Technical eligibility, control 9 of 20
T-09 Use secure, consistent public delivery
Public pages should use a valid HTTPS origin and consistent preferred URL scheme without mixed-content failures or accidental exposure of administrative routes.
- Priority
- Gate. A FAIL stops publish or launch.
- Hard gate
- Yes. A FAIL stops publication, whatever the score.
- Change class
- APPROVAL_REQUIRED: Required exact authority must be valid before the consequential action.
- Quality bucket
- Technical eligibility
Why it matters
Certificate errors and mixed content trigger browser warnings that put visitors off and can block parts of a page from loading. Serving the same pages over both HTTP and HTTPS splits signals between duplicate versions. Search engines and AI answer engines expect a secure, consistent site, as set out in Google's basic Search requirements.
Evidence to review
- Network responses, certificate checks, redirects and tested renewal/alert ownership.
How to implement
- Check certificate validity, renewal monitoring and mixed content.
- Review HTTP-to-HTTPS behaviour and canonical protocol.
- Treat HSTS, DNS, certificate and host-wide changes as infrastructure changes requiring explicit scope and approval.
How UltimateSEO checks this
Automated. A check in the scan sets PASS or FAIL for this control, and reports UNKNOWN or BLOCKED when its input is missing.
The check looks at: https on every crawled URL, http-to-https redirect behaviour, HSTS header and mixed-content references.
States used: PASS, FAIL, UNKNOWN, NOT_APPLICABLE or BLOCKED. UNKNOWN is never shown as a pass. How states work.
Sources
Part of The UltimateSEO Framework v4.3, catalogue dated 2026-10-14. Evidence states, control states and the publish gate are explained on the hub.