About a week ago we have moved our site to HTTPS. I always wanted to, and now that Google has made it a ranking signal - we finally ran out of excuses. Here's what we did:
On a side note - step #4 was where my geekiness took over and I developed a small web app that crawls a website and verifies there's no non-secure content. I made it public here, go ahead and test your website, it's free).
This is where I almost had a heart attack. Just a couple of days after the move had been made, Google Webmaster Tools showed me this:
The OMGWTF-moment. For about 5 seconds I forgot how to breathe. I started checking the websites SERP rankings right there in WMT and discovered that most pages have moved down by 1-4 positions, and some pages went down even further, by a whooping -20 positions. By the end of the week the number of "impressions" was down by 90%, the "clicks" were down by 60%. This felt scary as hell, especially considering all the rumors about Google testing Penguin 3.0 in August. Playing with the date-filters I discovered this started happening exactly 36 hours after the SSL-move.
Since we log everything we do on the SEO side of things in a special "SEO log" (and you should too!) I quickly looked through the recent entries. And found nothing... It had to be the https-move. After looking at our Google Analytics (where the traffic hasn't changed much, going down just a tiny little bit) I finally figured what was happening.
The reason behind is simple and obvious to any experienced SEO (which I'm totally not): Google Webmaster Tools treats http and https websites as two different entities in WMT. The non-SSL website traffic will start to decline just a couple of days after the move, while the SSL version will start growing. So you have to add and "verify" the HTTPS-version as a separate website in WMT, preferably prior to the move. And optionally, reconnect your Google Analytics property with the new "site" a couple of days later.
Google's official guide on moving a website (which explicitly mentions that it covers the "http-2-https" move too, among other types) even recommends using the Change of address feature in WMT, even with the 301-redirects in place. I tried it - doesn't work - you cannot use the tool unless you have changed the domain.
So as soon as I added and verified the SSL version, the graph for the new, SSL-website looked exactly the opposite:
We use about four different rank trackers to monitor our positions, both free and paid. All of them are protocol-independent. Up to this point there were no drastic drops or climbs on the graphs. But I'd still say the overall result of moving to SSL is more of a "negative" one. A week after the move has been made, about 15% of the phrases we monitor have lost their rank by 1-2 positions.
My guess is that's because the 301-redirect passes only 90% of the link juice (Google does mention in the moving guide that you have to change the external links to your website as well, where possible, as many as you can, which kinda proves the point). The 10% loss of the link juice had a bigger impact that the algorithm's HTTPS-reward (if any). Anyways, we'll continue monitoring the traffic/rankings, and I'll keep you updated.
To sum up, here's what you need to do if you decide to move (assuming you already have an SSL certificate in place): Redirect; Fix canonical; Nonsecure-check; Add SSL-site to WMT; Update external links where you can. Also I highly recommend reading the guide mentioned above.