HTTPS, Security, and Infrastructure

Underneath crawling, rendering, and indexing sits the plumbing: the certificate, the mobile version, the edge, the server. None of it wins rankings on its own. All of it can quietly cap everything else. This chapter covers the infrastructure layer that every other signal depends on.

HTTPS as the baseline

Google confirmed HTTPS as a ranking signal in 2014. It is a lightweight one, a tiebreaker rather than a headline factor, but the direction is settled: the secure version is preferred. More important than the ranking nudge is what HTTPS represents. TLS is the trust baseline of the modern web, the thing that lets a browser promise a user the connection was not tampered with, and one of the concrete trust signals under E-E-A-T.

Serve the whole site over HTTPS and redirect every HTTP URL to its HTTPS equivalent with a 301. That protocol move is a migration in miniature, with the same rule as any other: one permanent redirect per URL to its true equivalent, and consistent canonicals afterward. HTTPS redirects →

A half-migrated site is worse than either state, because it hands Google both an HTTP and an HTTPS version of every page to reconcile as duplicates. Redirect completely, update internal links to point at HTTPS directly rather than routing through the redirect, and make sure no HTTP URL still answers with a live page. The certificate itself is table stakes now, since browsers flag plain HTTP as "not secure," which affects how much a visitor trusts the page long before ranking enters the picture.

Mobile-first indexing

Mobile-first indexing is complete. Google predominantly uses the mobile version of a page for indexing and ranking, not the desktop version. This has a sharp consequence: whatever is missing from your mobile page is, for practical purposes, missing from Google's view of the page. Content collapsed away, links hidden, or structured data dropped on mobile does not count just because the desktop layout still has it.

So content, internal links, and structured data must reach parity on mobile. Not the same pixels, the same substance. Verify it directly with URL Inspection's rendered HTML, which shows what the mobile crawler actually built, and confirm your headings, body, links, and JSON-LD are all present there.

Google indexes the mobile version. Anything absent from your mobile page is absent from Google's view of it, no matter how complete the desktop layout looks.

Edge and CDN control

A content delivery network puts copies of your site on servers close to users, and the edge is increasingly where technical SEO decisions get enforced. You can serve robots.txt and set X-Robots-Tag headers at the edge, which is often the cleanest place to apply site-wide crawl and index rules without touching application code. You can cache HTML at the edge so responses return fast from a nearby node instead of a distant origin.

The edge is also where you enable modern transport. Serve over HTTP/2 at minimum, which multiplexes many requests over one connection, and HTTP/3 where your CDN supports it, which runs over QUIC and recovers better on lossy mobile networks. These are performance wins that the edge makes easy, and performance feeds back into how much Google is willing to crawl. HTTP/2, HTTP/3, and caching → The edge is equally where you can allow or block AI crawlers, since their access rides the same headers and robots rules. Edge control of AI bots →

Server health as the substrate

Server health caps crawling. Google raises its crawl rate when your server stays fast and error-free, and backs off when response times climb or errors spike. A site that returns reliable 200 responses quickly gets crawled more thoroughly than one that stutters, which means infrastructure quietly decides how much of your content Google even gets to see. Persistent 5xx errors do not just fail the pages that throw them; they teach Google to crawl the whole site less.

This is the mental model for the whole chapter. HTTPS, the mobile version, the edge, and the origin are not ranking tactics you tune for a boost. They are the substrate under every other signal. Get them wrong and crawling, rendering, and indexing all degrade at once, no matter how good the content is. Get them right and they simply disappear, letting the content and links do their work. The tell of a healthy setup is that nobody thinks about it: pages return fast, the certificate is valid, the mobile version is complete, and Google crawls freely. When any of those slips, the symptoms show up as ranking or indexing problems elsewhere, which is why infrastructure is the first thing to rule out when a technically sound site underperforms. With the infrastructure solid, the next layer is serving the right version to the right country and language. International SEO next →