HTTPS for online stores: why shoppers and Google expect it
A store without HTTPS shows a browser warning and puts payment details at risk. Check that every page loads securely and fix mixed or missing certificates.
2 min read
Area
Trust & policies
Severity
Critical
Fix effort
Small
Stores failing
1%
Of 180 stores we scanned where this check applies, 1% fail it and 99% pass. See all benchmarks.
HTTPS encrypts the connection between a shopper and your store. Without it, browsers label the page "Not secure", and anything typed into a form can be read on the way. This check confirms that your store loads over HTTPS and requests nothing insecurely.
Why it matters
A security warning at the moment a shopper considers paying ends the sale. Payment providers also require it, and search engines treat it as a basic quality signal. Most hosted platforms provide a certificate automatically, so a failure usually points to a custom domain set up wrongly or a certificate that has expired.
What the audit looks at
The audit checks that your store loads securely over HTTPS and asks for nothing insecurely.
What usually causes it
- A certificate that expired and was not renewed
- A custom domain pointed at the store without finishing SSL setup
- The store address saved with http:// in the platform settings
- Hard-coded http:// links to images or scripts in theme code
How to fix it
Serve the whole site over HTTPS. The effort is small, usually a setting or a paste and under 30 minutes.
- Browsers mark an HTTP checkout as Not secure, which ends most purchases.
- Redirect all HTTP traffic to HTTPS at the server or CDN, permanently.
How to check it yourself
- Open your store in Chrome and click the padlock next to the address. It states whether the connection is secure and when the certificate expires.
- Visit the http:// address and confirm it redirects to https://.
- Use a free SSL checker to read the certificate chain.
Frequently asked questions
Is the padlock a sign the store is trustworthy?
No. It only says the connection is encrypted. Shoppers do read it as a basic trust signal, which is why its absence costs sales.
My host says SSL is on, but the audit failed. Why?
A page can have a valid certificate and still request some files over HTTP. That is called mixed content and it is checked separately.
Related checks
Check your own store
See whether your store passes this check
Paste your store URL. The audit loads your pages in a real browser and shows the result for this check with the evidence behind it.