What are the consequences of using non-HTTPS links in emails?
Michael Ko
Co-founder & CEO, Suped
Published 27 May 2025
Updated 18 Aug 2025
7 min read
When sending emails, the links we include are crucial not just for guiding recipients to our content, but also for maintaining our sender reputation and ensuring deliverability. For a long time, the standard for web links was HTTP, but now, HTTPS (Hypertext Transfer Protocol Secure) has become the undisputed norm. The difference between HTTP and HTTPS is primarily encryption; HTTPS uses TLS/SSL to encrypt data, safeguarding it from interception. So, what happens if we still use non-HTTPS (HTTP) links in our emails?
I’ve encountered situations where even major brands or their platforms haven't fully embraced HTTPS for all their email-related links, including critical ones like the list-unsubscribe header. This can seem like a minor oversight, but it has significant implications, ranging from user experience to how mailbox providers perceive our email campaigns. It’s no longer just about best practices, it’s about compliance and ensuring our messages reach the inbox safely.
The consequences of using non-HTTPS links extend beyond simple aesthetic concerns. They can actively impede our email marketing efforts, leading to reduced engagement, damaged sender reputation, and ultimately, lower return on investment. Modern internet standards and user expectations heavily favor secure connections.
In the following sections, I’ll dive into the specific consequences that arise from including insecure links in emails, covering everything from security vulnerabilities and trust issues to deliverability challenges and technical complications. Understanding these risks is the first step toward building more secure and effective email campaigns.
Security and trust implications
One of the most immediate and significant consequences of using non-HTTPS links in emails is the compromise of security and the erosion of user trust. HTTP connections transmit data in plaintext, meaning that any information exchanged between the user's browser and the website is vulnerable to interception by malicious actors. This includes sensitive data like login credentials, personal information, or even payment details if the link leads to a form or checkout page.
Modern web browsers, such as Chrome, prominently display a “Not Secure” warning in the address bar when users visit an HTTP site. This warning, coupled with a lack of the padlock icon, immediately signals a potential risk to recipients. When a user clicks on a link in your email and is greeted by such a warning, it creates a negative impression and raises concerns about the legitimacy and safety of your brand.
This lack of visual security can lead to a significant drop in click-through rates. Users are becoming increasingly aware of online security and are less likely to interact with content or provide information on sites they perceive as unsecured. This distrust extends not only to the linked content but also back to the sender, negatively impacting your overall brand reputation. Essentially, if a link appears not secure, it directly affects user experience and engagement.
Security risks and trust erosion
Using non-HTTPS links exposes user data to potential interception and manipulation, compromising privacy. Browsers display prominent “Not Secure” warnings, deterring clicks and eroding recipient trust in your brand and emails. This can increase complaints and unsubscribe rates, and ultimately harm your sending reputation.
Deliverability and reputation impact
Beyond user perception, non-HTTPS links can directly impact your email deliverability. Mailbox providers like Google, Yahoo, and Microsoft are increasingly scrutinizing email content for security best practices. They prioritize sending users to secure destinations. Emails containing HTTP links are often viewed as less trustworthy or potentially suspicious, which can lead to them being filtered into spam folders or even blocked entirely. This is why HTTP links affect email deliverability.
The RFC 8058 standard mandates that the List-Unsubscribe header, a critical element for compliance, must use HTTPS. Failing to comply with this standard can result in immediate frowns of disapproval from major mailbox providers. This disapproval often translates into lower inbox placement rates and potentially being added to a blocklist (or blacklist). While a non-SSL link in the email body itself might not trigger an immediate block, it contributes to a general perception of “grubbiness” that lowers your sender reputation.
I’ve seen direct evidence of this impact. For example, some senders experienced a significant drop in deliverability to Yahoo when their SSL certificates for tracking links expired or were not properly configured for HTTPS. As soon as the certificates were renewed and uploaded, deliverability returned to normal within minutes. This clearly indicates that mailbox providers are actively assessing the security of links within emails and penalizing senders who fall short. If you're wondering are HTTP links penalized by spam filters, the answer is increasingly yes.
HTTP links
Security: Data transmitted in plaintext, vulnerable to interception. Browser warnings (“Not Secure”).
Deliverability: Lower sender reputation, increased spam filtering likelihood. Violation of RFC 8058 for List-Unsubscribe.
User Experience: Reduced trust, lower click-through rates, broken links on forced redirects.
SEO: Negative impact on search engine rankings as Google prioritizes secure sites.
HTTPS links
Security: Data encrypted via TLS/SSL, preventing interception. No browser warnings, displays padlock icon.
Deliverability: Improved sender reputation, better inbox placement. Compliance with RFC 8058 for List-Unsubscribe.
User Experience: Increased user trust, higher click-through rates, seamless navigation.
SEO: Positive influence on search engine rankings, alignment with modern web standards.
Technical challenges and user experience
Using HTTP links can also create various technical headaches and degrade the user experience. Modern browsers, especially Google Chrome, are increasingly forcing HTTP URLs to HTTPS. This automatic change can lead to problems if the target server doesn't have a valid SSL certificate for that specific domain or hostname. The result is often a certificate name mismatch error, making the link inaccessible and providing a poor experience.
Another common issue is mixed content warnings. This occurs when a secure HTTPS page attempts to load insecure HTTP content, such as images or scripts. While many email clients now block non-secure images from loading by default (e.g., in Gmail), links themselves can still trigger these warnings if they lead to mixed content pages. This creates a disjointed and potentially alarming experience for recipients. For similar reasons, HTTP tracking links affect email deliverability.
Tracking links are particularly susceptible to these problems. If your email service provider uses HTTP for its tracking domains, or if your custom tracking domain lacks a proper SSL certificate, these links can break or cause warnings. This directly impacts your ability to accurately track engagement and understand campaign performance, undermining a core aspect of modern email marketing. It's vital to ensure all aspects of your email, including secure HTTPS links, are correctly configured to prevent these issues.
Always use HTTPS for all links, including tracking and unsubscribe headers.
Ensure all domains used in email links (main site, tracking, custom) have valid SSL certificates.
Regularly check for certificate expiration to prevent deliverability drops.
Common pitfalls
Failing to update tracking links to HTTPS, leading to broken redirects or warnings.
Not configuring SSL certificates for all subdomains used in email, not just the main domain.
Assuming email platforms automatically handle HTTPS for all link types.
Expert tips
Beyond deliverability, enterprise systems and gateway anti-malware software are often touchy about non-HTTPS traffic.
A platform that charges extra for HTTPS in 2025 is outdated and might indicate broader issues.
Even if a non-HTTPS link doesn't directly cause delivery problems, it lowers sender reputation, which can be a tipping point if other issues exist.
Expert view
Expert from Email Geeks says they are violating RFC 8058, which requires List-Unsubscribe headers to be HTTPS, leading to disapproval from mailbox providers.
2025-05-15 - Email Geeks
Expert view
Expert from Email Geeks says while non-HTTPS links in the body might not be a direct block, it adds to the general perception of 'grubbiness' that impacts reputation.
2025-05-15 - Email Geeks
The imperative of HTTPS in email
The transition to HTTPS for all web content, including links within emails, is not merely a suggestion; it’s an industry standard. Mailbox providers, internet browsers, and users alike expect secure connections. Failure to adopt HTTPS across all elements of your email campaigns can lead to a cascade of negative effects, ranging from immediate security warnings to long-term damage to your sender reputation and email deliverability.
Prioritizing HTTPS ensures that your emails are perceived as trustworthy and professional, which is essential for maximizing engagement and conversion rates. It helps to avoid being blocklisted (or blacklisted) or filtered into spam, preserving your ability to reach the inbox. Moreover, it aligns your email practices with the broader internet's movement towards a more secure and privacy-conscious environment.
For these reasons, it is crucial to audit all your email templates and link structures to ensure every URL, including those in images, tracking, and unsubscribe headers, uses HTTPS. This proactive approach will not only enhance your email program's security and deliverability but also build greater trust with your audience, fostering a more successful and compliant email marketing strategy.
Google, 
Yahoo, and 
Microsoft are increasingly scrutinizing email content for security best practices. They prioritize sending users to secure destinations. Emails containing HTTP links are often viewed as less trustworthy or potentially suspicious, which can lead to them being filtered into spam folders or even blocked entirely. This is why HTTP links affect email deliverability.
Google Chrome, are increasingly forcing HTTP URLs to HTTPS. This automatic change can lead to problems if the target server doesn't have a valid SSL certificate for that specific domain or hostname. The result is often a certificate name mismatch error, making the link inaccessible and providing a poor experience.
Gmail), links themselves can still trigger these warnings if they lead to mixed content pages. This creates a disjointed and potentially alarming experience for recipients. For similar reasons, HTTP tracking links affect email deliverability.
