How to Add HTTPS to Google Analytics

Confused about how to add HTTPS to your Google Analytics property? You're not alone. Many guides you'll find are outdated, referring to a setting that no longer exists in Google Analytics 4. This article will clear up how GA4 handles HTTPS traffic and show you exactly what to check to ensure your analytics data is secure and accurate.

So, How Do You Add HTTPS in Google Analytics 4?

Here's the straightforward answer: you don’t actually have to. There is no specific button, toggle, or setting within your GA4 property to "add" HTTPS.

This is a major departure from the older Universal Analytics (UA), where property settings included a "Default URL" field. In UA, you had to manually select whether your website's default address used http:// or https://. This setting helped standardize page reports, but it was a manual step tied to an older way of thinking about data.

Google Analytics 4 operates on a more flexible, event-based model. It doesn't rely on a pre-configured default URL. Instead, it captures the full page URL, including the protocol (http or https), directly from the user's browser for every event, such as a page_view. The full URL is stored in the page_location parameter.

So, if your website is correctly running on HTTPS and a user visits https://www.yourwebsite.com, GA4 will automatically record the activity for that exact URL. There's nothing for you to configure in the GA4 interface to make this happen. The real work isn’t in Google Analytics, it's on your website and server.

What Really Matters: Securing Your Website with HTTPS

Since Google Analytics simply mirrors the reality of your website's setup, the key is to ensure your entire site loads securely over HTTPS for every visitor. If you haven't already made the switch, it’s not just a good idea - it's essential for modern marketing and business.

1. User Trust and Credibility

Internet users are now trained to look for the padlock icon in their browser's address bar. Sites that load with a "Not Secure" warning instantly erode trust, especially if you're asking for personal information or payment details. HTTPS signals that the connection between the user’s browser and your server is encrypted and secure, giving visitors peace of mind.

2. Google Ranking Signal

Google officially confirmed over eight years ago that HTTPS is a lightweight ranking signal. While it might not boost you to the number one spot overnight, having a secure site is considered a basic requirement for a good user experience, which is at the heart of SEO. All else being equal, a secure site will be favored over an insecure one.

3. Analytics Data Integrity

An HTTPS connection has a direct impact on the quality of your analytics data, particularly when it comes to referral traffic. When a user clicks a link from a secure (HTTPS) site to an insecure (HTTP) site, the referral data - information about where the user came from - is often stripped away for security reasons. This can cause that traffic to be misclassified in your reports as (direct) traffic instead of referral traffic. By ensuring your site is on HTTPS, you preserve this valuable referral data from other secure websites, giving you a clearer picture of your traffic sources.

How to Check If HTTPS Data is Flowing into GA4

Even though there is no setting to change, you should still verify that Google Analytics is recording your traffic correctly. Here are the steps to confirm that your data reflects your secure site setup.

Step 1: Get Your Hands Dirty with the Realtime Report

The easiest way to check is to become a visitor yourself. The Realtime report lets you see activity on your site as it happens.

• Open your website in a new browser tab or on your phone. Make sure the URL clearly starts with https://. Browse to a few different pages.
• In your Google Analytics 4 dashboard, navigate to Reports > Realtime.
• Cards like "Views by Page title and screen name" should show the pages you are currently visiting. More importantly, check the "Users in last 30 minutes" map to confirm your own visit has been registered. This confirms the tracking code is firing correctly on your secure pages.

Step 2: Dive into the Pages and Screens Report

The Realtime report shows what’s happening now, but the engagement reports show you historical data. This is where you can confirm that all your traffic is being recorded properly.

• In GA4, go to Reports > Engagement > Pages and screens.
• By default, this report shows metrics by Page path and screen class. This is useful, but we need to see the full URL to check the protocol.
• Click the small "+" icon next to the primary dimension ("Page path and screen class").
• From the dropdown menu, search for and select Page location.

The report will now update with a second column showing the complete URL for each page. Scan through this column. You should see that all, or at least the vast majority, of your URLs begin with https://. This is your proof that GA4 is seeing and processing your traffic as secure.

Step 3: Hunt Down "Mixed Content" Issues

What if you perform the check above and see both http:// and https:// versions of the same pages in your reports?

This signals a problem with your website's configuration, not Google Analytics. It means that some users are still able to access the non-secure version of your site. This usually happens for one of two reasons:

• Incomplete Redirects: Your site isn't automatically redirecting all HTTP traffic to HTTPS. Someone typing yourwebsite.com into their browser might be landing on the HTTP version instead of being forwarded to the secure one.
• Mixed Content Warnings: Your web pages might be loading non-secure assets (like images, scripts, or stylesheets) over HTTP, which can cause security warnings and tracking inconsistencies.

To fix this, work with your developer or an SEO specialist to implement sitewide 301 redirects from every HTTP URL to its corresponding HTTPS version. You should also ensure your canonical tags point to the HTTPS URL as the one true version of each page.

For Universal Analytics Vets: Why This Changed

If you've been working with Google Analytics for a while, you probably remember the old "Default URL" setting in Universal Analytics. Located under Admin > Property Settings, this simple dropdown menu was where you'd tell GA which protocol your site used.

Universal Analytics was built around a session and pageview model. Setting a default URL helped it standardize reports and better understand site structure. However, this became less relevant with the shift to GA4's user-and-event-centric data model. Since every event in GA4 captures the full page_location, there's no need for a default setting. GA4's approach is more precise, as it simply records what actually happens in the user’s browser without making assumptions based on a property setting.

Tip: Link Google Search Console for Complete Insight

While GA4 automatically handles HTTPS tracking, you should align it with Google Search Console (GSC) for a more complete performance overview. Google Search Console is the definitive source for how Googlebot sees your site, including its protocol.

When you set up Search Console, you should use a "Domain Property." This type of property automatically consolidates data from all subdomains and protocols (including http, https, www, and non-www) into a single view.

By linking your GSC Domain Property to GA4, you pull valuable organic search query data directly into your Analytics reports. This confirms to Google that you recognize all versions of your site under one umbrella and provides a more holistic view of your user journey, from search query to on-site conversion.

Final Thoughts

In short, making Google Analytics track your HTTPS site isn't about adjusting a setting inside GA4. It's about ensuring your website is correctly and consistently serving secure content via https:// to all users. Once that foundational part is handled on your web server, Google Analytics 4 will automatically and accurately capture the data just as it happens, protocol included.

Connecting data sources like Google Analytics and wrestling with reports to get a clear picture of marketing performance is often where marketers lose countless hours. When we built Graphed , our goal was to completely automate that process. You can connect your marketing platforms in seconds, then simply ask questions in plain English to build real-time dashboards and reports. This gives you back time to focus on strategy and growth instead of getting stuck in data wrangling.