I want to put a PayPal donate button on my web page, at the moment it doesn't have https (I'm working on it...)
Would this be insecure for the people donating or for me?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
The problem with having a link to an encrypted site (https) from an unencrypted (http) one is that if someone could "man in the middle" the cleartext (http) traffic they could change which link you go to.
More importantly in the case of your PayPal button, an attacker could send you to a fake website where they copied all the current PayPal HTML for look & feel but then use that to collect username/passwords or otherwise gain access to you clients accounts. Fake websites like this which harvest user credentials have existed for years.
In this case, the risk isn't to PayPal so much as it is to your clients and your clients PayPal accounts.
This said there are a number of easy options to encrypt the page hosting your PayPal button, or it's equivalent.