HTTPS Migration Checklist with Auditite

Overview

Migrating to HTTPS is essential for security, user trust, and SEO (HTTPS is a confirmed ranking signal). However, a botched HTTPS migration can cause significant traffic loss. This checklist ensures every aspect of the migration is covered.

Pre-Migration Preparation

• Purchase and install an SSL/TLS certificate from a trusted certificate authority
• Choose the correct certificate type (single domain, wildcard, or multi-domain)
• Test the certificate on a staging environment before production deployment
• Verify the certificate covers all subdomains used by the site (www and non-www)
• Document current organic traffic baseline and top landing pages
• Export all current backlinks and their target URLs
• Take a screenshot of Google Search Console performance for the last 6 months

Redirect Setup

• Implement 301 redirects from every HTTP URL to its HTTPS equivalent
• Redirect both www and non-www HTTP versions to the preferred HTTPS version
• Test redirects on a sample of 50+ URLs across different page templates
• Verify no redirect chains exist (HTTP to HTTPS should be a single hop)
• Confirm redirects preserve the full URL path and query parameters

On-Site Updates

• Update all internal links to use HTTPS (or protocol-relative) URLs
• Update canonical tags to reference HTTPS URLs
• Update XML sitemaps to list HTTPS URLs
• Update the sitemap reference in robots.txt to the HTTPS sitemap URL
• Update hreflang tags to reference HTTPS URLs (if applicable)
• Update structured data to use HTTPS URLs
• Update Open Graph and social meta tags to use HTTPS URLs
• Check for hardcoded HTTP URLs in CSS, JavaScript, and embedded content
• Verify all images, scripts, and stylesheets load over HTTPS (no mixed content)

Third-Party Integrations

• Update Google Analytics property settings to use HTTPS
• Add and verify the HTTPS property in Google Search Console
• Submit the new HTTPS sitemap in Google Search Console
• Update Bing Webmaster Tools with the HTTPS site
• Update all third-party tracking pixels and scripts to HTTPS
• Verify ad platforms and affiliate links use HTTPS URLs
• Update social media profile links to HTTPS

Post-Migration Verification

• Test the site for mixed content warnings in Chrome DevTools (Console tab)
• Verify HSTS (HTTP Strict Transport Security) header is set correctly
• Check that the SSL certificate is valid and not expired using an SSL checker
• Run a full site crawl on the HTTPS version to check for broken links
• Verify Google Search Console shows no new crawl errors on the HTTPS property
• Confirm the HTTPS version appears in Google’s index (site:yourdomain.com)

Post-Migration Monitoring (Weeks 1-4)

• Monitor organic traffic daily for the first two weeks
• Check Google Search Console for crawl errors on both HTTP and HTTPS properties
• Verify the HTTPS property is gaining indexed pages while HTTP loses them
• Monitor Core Web Vitals for any performance changes caused by SSL handshake overhead
• Check that top-ranking keywords maintain their positions
• Verify backlinks are being attributed to the HTTPS URLs in your backlink monitoring tool

Common HTTPS Migration Mistakes

Mixed Content

Loading HTTP resources (images, scripts, stylesheets) on an HTTPS page triggers browser warnings and degrades trust signals. Audit every resource URL.

Missing Redirects

Every HTTP URL must redirect to HTTPS. Missing redirects create duplicate content (both HTTP and HTTPS versions accessible).

Certificate Errors

An expired, self-signed, or misconfigured certificate is worse than no HTTPS at all. Monitor certificate expiration and renew well in advance.

Forgetting Subdomains

If your site uses subdomains (blog.example.com, shop.example.com), each needs a valid certificate and HTTP-to-HTTPS redirects.