HTTPS and trust
A browser marks an http site as not secure. Google described HTTPS as a lightweight ranking signal, not a shortcut to page one. Without the lock, forms and phone numbers travel on an open connection.
One secure version
The site should open on https, and the http address should 301 to that same secure URL. Two open versions side by side are duplicates: Google may index both.
An expired certificate shows a warning and drops trust. Renewal is part of sound hosting, not a surprise after a customer sees a red screen.
| State | What the visitor sees | What to do |
|---|---|---|
| Valid https | A lock | Keep it and redirect to it |
| Open http | A browser warning | 301 to https |
| Expired certificate | A red warning | Renew it with the host |
| Mixed content | A weak lock or a warning | Replace http URLs inside the page |