(Parts taken from my answer to a similar question.)
HTTPS can achieve two things:
- Authentication. Making sure that the visitor is communicating with the real domain owner.
- Encryption. Making sure that only this domain owner and the visitor can read their communication.
Probably everyone agrees that HTTPS should be mandatory when transmitting secrets (like passwords, banking data etc.), but even if your site does not process such secrets, there are several other cases where and why the use of HTTPS can be beneficial.
Attackers can’t tamper with requested content.
When using HTTP, eavesdroppers could manipulate the content your visitors see on your website. For example:
- Including malware in the software you offer for download (or if you don’t offer any software downloads, the attackers start doing so).
- Censoring some of your content. Changing your expressions of opinion.
- Injecting advertisements.
- Replacing the data of your donations account with their own.
HTTPS can prevent this.
Attackers can’t read requested content.
When using HTTP, eavesdroppers can learn which pages/content on your host your visitors access. Although the content itself may be public, the knowledge that a specific person consumes it can be problematic:
- It opens an attack vector for social engineering.
- It infringes privacy.
- It can lead to surveillance and punishment (right up to imprisonment, torture, death).
This, of course, depends on the nature of your content, but what seems to be harmless content to you can be interpreted differently by other parties.
Better be safe than sorry. HTTPS can prevent this.