Get a free certificate, 301 every HTTP URL to its HTTPS twin, and serve one canonical host. Then turn on HSTS. After that the real work is mixed content — the stray http:// images and scripts that quietly break the padlock.
Certificate and redirects come first
The certificate itself is a solved problem. Let's Encrypt issues them free, they renew automatically every 90 days, and nearly every host — including the cPanel setups most small cannabis stores run on — provisions one with a checkbox. Nobody needs a paid certificate for SEO. The encryption and the padlock are identical.
Redirects are where migrations actually go wrong. Your domain answers at four addresses: http with and without www, and https with and without www. Three of those must 301 to the fourth, in a single hop. Use 301, not 302, and pick one host as canonical. A store that answers at both https://www and https:// without redirecting is running two competing copies of itself. Test all four variants in a redirect checker once the rules are in, and again after any host migration, because migrations are where working redirect rules go to die.
HSTS, once the redirects are stable
The Strict-Transport-Security header tells browsers to skip HTTP entirely and request the secure version straight away, which removes the redirect hop for returning visitors and closes the small window where a downgraded request could be intercepted. Start with a short max-age value, confirm nothing broke, then extend it. HSTS is deliberately sticky: browsers cache the instruction for as long as you declared, so a rushed rollout with a year-long max-age is painful to walk back if some subdomain still needs HTTP.
While you are in the server config, set a calendar reminder or uptime monitor for certificate expiry. Auto-renewal fails quietly now and then (a changed DNS record, a moved site, a host migration) and an expired certificate throws a full-screen browser warning that stops every visitor cold. Five minutes of monitoring setup buys insurance against the most visible failure a store can have.
Mixed content, the long tail
A page served over HTTPS that loads an image, script, or stylesheet over plain HTTP is mixed content. Browsers either block the element or strip the padlock, and either outcome costs trust on a site where visitors are already cautious about buying.
Worked example: a dispensary I audited had migrated cleanly, yet forty-odd blog posts still showed no padlock. The old theme had written absolute http:// image URLs into every post body. The browser console named each offending file, and a database search-replace of http://domain.com to https://domain.com fixed all of them in one pass. Total time, twenty minutes — most of it taking a backup first. Check the console on your highest-traffic pages; hardcoded URLs from old themes and page builders are almost always the culprit.
Key takeaways
- Free certificates from Let's Encrypt are all the SSL a store needs.
- All four host variants must 301 to one canonical HTTPS address.
- Roll out HSTS with a short max-age first; it is hard to undo.
- Mixed content usually traces to hardcoded http:// URLs in old content.
Frequently asked questions
Do I need to pay for an SSL certificate?
No. Let's Encrypt issues free certificates that renew automatically every 90 days, and most hosts now provision them with one click. Paid certificates do not rank better or encrypt better; the padlock is identical.
Will moving to HTTPS drop my rankings?
A correct migration causes at most a brief wobble. Redirect every HTTP URL to its HTTPS twin with a 301, keep the paths otherwise identical, and update the sitemap. Signals consolidate onto the secure versions and things settle.
Want this done for your brand?
We build cannabis & CBD search visibility with full transparency, for dispensaries, brands, and MSOs.
Get a free cannabis SEO audit ›