https-and-security-seo

name	https-and-security-seo
description	Use when checking site security signals. HTTPS is a ranking factor; mixed content hurts.

HTTPS and Security SEO

HTTPS = required ranking signal. Mixed content (HTTP resources on HTTPS page) breaks the lock icon and hurts SEO.

HTTPS implementation

1. Get SSL certificate (Let's Encrypt free, Cloudflare auto)
2. Force redirect HTTP → HTTPS (301)
3. Update internal links to HTTPS
4. Update canonicals to HTTPS
5. Update sitemap to HTTPS
6. Submit HTTPS sitemap to Search Console
7. Add HSTS header for forced HTTPS

Mixed content fixes

Mixed content = HTTPS page loading HTTP resources. Browser shows broken lock icon.

Common causes:

• Old image URLs (http://...)
• CDN URLs (http://)
• Third-party script (http://)
• iframe (http://)

Fix: search-and-replace http:// → https:// across codebase.

Security headers

Add via CDN/server:

• HSTS (forced HTTPS)
• X-Frame-Options (prevents clickjacking)
• X-Content-Type-Options (prevent MIME sniffing)
• Content-Security-Policy (limits resource sources)
• Referrer-Policy (limits referrer leakage)

Cloudflare provides most by default.

Where this fits in the X3 empire

Security baseline for all CardPrepAI deployments.