait up to 48 hours after connecting.

Shopify

Shopify issues the certificate when you connect your domain. Online Store, then Domains. If the SSL status is “Pending,” wait. If it stays pending for days, the domain’s DNS records are likely wrong. Shopify’s help page for “SSL pending” has the exact records.

Your own site or a developer

Install a certificate (Let’s Encrypt is free and automated with certbot). Then redirect all http traffic to https. Most hosts do this in one click.

How to check it worked

Open your site. Look for the padlock in the address bar and https:// at the front. Click the padlock. It should say the connection is secure. Then run the free check again.

Do not worry about

The type of certificate does not matter for this check. A free one from Let’s Encrypt counts exactly the same as a paid one. You do not need an “extended validation” certificate, and nobody can tell the difference.