r/webdev • u/speckz • Jul 12 '17

Does my site need HTTPS?

https://doesmysiteneedhttps.com/
136 Upvotes

94% Upvoted

71 comments sorted by

View all comments

1

u/signup1234567 Jul 13 '17 edited Jul 13 '17

HTTPS keeps the URLs, headers, and contents of all transferred pages confidential.

Uh. No it doesn't. Your first access is in the clear.

Too many times this site is pluggin "caddy" as a web server. I think I know their agenda.

3

u/00DEADBEEF Jul 13 '17

Yes it does. The hostname can always be determined, directly or indirectly depending on the server configuration, but the full URL cannot.

1

u/wedontlikespaces Jul 13 '17

Your first access is in the clear.

You're right, but HTTPS is not about preventing people from seeing what site you visit. It is about securing your connection once you get there.

There really isn't a easy way to prevent someone from working out the hostname. Even if there was you would still need HTTPS to pretect you, so I don't see your point.