Page Experience Goes Beyond Speed Scores
When people hear "page experience," they immediately think Core Web Vitals — LCP, FID (now INP), and CLS. Those matter, but they're only part of the story. Google's page experience signals include HTTPS, mobile-friendliness, absence of intrusive interstitials, and safe browsing status. Getting a perfect Lighthouse score while serving your site over HTTP with a full-screen popup still fails the page experience check.
HTTPS as a Ranking Signal
Google confirmed HTTPS as a ranking signal back in 2014. It's a lightweight signal — it won't vault you from page 3 to page 1 — but in competitive situations where two pages are otherwise equal, HTTPS wins.
Migration Considerations
If you're still on HTTP in 2026, you have bigger problems than SEO. But if you're planning an HTTPS migration for a large site, here's what goes wrong:
- Mixed content: Pages that load over HTTPS but include HTTP resources (images, scripts, iframes). Browsers block or warn about these, breaking page functionality. Crawl your site post-migration and check for mixed content warnings.
- Redirect chains: HTTP → HTTPS → www → non-www. Each hop loses a tiny amount of link equity and slows page load. Configure your redirects to go from the old URL to the final canonical in a single 301.
- HSTS header not set: Without HSTS (HTTP Strict Transport Security), browsers will still try HTTP first and rely on your redirect. With HSTS, browsers go directly to HTTPS after the first visit.
# Recommended HSTS header
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
# Start with a short max-age (300 seconds) and increase gradually
# Once confident, submit to the HSTS preload list: hstspreload.org
# Preloaded domains get HTTPS enforced by the browser before the first visitHSTS preloading is a one-way street. Once you're on the list, removing your domain takes months. Make sure your entire site works on HTTPS before submitting.
Intrusive Interstitials
Google penalizes pages that show intrusive interstitials — popups and overlays that cover the main content, especially on mobile. This penalty has been active since 2017, and it's a page-level signal, not site-level.
What Counts as Intrusive
- A popup that covers the majority of the page content immediately after the user arrives from search
- A standalone interstitial the user must dismiss before accessing the content
- A layout where the above-the-fold portion is an interstitial, and the original content is below the fold
What's Allowed
- Legally required interstitials (cookie consent, age verification)
- Login dialogs for paywalled content (where the content isn't indexable anyway)
- Banners that use a reasonable amount of screen space — Google's guideline is roughly the height of a browser notification bar
The practical line: if your popup takes more than about 30% of the mobile viewport and appears within the first few seconds after a search click, it's likely triggering the penalty. Delay popups by at least 30 seconds or trigger them on scroll depth (50%+), and keep them to a reasonable size.
Safe Browsing
Safe browsing status checks whether your site has been flagged for malware, phishing, unwanted software, or deceptive content. If Google's safe browsing system flags your site, you'll see warnings in search results and browsers, which effectively tanks your organic traffic to near zero.
Check your status at: Google Search Console → Security & Manual Actions → Security Issues. Also test individual URLs at transparencyreport.google.com/safe-browsing/search.
Common Causes of Safe Browsing Flags
Compromised sites are the most common cause. Hackers inject malicious redirects, spam pages, or cryptocurrency miners. A monthly security scan (tools like Sucuri SiteCheck or your hosting provider's malware scanner) catches these before Google's systems do.
Deceptive download buttons also trigger flags. If your site hosts software and the download page has misleading buttons (ads that look like the real download button), Google may flag the page.
If you're flagged, fix the security issue and request a review in Search Console. Reviews typically take 1-3 days for malware and up to 2 weeks for phishing.
Mobile-Friendliness in 2026
Mobile-first indexing is fully deployed — Google crawls and indexes the mobile version of your site, period. A page that renders poorly on mobile is a page that renders poorly for Google.
The most common mobile issues I still see:
Viewport not configured: Missing <meta name="viewport" content="width=device-width, initial-scale=1"> in the head. Without this, mobile browsers render the page at desktop width and scale it down.
Tap targets too small: Buttons and links need to be at least 48x48 CSS pixels with enough spacing between them. Cramped navigation menus fail this check constantly.
Content wider than screen: A table, image, or code block that extends beyond the viewport creates a horizontal scroll. Wrap tables in overflow-x: auto containers, set max-width: 100% on images, and use word-break on long strings.
Font size too small: Base font size should be 16px minimum on mobile. Anything smaller requires pinching to read, which Google considers a poor mobile experience.
Measuring Page Experience Holistically
Google Search Console has a "Page Experience" report that combines all these signals into one view. Check it monthly. It shows the percentage of your URLs that pass all page experience criteria.
The practical goal: get 90%+ of your indexed URLs passing all page experience checks. Perfect 100% is unrealistic for large sites — there will always be a few edge cases. But anything below 80% means you have systemic issues worth prioritizing.
If you're choosing where to invest, prioritize in this order: HTTPS (table stakes), safe browsing (existential risk), intrusive interstitials (easy to fix), mobile-friendliness (affects all mobile users), Core Web Vitals (matters, but the impact per-page is smaller than the others).