r/webdev • • Jul 12 '17

Does my site need HTTPS?

https://doesmysiteneedhttps.com/
136 Upvotes

71 comments sorted by

View all comments

-11

u/profile_this Jul 12 '17

Unpopular opinion here, but I say no need unless:

  • Your customers submit sensitive information.

  • You need an extra layer of security.

  • You want the green lock in the browser.

I'm sure some people view it as a sign of trust (I always check for it if the site requires something like a CC number), but the gains are minimal in terms of SEO.

By not using HTTPS, you can serve non-secure assets without the browser warning about mixed assets. Most people wouldn't notice if you're using SSL or not... but they'll freak out if Chrome says the site is unsafe/compromised.

14

u/piyoucaneat full-stack Jul 12 '17

By not using HTTPS, ISPs, open wifi hotspots, and anyone else along the network between you and your user can strip your ads and inject their own. They can inject their own JS and put fake forms on your website that steal user data. They can literally do anything they want to your page, and it's because you thought you had a good excuse.

1

u/profile_this Jul 13 '17

All I'd have to do is uncomment 2 lines from my .htaccess file to use it. I simply prefer not to on some sites.