[Estimated read time: 6 minutes]

It's been almost two years (August 2014) since Google announced that HTTPS was a ranking signal. Speculation ran rampant, as usual, with some suggesting there was little or no benefit to switching (and possibly significant risk) while others rushed to sell customers on making the HTTPS switch. Two years later, I believe the data speaks for itself — Google is fighting, and winning, a long war.

What's happened since?

If you only consider the impact of Google's original HTTPS update, I understand your skepticism. Prior to the update, our 10,000-keyword tracking system (think of it as a laboratory for studying Google searches) showed that roughly 7% of page-1 Google results used the "https:" protocol. A week after the update announcement, that number had increased only slightly, to just over 8%:

The blue/purple show the before/after based on the announcement date. As you can see, the update probably rolled out over the course of a few days. Even over a 2-week period, though, the impact appears to be fairly small. This led many of us to downplay Google's statements and ignore HTTPS for a while. The next graph is our wake-up call:

As of late June, our tracking data shows that 32.5% (almost one-third) of page-1 Google results now use the "https:" protocol. The tiny bump on the far left (above "A-14" = August 2014) is the original HTTPS algorithm update. The much larger bump in the middle is when Wikipedia switched to HTTPS. This goes to show the impact that one powerhouse can have on SERPs, but that's a story for another time.

What does it mean?

Has Google rolled out multiple updates, rewarding HTTPS (or punishing the lack of it)? Probably not. If this two-year trend was purely a result of algorithm updates, we would expect to see a series of jumps and new plateaus. Other than the Wikipedia change and two smaller bumps, the graph clearly shows a gradual progression.

It's possible that people are simply switching to HTTPS for their own reasons, but I strongly believe that this data suggests Google's PR campaign is working. They've successfully led search marketers and site owners to believe that HTTPS will be rewarded, and this has drastically sped up the shift. An algorithm update is risky and can cause collateral damage. Convincing us that change is for our own good is risk-free for Google. Again, Google is fighting the long war.

Is our data accurate?

Of course, our tracking set is just one sample of search data. The trendline is interesting, but it's possible that our keywords are overstating the prevalence of HTTPS results. I presented a number of roughly 30% at SMX Advanced in mid-June. Later that same day, Google's Gary Illyes called me out and confirmed that number:

Gary did not give an exact figure, but essentially gave a nod to the number, suggesting that we're in the general ballpark. A follow-up tweet confirms this interpretation:

This is as close to confirmation as we can reasonably expect, so let's assume we showed up to the right ballgame and our tickets aren't counterfeit.

Why does 30% matter?

Ok, so about one-third of results use HTTPS. Simple arithmetic says that two-thirds don't. Projecting the trend forward, we've got about a year and a half (16–17 months) before HTTPS hits 50%. So, is it time to panic? No, probably not, but here's the piece of the puzzle you may be missing.

Google has to strike a balance. If they reward sites with HTTPS (or dock sites without it) when very few sites are using it, then they risk a lot of collateral damage to good sites that just haven't made the switch. If, on the other hand, they wait until most sites have switched, a reward is moot. If 100% of sites are on HTTPS and they reward those sites (or dock the 0% without it), nothing happens. They also have to be careful not to set the reward too high, or sites might switch simply to game the system, but not too low, or no one will care. However I feel about Google on any given day, I acknowledge that their job isn't easy.

If rewarding HTTPS too heavily when adoption is low is risky and rewarding it when adoption is too high is pointless, then, naturally, the perfect time to strike is somewhere in the middle. At 30% adoption, we're starting to edge into that middle territory. When adoption hits something like 50–60%, I suspect it will make sense for Google to turn up the algorithmic volume on HTTPS.

At the same time, Google has to make sure that most of the major, trusted sites have switched. As of this writing, 4 of the top 5 sites in our tracking data are running on HTTPS (Wikipedia, Amazon, Facebook, and YouTube) with the only straggler being #5, Yelp. The top 5 sites in our tracking account for just over 12% of page-1 results, which is a big bit of real estate for only 5 sites.

Of the top 20 sites in our tracking data, only 7 have gone full HTTPS. That's 35%, which is pretty close to our overall numbers across all sites. If Google can convince most of those sites to switch, they'll have covered quite a bit of ground. Focusing on big players and convincing them to switch puts pressure on smaller sites.

In many ways, Google has already been successful. Even without a major, algorithmic HTTPS boost, sites continue to make the switch. As the number climbs, though, the odds of a larger boost increase. I suspect the war is going to be over sooner than the trendline suggests.

What are the risks?

Am I telling you to make the switch? No. While I think there are good reasons to move to HTTPS for some sites and I think most of Google's motives are sincere on this subject, I also believe Google has been irresponsible about downplaying the risks.

Any major change to sitewide URLs is risky, especially for large sites. If you weigh the time, money, and risk of the switch against what is still a small algorithmic boost, I think it's a tough sell in many cases. These risks are not theoretical — back in May, Wired.com wrote up the many problems they've encountered during their HTTPS switch, a switch that they've since paused to reconsider.

Like any major, sitewide change, you have to consider the broader business case, costs, and benefits. I suspect that pressure from Google will increase, especially as adoption increases, and that we're within a year of a tipping point where half of page-1 results will be running on HTTPS. Be aware of how the adoption rate is moving in your own industry and be alert, because I suspect we could see another HTTPS algorithm update in the next 6–12 months.