Have a HTTP or HTTPS website?

Question

There were some questions regarding this topic, but none of them discussed if there is some expection, and if http is just enough for some kind of websites.

I've seen lot of school/high school websites with just http, so there was no https link. On this websites there was also no login or something present, so was a let's say normal static kind of website (I did not check it further, maybe there was some hidden link to login and edit the website). Does this kind of website need a https? What is a danger of having just http for this site?

Another example would be a personal website. Imagine you have a website where people can read your info, the projects you were working on and contact details; so no login and nothing. Does this kind of website requires a https connection? Also here, what is dangerous of having just http for this site?

Also this: http://collegeinfogeek.com/
This website is http, but does this website need a https for their purpose?

One more thing that is not clear for me. If there is a login option present on the website, https is highly reccomended. But in the case we use http and we encrypt the login credentials and send the ecrypted data on the server we should be also secure or?

NOTE: I am reffering to "small" websites, not an organization or business website (with bank transactions and so). Just normal site with login possibility.

Answer 1

HTTPS is always recommended these days. And generally fairly easy to implement too.

Any webiste that contains sensitive information or any that simply has a login MUST be secured with HTTPS. Othewise, you are sending information in clear text over the Internet which is easily intercepted.

For sites with no login and no sensitive information, HTTPS is perhaps less critical but there are still reasons. The main one being that without it, it is possible for attackers to substitute some of your legitimate content with their own. When using HTTPS, the end-to-end conversation is encrypted and so attacker have no way of intercepting and replacing content.

The other main reason to want HTTPS always is to stop 3rd parties from following what you are reading.

These apply to the website you listed. Although the store part of the site is already secured with HTTPS, the general sections are not, by default, and so may be vulnerable to attack and eavesdropping.

You should note, however, that having a general website only use HTTP is still very common and the risks are generally not that bad.

Note: Try using HTTPS on that website, For me, it completely messed up the formatting. So something is not correctly configured.

Regarding login pages: It is best practice to encrypt the login page not just the actual login dialogue. This ensures that the end-to-end communication is encrypted and it provides visible assurance to the user that you have done the right thing. Never give your login details on a page that isn't using HTTPS. Not for any reason. You probably don't have time to go round checking what the system is doing behind the scenes and it indicates poor understanding and/or practice on the site owners and developers parts.