An interesting post appeared yesterday in the official Google Online Security and Webmaster Central blogs which confirms that in an effort to "make the Internet safer" it has been testing a system which looks at "whether sites use secure, encrypted connections as a signal in our search ranking algorithms." This follows calls for HTTPS everywhere at the recent Google I/O a few months back.
Google says is has seen positive results, and is now actually using HTTPS as a ranking signal albeit a "very lightweight" one which only impacts <1% of queries. Nonetheless, the intention is now clear that this will be the way forward and the signal will most likely be given more weight once website owners have had fair chance to make the move from HTTP to HTTPS.
Keep an eye open for official announcements from Google in the coming weeks, including best practice advise such as using 2048-bit key certificates and relative URLs for resources that reside on the same secure domain (using protocol relative URLs for all other domains.)
Mark Sparshott, a director at security vendor Proofpoint, says "I welcome Google's move to use HTTPS as ranking signal and downgrade those sites that are not encrypting connections to their visitors but caution that the minimal scope and weighting Google are applying may not be enough of a deterrent for poor security best practice yet."
