Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Let's say I have a large content-only site; no login or logout, no usernames, no email addresses, no secure area, nothing secret on the site, nada. People just come to the site and go from page to page and look at content.

Besides a slight bump in SEO from Google (very slight, from what I've read), is there any benefit of forcing the site to load via HTTPS?

share|improve this question
    
Possible duplicate of Force Using SSL on Site now? – unor yesterday
1  
I don't believe this is a duplicate of Force Using SSL on Site now?. Although some answers may end up being similar, that question is asking for advice about whether or not to use SSL while this question is not. If anything, the other question should be closed for being opinion based. – Stephen Ostermiller yesterday
    
I call this an opinion-based question because SSL is generally used for secure sites, and you're trying to find a reason for loading an insecure site over SSL vs non SSL and the answers will likely be resulted from people's opinions of SSL – Mike yesterday
1  
Let's flip this around: what is the benefit of NOT using SSL? There isn't any that I know of. Oh sure, the implementation which would be a one off and take (comparatively to everything else) no time. So, if one approach has no downsides and some upsides, the other has no upsides and (according to you) no downsides, then...why stick with the latter? – Vld yesterday
2  
Mobile carriers always tamper with unencrypted HTTP traffic, whether it's for image (over)compression, injecting evil Javascript or more agressive cache-control headers. HTTPS will prevent all that nonsense. – André Borie yesterday

HTTPS does not just provide secrecy (of which you are doubting the value, though there are good reasons for it still) but also authenticity, which is always of value. Without it, a malicious access point/router/ISP/etc. can rewrite any part of your site before displaying it to the user. This could include:

  • injecting ads for your competitors
  • injecting ads or annoying widgets that make your site look bad and harm your reputation
  • injecting exploits to perform drive-by downloads of malware onto the visitor's computer, who then (rightly!) blames you for it happening
  • replacing software downloads from your site with ones that have bundled malware
  • lowering the quality of your images
  • removing parts of your site they don't want you to see, e.g. things that compete with their own services or depict them in a bad light
  • etc.

Failure to protect your users from these things is irresponsible.

share|improve this answer
    
But if the data is compressed, then such injection you describe may be difficult to produce. – Mike yesterday
8  
@Mike Not really. There's plenty of off-the-shelf software to do this, and it all handles decompression and recompression just fine. – ceejayoz yesterday
1  
@Mike Not really. A full rewriting proxy can decode all the traffic and inject whatever new stuff it wants afresh. – Nayuki 11 hours ago
1  
FYI most if not all of my examples have actually been seen in the wild. – R.. 11 hours ago

"nothing secret on the site"

...According to you. Maybe you are a competitor to someone's boss and he likes his/her boss not knowing. It creates privacy. You might think it's insignificant, or maybe it's not a big deal now but could be at another point in time. I am a firm believer that no-one apart from me and the website should know what I'm doing.

It creates trust. Having the padlock is a sign of security and it can signify some degree of skill regarding the website, and thus your products.

It makes you less of a target for e.g. MitM attacks. Security increases.

With initiatives like Let's Encrypt, which make it a lot easier and free, there aren't many downsides. CPU power taken up by SSL is negligible these days.

share|improve this answer
7  
Unfortunately SSL does not stop corporate IT or your ISP or people on the public cafe wifi with you from knowing what sites you're visiting. The DNS lookups are still done in the clear. While they can't see the content, nor the exact URL, nor that you're even using a web browser, they can see that you're accessing penisland.com (which is, of course, a site for pen enthusiasts, but might be misconstrued). Using a VPN or SOCKS5 proxy will protect your DNS queries. – Schwern yesterday
    
Yes, but saying "dont use https because there is DNS lookups" is like saying "YEah I have no lick because they can break a glass". Https should be standard IMO, just as the lock. It's a fine first step :) – Martijn yesterday
2  
@Martijn: With Server Name Indication (which all modern browsers support), the hostname of the website is itself sent in the clear as part of the HTTPS handshake. It's not just a matter of sidechannel attacks and cannot be mitigated with e.g. DNSsec. – Kevin yesterday
    
@Martijn Absolutely do use HTTPS, but it only creates privacy about the URL and page content. It doesn't prevent your IT department from knowing what sites you're visiting. You need more than HTTPS for that. – Schwern 21 hours ago
    
@Schwern I never understood the argument that HTTPS doesn't protect the host name because the DNS lookup and SNI and the server's certificate are in the clear. Of course that's true as stated, but plain text HTTP is by no means any better in this regard! – Michael Kjörling 59 mins ago

It prevents man in the middle attacks that make you think you are visiting your site but present a page that is actually from another and may attempt to get info from you. Since the data is encrypted, it also makes it more difficult for an attacker to manipulate the page as you see it.

Because you need a SSL certificate, that verifies you are the owner of the site at a minimum giving at least some verification of who you are.

share|improve this answer

(Parts taken from my answer to a similar question.)


HTTPS can achieve two things:

  • Authentication. Making sure that the visitor is communicating with the real domain owner.
  • Encryption. Making sure that only this domain owner and the visitor can read their communication.

Probably everyone agrees that HTTPS should be mandatory when transmitting secrets (like passwords, banking data etc.), but even if your site does not process such secrets, there are several other cases where and why the use of HTTPS can be beneficial.

Attackers can’t tamper with requested content.

When using HTTP, eavesdroppers could manipulate the content your visitors see on your website. For example:

  • Including malware in the software you offer for download (or if you don’t offer any software downloads, the attackers start doing so).
  • Censoring some of your content. Changing your expressions of opinion.
  • Injecting advertisements.
  • Replacing the data of your donations account with their own.

HTTPS can prevent this.

Attackers can’t read requested content.

When using HTTP, eavesdroppers can learn which pages/content on your host your visitors access. Although the content itself may be public, the knowledge that a specific person consumes it can be problematic:

  • It opens an attack vector for social engineering.
  • It infringes privacy.
  • It can lead to surveillance and punishment (right up to imprisonment, torture, death).

This, of course, depends on the nature of your content, but what seems to be harmless content to you can be interpreted differently by other parties.

Better be safe than sorry. HTTPS can prevent this.

share|improve this answer
1  
Indeed, HTTPS can prevent it. In some situations, it might not. See Lenovo Superfish for a fairly recent example. – Michael Kjörling yesterday
    
@MichaelKjörling: Yes, I’m aware of this (that’s why I made sure to use "can" ;)), but it’s an issue stemming from the behaviour of the visitor, not an issue with HTTPS itself or the way the webmaster uses it, right? The visitor should care about which CAs to trust (and the visitor should care about which software to install, especially if it has the permission to fiddle with the list of CAs to trust). – unor yesterday
    
Indeed; I'm not arguing against your point, only adding to it! – Michael Kjörling yesterday

Marketing firms like Hitwise pay ISPs to gather data about your site when you don' use SSL. Data about your site gets collected which you might rather not have your competitors know:

  • user demograhics
  • visitor statistics
  • popular pages
  • search engine keywords (although with "not provided" this is less of an issue these days)
share|improve this answer

You get HTTP/2 support, the new web standard designed to significantly improve website loading speeds.

Because browser makers have chosen to support HTTP/2 only over HTTPS, enabling HTTPS (on a server that supports HTTP/2) is the only way to get this speed upgrade.

share|improve this answer

Besides the benefits mentioned by others there is one reason that will make you switch to SSL unless you don't care about your visitors that use Chrome - the new versions of Chrome (starting from the end of the year as far as I remember) are going to show a warning (which will drive away users from your site) by default for all sites that aren't using HTTPS.

//EDIT:

Here are links to two more detailed articles, though I can't seem to find the one I've read about when they're planning to officially introduce the feature:

https://motherboard.vice.com/read/google-will-soon-shame-all-websites-that-are-unencrypted-chrome-https

http://www.pandasecurity.com/mediacenter/security/websites-that-arent-using-https/

share|improve this answer
1  
Can you add any citations to reliable sources that support this? – Andrew Lott yesterday
    
@AndrewLott It's not a perfect citation for the claim made in the answer, but there's always Marking HTTP As Non-Secure. – Michael Kjörling yesterday
    
@Andrew Lott - see my edited answer. Unfortunately as stated there I can't seem to find the deploy date for this feature, though I think I read about December. – Sledge Hammer yesterday
    
Thanks both. This kind of answer is more useful to visitors as it gives them the background as well! – Andrew Lott yesterday

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.