It's not "compulsory" -- nobody is forcing the sites.

But it is advisable. While the homepage/etc¹ need not be on an HTTPS connection, all the pages that have forms and those which show sensitive data should be. For example, it's perfectly OK for a site to let you shop on HTTP, but will redirect you to HTTPS for checkout.

Try to keep HTTPS for all pages after a log in to prevent session hijacking as well.

Without an HTTPS connection, all the details you enter into the form will be visible to an attacker.

^{1. There may be some benefits of doing this, though. It could prevent a man in the middle from modifying the secure links to point to their own, HTTP sites.}

It's not "compulsory" -- nobody is forcing the sites.

But it is advisable. While the homepage/etc¹ need not be on an HTTPS connection, all the pages that have forms and those which show sensitive data should be. For example, it's perfectly OK for a site to let you shop on HTTP, but will redirect you to HTTPS for checkout.

Try to keep HTTPS for all pages after a log in to prevent session hijacking as well. It is best to keep your HTTPS pages on a separate domain (http://example.com but https://shop.example.com) for this same reason.

Otherwise, just encrypt all the things. It's not too hard.

Without an HTTPS connection, all the details you enter into the form will be visible to an attacker.

^{1. There may be some benefits of doing this, though. It could prevent a man in the middle from modifying the secure links to point to their own, HTTP sites.}

It's not "compulsory" -- nobody is forcing the sites.

But it is advisable. While the homepage/etc need not be on an HTTPS connection, all the pages that have forms and those which show sensitive data should be. For example, it's perfectly OK for a site to let you shop on HTTP, but will redirect you to HTTPS for checkout.

Without an HTTPS connection, all the details you enter into the form will be visible to an attacker.

It's not "compulsory" -- nobody is forcing the sites.

But it is advisable. While the homepage/etc¹ need not be on an HTTPS connection, all the pages that have forms and those which show sensitive data should be. For example, it's perfectly OK for a site to let you shop on HTTP, but will redirect you to HTTPS for checkout.

Try to keep HTTPS for all pages after a log in to prevent session hijacking as well.

Without an HTTPS connection, all the details you enter into the form will be visible to an attacker.

^{1. There may be some benefits of doing this, though. It could prevent a man in the middle from modifying the secure links to point to their own, HTTP sites.}