9.5% of small business websites still load their insecure http:// version without sending visitors to the secure https:// one, and real estate websites do it at more than twice that rate, 20.8%. Another 3.8% show a security certificate that browsers reject.
Analysis of 5,120 small business websites · websites of US businesses listed on Google, September 2026
Key Findings
- 1.9.5% of small business websites still load their insecure http:// version without redirecting visitors to secure HTTPS.
- 2.20.8% of real estate websites load without redirecting to HTTPS, the highest rate of any industry and more than twice the small business average.
- 3.1.7% of funeral home websites load without redirecting to HTTPS, the lowest rate of any industry.
- 4.3.8% of small business websites show a security certificate that browsers reject as expired or invalid, which puts a full-page warning in front of visitors.
- 5.1.5% of small business websites have no security certificate at all, so they cannot offer HTTPS.
Summary
A home buyer clicks an old link to a real estate agent's listings page. The page loads, but the address bar says "Not secure", and it says the same on the contact form where the buyer is about to type a phone number and email address. The agent has a security certificate; the website just never sends visitors to the secure version.
HTTPS is the encrypted version of a website: data sent between the visitor and the site cannot be read or changed in transit. Browsers label pages without it "Not secure". A website that has HTTPS but does not redirect to it still lets visitors land on the insecure version through old links, bookmarks and typed addresses, which is where trust is lost.
9.5% of small business websites load without redirecting to HTTPS, almost one in ten. Most of them do have a certificate; they are missing a single redirect setting that most hosts offer as one switch. Real estate websites lead at 20.8%, and funeral homes trail at 1.7%.
What we measured
On September 23 and 24, 2026 we visited 5,120 small business websites, taken from Google business listings in 56 US industries. For each website we requested the http:// address and checked whether it redirected to https://, recorded whether the website had a security certificate and whether browsers would accept it, and looked at up to 20 pages to see how many were served over plain HTTP.
A security certificate, often called an SSL certificate, is what lets a website offer HTTPS. A redirect sends visitors from one address to another automatically. A certificate is rejected when it has expired, was issued for a different address or was signed by the website itself rather than a trusted authority.
One in ten small business websites still loads without HTTPS
The gap shows up inside websites too. 1.8% of small business web pages are served over plain HTTP. That happens when a website links to its own http:// addresses and the server does not redirect them, so visitors reach the insecure version just by clicking around.
Chrome shows "Not secure" in the address bar on every one of those pages, including contact and booking forms, which is where it does the most harm. A visitor about to type a phone number or card details sees a warning from their own browser at exactly the wrong moment.
Real estate, accounting and electrician websites lag the most
Real estate agents lead at 20.8%, followed by accountants at 18.4% and electricians at 17.6%, all nearly twice the small business average. Many of these websites are older builds or run on templates from industry vendors that never forced HTTPS on the server. For accountants, whose clients send financial documents, a "Not secure" label is a particularly poor first impression.
Source: Suff Digital analysis of 5,120 small business websites · websites of US businesses listed on Google, September 2026
Funeral home, cleaning and church websites have nearly finished the move
At the other end, 1.7% of funeral home websites, 2.9% of cleaning company websites and 3.9% of church websites load without redirecting. Med spas (4.3%), garage door companies (4.5%) and orthodontists (4.8%) follow. Med spas and orthodontists often run on healthcare marketing platforms that force HTTPS by default.
Source: Suff Digital analysis of 5,120 small business websites · websites of US businesses listed on Google, September 2026
The spread between the top and bottom of the list, 20.8% against 1.7%, shows the problem is a setting, not a cost.
Broken certificates are a separate problem
A rejected certificate is worse than a missing redirect. Visitors see a full-page security warning before the website loads. The usual causes are a certificate that expired and did not renew, one issued for a different address, or one the website signed itself.
A further 1.5% of small business websites have no certificate at all, so they cannot offer HTTPS even if the owner wanted to. Free certificates that renew automatically are standard on most hosts, which makes both problems among the cheapest a small business can fix.
What this means for small business owners
Type http:// followed by your domain into a browser. If the address bar does not switch to https://, ask your host or developer to add a permanent (301) redirect for the whole website; most hosts have a one-click "force HTTPS" setting. Then click the padlock and check the certificate's expiry date and the address it covers.
Free certificates renew on their own, but only while the domain settings stay correct, which is why they lapse after a host or domain change. A website management plan checks the redirect and certificate every month, so a lapse is fixed before visitors see a warning.
Embed this research
Paste this on your site to embed the charts. It links back to the source automatically.
<iframe id="sd-small-business-https-redirect" src="https://www.suffdigital.com/embed/data-studies/small-business-https-redirect" width="100%" height="600" style="width:100%;border:1px solid #E5E7EB;border-radius:12px" loading="lazy" title="20.8% of Real Estate Websites Still Load Without HTTPS vs 9.5% of Small Business Websites - Suff Digital"></iframe>
<script>window.addEventListener("message",function(e){if(e&&e.data&&e.data.sdEmbed==="small-business-https-redirect"&&e.data.height){var f=document.getElementById("sd-small-business-https-redirect");if(f){f.style.height=e.data.height+"px";}}});</script>
<p style="font:14px/1.5 system-ui,sans-serif">Source: <a href="https://www.suffdigital.com/resources/data-studies/small-business-https-redirect">20.8% of Real Estate Websites Still Load Without HTTPS vs 9.5% of Small Business Websites - Suff Digital</a></p>
Cite this study
Suff Digital. (2026). 20.8% of Real Estate Websites Still Load Without HTTPS vs 9.5% of Small Business Websites. https://www.suffdigital.com/resources/data-studies/small-business-https-redirect
20.8% of Real Estate Websites Still Load Without HTTPS vs 9.5% of Small Business Websites - Suff Digital - https://www.suffdigital.com/resources/data-studies/small-business-https-redirect
Frequently asked questions
Related studies
- Website Migration37% of Small Business Websites on HTTPS Still Link to Insecure HTTP Addresses
- Website Migration659,120 Secure Homepages Still Load Files Over Insecure HTTP
- SEO26.9% of Small Business Websites Link to Their Own Redirects vs 0.9% With Redirect Chains
- Website Migration37% of Small Business Backlinks Depend on a Redirect vs 15% for Established Brands