97% of the pages AI engines cite are HTTPS. Secure serving is effectively table stakes for AI citation.
Of 46,700 cited URLs, 45,255 (97%) are HTTPS and only 234 are plain HTTP. AI engines almost never cite insecure pages.
HTTPS vs HTTP among AI-cited pages
| Category | Cited URLs | Share |
|---|---|---|
| HTTPS (secure) | 45,255 | 96.9% |
| HTTP (insecure) | 234 | 0.5% |
What the breakdown shows
The near-universal 97% HTTPS share is worth stating plainly because it sets a floor: in this dataset, being served securely is effectively a precondition for being cited. Only 234 of 46,700 cited URLs were plain HTTP — a rounding error. That does not prove HTTPS causes citations; rather, the modern, well-maintained sites AI engines tend to draw on are essentially all HTTPS already, so an insecure page starts from a position almost no cited page occupies.
The flip side is the useful part: if any of your important pages are still HTTP, mixed-content, or serving certificate errors, you are outside the pattern of virtually every page these engines cite — a cheap, unambiguous thing to fix.
Ready to Monitor Your AI Visibility?
Track how AI chatbots mention your brand across ChatGPT, Perplexity, and other platforms.
Why this is trustworthy (and its limits)
This is measured from the cited URLs themselves — the actual strings AI engines returned — so there is no modelling or estimation involved; the shares are exact counts. The one caveat is scope: it describes the 46,700 URLs cited for AmICited’s tracked prompts (SaaS , e-commerce and support-leaning topics), so treat it as a strong signal for that kind of content rather than a universal law. It is also a description of what gets cited, not proof that changing this trait alone would earn a citation.
Takeaways
What to do about it
- Serve every page over HTTPS with a valid certificate — it is the one technical trait almost all AI-cited pages share.
- Eliminate mixed-content warnings and redirect all HTTP to HTTPS site-wide.
- Treat this as a pass/fail hygiene check, not an optimisation dial: you either clear the bar the cited set sits at, or you don’t.
Stay Updated on AI Visibility Trends
Get the latest insights on AI mentions, brand monitoring, and optimization strategies.
Why HTTPS is effectively mandatory for AI citations
The 97% HTTPS share among AI-cited pages is not just a statistic — it is a statement about what the modern web looks like, and what AI engines expect. The 234 HTTP URLs in the dataset are a rounding error (0.5%), and many of them are likely legacy pages that predate the HTTPS-everywhere movement.
There are several reasons why HTTPS is so dominant among cited pages, none of which are specific to AI search but all of which contribute:
The web itself is overwhelmingly HTTPS now. Google’s transparency report shows that over 95% of pages loaded in Chrome are served over HTTPS. The AI-cited set at 97% simply mirrors the broader web’s migration to secure serving.
The sites that earn AI citations are well-maintained. Large publishers, SaaS companies, and established media organizations adopted HTTPS years ago as part of standard security practices. Their HTTPS adoption is a proxy for overall site quality, not a specific AI citation factor.
HTTP pages are increasingly treated as untrustworthy. Browsers mark HTTP pages as “Not Secure,” and many CDNs and hosting platforms default to HTTPS. An HTTP page in 2026 signals neglect — the kind of neglect that correlates with thin, outdated, or poorly maintained content.
The practical implication is clear: if any of your pages are still HTTP, you are operating outside the norms of the cited web. This is not a subtle optimization — it is a pass/fail hygiene check. You either clear the bar, or you don’t.
How this compares to traditional SEO
In traditional Google Search, HTTPS has been a confirmed lightweight ranking signal since 2014. Google has stated that HTTPS gives a “small ranking boost” and that it may become stronger over time. The AI-cited data is consistent with this: HTTPS is not a citation driver, but its absence is a strong negative signal.
The difference in AI search is that the bar may be even more binary. In traditional search, an HTTP page can still rank well if it has exceptional content and authority. In AI search, the data suggests that HTTP pages are so rare in the cited set that they are effectively invisible. If your content is behind HTTP, AI engines may simply not consider it — not because they have a policy against HTTP, but because the retrieval systems they use are built on a corpus that is overwhelmingly HTTPS.
What about mixed content and certificate issues?
The 97% figure measures URLs that begin with https://. It does not capture pages that are served over HTTPS but contain mixed content (HTTP resources embedded in an HTTPS page), or pages with certificate errors. These are important nuances:
Mixed content: A page served over HTTPS that loads images, scripts, or stylesheets over HTTP. Browsers may block or warn about these resources, and AI crawlers may similarly fail to load them. This can result in incomplete content extraction.
Certificate errors: Expired, misconfigured, or self-signed certificates can cause crawlers to abort the request entirely. Most AI crawlers will not ignore certificate errors the way a determined human user might.
The practical recommendation is to go beyond just having HTTPS — ensure your certificate is valid, auto-renewing, and that all resources on your pages are served securely. A single mixed-content warning or certificate expiry can make your content as invisible to AI crawlers as if it were plain HTTP.
Practical recommendations
Audit your entire site for HTTP pages. Use a crawler like Screaming Frog to identify any pages still served over HTTP. Redirect them to HTTPS.
Implement HSTS (HTTP Strict Transport Security). HSTS tells browsers and crawlers to always use HTTPS for your domain, preventing accidental HTTP requests.
Check for mixed content. Use Chrome DevTools or an online mixed-content scanner to identify pages that load insecure resources.
Set up certificate auto-renewal. Use Let’s Encrypt with auto-renewal, or your hosting provider’s managed SSL. Certificate expiry should never be a manual process.
Treat HTTPS as done, not as an optimization. Once your entire site is HTTPS with no mixed content, move on. The 97% figure tells you that this is table stakes — further investment in HTTPS-specific optimizations will not move your citation numbers.
Methodology
Derived purely from the cited source-URL strings in AmICited’s tracking data (46,700 URLs, June 24, 2026 – July 23, 2026, 2026) — no page fetching, no modelling, and no external links reproduced here. URL depth counts path segments after the host; scheme (HTTP/HTTPS) and host (www / root / other subdomain ) are read directly from each URL. The prompt set skews toward SaaS, e-commerce and support topics. Copilot is tracked but returned no citation data in this window.
