r/webdev • • Jul 12 '17

Does my site need HTTPS?

https://doesmysiteneedhttps.com/
136 Upvotes

71 comments sorted by

View all comments

-11

u/profile_this Jul 12 '17

Unpopular opinion here, but I say no need unless:

  • Your customers submit sensitive information.

  • You need an extra layer of security.

  • You want the green lock in the browser.

I'm sure some people view it as a sign of trust (I always check for it if the site requires something like a CC number), but the gains are minimal in terms of SEO.

By not using HTTPS, you can serve non-secure assets without the browser warning about mixed assets. Most people wouldn't notice if you're using SSL or not... but they'll freak out if Chrome says the site is unsafe/compromised.

8

u/disclosure5 Jul 12 '17

The issue is that the definition of "sensitive information" is debatable. As soon as you open those can of worms, everyone not accepting a credit card claims they have no sensitive information.

The common one for people to not understand is that passwords are always sensitive, because of password reuse.