I want to put a PayPal donate button on my web page, at the moment it doesn't have https (I'm working on it...)

Would this be insecure for the people donating or for me?

  • That depends on how the donate button works. If it is a link to https://secure-donation-site/unique-recipient-id, then it should be vulnerable only to MITM alteration of the link target. While this isn't good, as far as I'm aware it is the best (simple) option for a non-HTTPS site. – Οurous Mar 29 '17 at 21:41
  • 1
    Related: stackoverflow.com/questions/28648475/… – Arminius Mar 29 '17 at 21:44

The problem with having a link to an encrypted site (https) from an unencrypted (http) one is that if someone could "man in the middle" the cleartext (http) traffic they could change which link you go to.

More importantly in the case of your PayPal button, an attacker could send you to a fake website where they copied all the current PayPal HTML for look & feel but then use that to collect username/passwords or otherwise gain access to you clients accounts. Fake websites like this which harvest user credentials have existed for years.

In this case, the risk isn't to PayPal so much as it is to your clients and your clients PayPal accounts.

This said there are a number of easy options to encrypt the page hosting your PayPal button, or it's equivalent.


I haven't used Paypal in a while, but if I remeber correctly the "Donate" button links the user to a secure Paypal page to complete the transaction. However, I would still recommend getting an SSL. you can get one as cheap as $9 from NameCheap.

  • 1
    You can get a certificate for free with Let's Encrypt, no need to pay. – Arminius Mar 29 '17 at 21:38
  • @Arminius Correct but that will not carry any level of insurance (although actually claiming SSL/TLS insurance is next to impossible). – SuperAdmin Mar 29 '17 at 21:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.