37.1% of small business websites that run on secure HTTPS still link to at least one old, insecure http:// address, and 23.5% of their pages carry such a link. Church websites have the highest rate at 63%.
Analysis of 5,040 small business websites on HTTPS · websites of US businesses listed on Google, September 2026
Key Findings
- 1.37.1% of small business websites that use HTTPS still link to at least one insecure http:// address.
- 2.23.5% of pages on small business websites that use HTTPS contain a link to an insecure http:// address.
- 3.63% of church websites link to insecure http:// addresses, the highest rate of any industry and four times the 15.5% of nail salon websites.
- 4.58% of optometrist websites link to insecure http:// addresses, followed by funeral home, nonprofit and veterinarian websites at 55% each.
- 5.1.8% of small business web pages are still served over plain, unencrypted HTTP instead of HTTPS.
Summary
A veterinary clinic moved its website to HTTPS years ago and the padlock shows in every visitor's browser. Scroll to the footer, though, and the link to its pet insurance partner still starts with http://, and so does the link in an old blog post to its own adoption page. Each of those links sends visitors either through an extra redirect or to a page with no encryption at all.
HTTPS is the secure version of the web's basic protocol: it encrypts everything sent between the browser and the website, and browsers mark sites without it as "Not secure". Switching a website to HTTPS happens on the server, but the links written into its pages stay exactly as they were typed. Each leftover http:// link is a small crack in an otherwise secure site.
More than a third of small business websites have at least one. 37.1% of small business websites on HTTPS still link to an insecure http:// address, and 23.5% of their pages carry one. The move to HTTPS was finished at the server and never finished in the content.
What we measured
On September 23 and 24, 2026 we visited 5,040 small business websites served over HTTPS, taken from Google business listings in 56 US industries, and read the links on up to 20 pages of each site. We flagged every link to an address that starts with http:// instead of https://, whether it points to the website's own pages or to another website. A website counts when any of its pages has one.
An http:// link is a link to the unencrypted version of a web address. If the destination has moved to HTTPS, the visitor goes through a redirect first; if it has not, the visitor leaves a secure page for an insecure one. An industry's rate is the share of its websites with at least one such link.
More than a third of secure websites still link to insecure addresses
The leftovers are spread through the content, not tucked on one page. 23.5% of all pages on these websites contain at least one http:// link, almost one page in four. They sit in footers, old blog posts, embedded widgets and links to partner organizations, directories and resources that were copied in before the website moved to HTTPS.
A smaller group has a deeper problem. 1.8% of small business web pages are served over plain HTTP themselves, which usually means the website never forced HTTPS for every visitor. For everyone else, the leftover links are a content problem rather than a server problem, and they stay until someone edits them.
Church, optometrist and funeral home websites have the highest rates
63% of church websites link to at least one insecure http:// address, followed by optometrists at 58% and funeral homes, nonprofits and veterinarians at 55% each. These are websites that stay live for years with light edits and link out often, to parent organizations, suppliers, directories and community resources, many of which were written years ago.
Source: Suff Digital analysis of 5,040 small business websites on HTTPS · websites of US businesses listed on Google, September 2026
For a financial advisor (53%) or a hotel (51%), the stakes are higher than the numbers suggest, because their visitors are often about to share personal or payment details. A browser warning or an insecure destination at that moment costs trust the website otherwise earned.
Nail salon and spa websites have the lowest rates
At the other end, 15.5% of nail salon websites and 16.7% of spa websites link to an http:// address, about a quarter of the church rate. Barber shops (22.4%) and jewelry stores (22.9%) follow, with HVAC contractors at 24.1% and SaaS companies at 25.3%.
Source: Suff Digital analysis of 5,040 small business websites on HTTPS · websites of US businesses listed on Google, September 2026
These industries tend to have newer websites, often built on hosted platforms that write https:// into every link by default, and they link out less. Their lower rates show the problem is not inevitable: a website built after the move to HTTPS rarely has it.
What this means for small business owners
Search your website's content for "http://" followed by your own domain and switch each one to https://. On WordPress a search-and-replace plugin or a single database query does it in one pass. Then check menus, footers and theme settings, which are stored separately and are often missed.
For links to other websites, test whether the https:// version works and update the link if it does. If the other website has no HTTPS at all, decide whether the link is still worth keeping. Our technical seo services include a full check for these leftovers, along with the redirects and certificates behind them.
Embed this research
Paste this on your site to embed the charts. It links back to the source automatically.
<iframe id="sd-http-links-on-https-sites" src="https://www.suffdigital.com/embed/data-studies/http-links-on-https-sites" width="100%" height="600" style="width:100%;border:1px solid #E5E7EB;border-radius:12px" loading="lazy" title="37% of Small Business Websites on HTTPS Still Link to Insecure HTTP Addresses - Suff Digital"></iframe>
<script>window.addEventListener("message",function(e){if(e&&e.data&&e.data.sdEmbed==="http-links-on-https-sites"&&e.data.height){var f=document.getElementById("sd-http-links-on-https-sites");if(f){f.style.height=e.data.height+"px";}}});</script>
<p style="font:14px/1.5 system-ui,sans-serif">Source: <a href="https://www.suffdigital.com/resources/data-studies/http-links-on-https-sites">37% of Small Business Websites on HTTPS Still Link to Insecure HTTP Addresses - Suff Digital</a></p>
Cite this study
Suff Digital. (2026). 37% of Small Business Websites on HTTPS Still Link to Insecure HTTP Addresses. https://www.suffdigital.com/resources/data-studies/http-links-on-https-sites
37% of Small Business Websites on HTTPS Still Link to Insecure HTTP Addresses - Suff Digital - https://www.suffdigital.com/resources/data-studies/http-links-on-https-sites
Frequently asked questions
Related studies
- Website Migration659,120 Secure Homepages Still Load Files Over Insecure HTTP
- SEO26.9% of Small Business Websites Link to Their Own Redirects vs 0.9% With Redirect Chains
- Website Migration20.8% of Real Estate Websites Still Load Without HTTPS vs 9.5% of Small Business Websites
- SEOFollowed Backlinks to Small Business Websites Vanish Five Times as Often as Nofollow Links