HSTS and SEO: What It Does (and Doesn’t Do) for Your Rankings

HSTS (HTTP Strict Transport Security) usually gets filed under security. It’s a response header that tells browsers a site must only ever be loaded over HTTPS. It also has a real SEO role, and a couple of common misunderstandings about it can cost you if you get them wrong.

Here’s what HSTS does and doesn’t do for SEO, based on Google’s own documentation and what we see in technical SEO audits.

What HSTS actually does

When a browser loads your site over HTTPS and sees the Strict-Transport-Security header, it stores a rule for as long as the header’s max-age says. From then on, if anyone types or clicks an http:// link to your site, the browser rewrites it to https:// before sending anything. In Chrome’s developer tools that shows up as a “307 Internal Redirect”.

That 307 never comes from your server. It’s the browser enforcing a rule it has remembered, which is the key to understanding the SEO side.

1. HSTS is a canonicalization signal

Every page on an HTTPS site can technically exist at two addresses, http:// and https://. Google treats these as duplicates and picks one as canonical. Google says it prefers HTTPS pages as canonical “except when there are issues or conflicting signals”.

Google’s guide to consolidating duplicate URLs lists three ways to make sure the HTTPS version wins: redirect HTTP to HTTPS, add a canonical tag from the HTTP page to the HTTPS page, and implement HSTS. So HSTS is one of the signals Google itself recommends for this.

In practice this is where we’ve seen HSTS help. Sites with HTTP versions still appearing in Search Console, split signals between the two versions, or the odd HTTP URL in the index tend to clean up once redirects, canonicals and HSTS all point the same way.

2. HSTS does not replace your 301 redirects

This is the mistake to avoid. Googlebot doesn’t keep an HSTS list. Google’s John Mueller has explained that Googlebot crawls URLs “with a fresh slate” and accesses the HTTP URL directly, and that the 307 HSTS redirects are browser-only, not real redirects it follows.

So Googlebot still needs a server-side 301 redirect from every HTTP URL to its HTTPS equivalent. That’s what passes signals from old HTTP links to your HTTPS pages and what Google uses to discover the move. HSTS sits on top of that redirect for real visitors; it never replaces it.

3. HSTS can’t fix a broken HTTPS setup

Google is clear that some problems make it prefer HTTP very strongly, and that “implementing HSTS cannot override this strong preference”:

• an invalid or expired SSL certificate on the HTTPS version
• HTTPS pages that redirect to or through an HTTP page
• HTTPS pages with a canonical tag pointing to the HTTP version
• insecure (HTTP) resources loaded on the HTTPS page, other than images

Fix these first. HSTS on a site with any of them is just one signal outvoted by the others.

4. The indirect wins: speed and trust

• Faster visits from old links. Any visit that starts on an http:// link normally costs a full round trip to your server for the redirect before the page starts loading. With HSTS the browser upgrades instantly. HSTS also makes sure every visit uses HTTPS, which is the only way browsers use the faster HTTP/2 and HTTP/3 protocols. Our sister company WP Speed Fix covers this in how HSTS can reduce your TTFB.
• Security scores. Scanners such as Qualys SSL Labs and Mozilla Observatory check for HSTS, and SSL Labs only gives an A+ to sites that send it. Plenty of SEO and site audit tools flag a missing HSTS header too. It isn’t a ranking factor in itself, but it’s expected as basic security practice, and clients, agencies and payment providers notice.

How to check HSTS in an SEO audit

• Check the header. Load the final HTTPS URL (after any www or non-www redirect) and look for Strict-Transport-Security in the response headers, with a max-age of at least six months.
• Check the 301 is still there. Request the http:// URL with a tool that doesn’t keep HSTS state (curl, or a crawler) and confirm it returns a 301 straight to the HTTPS URL, not a chain.
• Watch your crawler settings. Screaming Frog has a Respect HSTS Policy option. With it on, HTTP links show as 307 HSTS Policy redirects, which can hide whether the real 301 exists. Run a crawl with it off to see what Googlebot sees.
• Check Search Console. Look in the Pages report for HTTP URLs that are indexed or chosen as canonical. That’s the sign the signals are still mixed.

How to turn HSTS on

Make sure the site works fully over HTTPS with a valid certificate first, because browsers will refuse to load it over HTTP once HSTS is on. Then:

• Cloudflare: SSL/TLS, then Edge Certificates, then HTTP Strict Transport Security (HSTS). Walkthrough in this WP Speed Fix guide.
• Plesk hosting: the domain’s SSL/TLS Certificates screen has an HSTS switch. Step-by-step instructions are in WP Alpha’s guide to enabling HSTS. A header set on the server still reaches visitors when the site is behind Cloudflare.
• Other hosts: ask your host to add the header, or add it in the server configuration.

Start with a max-age of six months and leave includeSubDomains and preload off until you’re sure every subdomain runs on HTTPS.

The bottom line

HSTS won’t jump you up the rankings on its own. What it does is remove one source of duplicate URLs, back up your redirects and canonicals with a signal Google explicitly recommends, speed up visits from old links and tick a security box that audits and customers now expect. Ten minutes of work for that is an easy call, as long as you keep your 301s in place.

If you’d like a full technical review of how your site handles HTTPS, redirects and canonicals, take a look at our SEO audit tools guide or get in touch.

FAQ

Is HSTS a Google ranking factor?

Not directly. HTTPS is a lightweight ranking signal, and HSTS supports it by making sure the HTTPS version is the one Google treats as canonical.

Does Googlebot follow HSTS?

No. Googlebot doesn’t store HSTS rules and crawls HTTP URLs directly, so it relies on your 301 redirects.

Can HSTS hurt SEO?

Only if HTTPS is broken. If your certificate expires or a subdomain has no certificate, browsers will refuse to load the site for visitors who have the HSTS rule. Keep certificates auto-renewing and be careful with includeSubDomains and preload.