I've never encountered this scenario but would the security implications be to such a website?


Not really. If the user is on a HTTP non-login page, and clicks on a 'login' button, unlikely he/she is going to notice if the login is now using HTTPs or HTTP.

Best to have the entire site on HTTPs.

  • In addition, authentication data for subsequent requests is stored in cookies and are served over plain HTTP. Attacker can sniff them and use to authenticate the user without having to know actual credentials. Something like pass the hash attack.
    – Crypt32
    Nov 30 '17 at 6:12

Not the answer you're looking for? Browse other questions tagged or ask your own question.