I was going to make a purchase on a website, but the page containing the credit card entry form is served via HTTP and not HTTPS. Is it definitely unsafe?

The website advertises the use of "RapidSSL", but if I send my credit card number through HTTP, this SSL connection will not be used. Is pressing Next on this page a security concern?

no https


2 Answers 2


Checked it now: CC details are really sent UNENCRYPTED over the wire. They use no SSL at all. Not even on POST. The credit card details are really sent over the clear, over the wire. The RapidSSL button is even false, because it does not popup a validation when clicked (which real RapidSSL buttons should do)

I also checked. They have a SSL site with real certificate and Everything, but they specifically disable SSL by redirecting to HTTP when attempting to load the /secure namespace over HTTPS. It should really be the opposite, where HTTP redirects to HTTPS.

I would say you can be sure about submitting a CC number there, and thats only in this specifically case: If you are 100 % sure that your WHOLE PATH, from your computer, to that company's server, is completely trusted, then you can submit the CC there. That includes trusting your ISP, your landlord and every router and device on the path to the Company in question.

How to check yourself:

Check the source of the page. If the credit card form "form action=" parameter Point to a HTTPS site, its encrypted.

If the "form action=" parameter is empty or contains a invalid value, chances are the CC is submitted over a AJAX script and thus you have to rummage through tons of JS code to find out if CC are sent encrypted or not.

However, submitting to a HTTPS site from a HTTP site is NOT 100% SAFE. There is possible that the page in question has been modified in transit by a malicious indivual to send the details to a attacker's server or via a HTTP Connection to be able to sniff the data.

However, MITM/modifying attacks are rare, if you are home on your home Connection and you DO NOT sit on wireless, its pretty hard to get into a suitable position to be able to modify data in transit.

I would say: As long as the form submits to a HTTPS resource (form action=https://blaahblaahblaah) you can be SUFFICIENT safe that the credit card is not being leaked.

If we take the assumption that there only PASSIVE listernes, no Active adversiaries in the network, then your credit card number is 100% safe if the form is sent over HTTPS. However, this are NOT in case here, thus you should really trust the link Before sending anything there. Not even your home Connection may be fully 100% safe to send CC details there, if you account in the physical security of EVERY node on the path.


Under no circumstances is it safe to send a credit card number over a connection that is not secured. There are two reasons. The first is that you cannot know whether the path between you and the server is safe; the path can change from day to day, and even form minute to minute.

The more important reason is that the merchant who fails to secure their web transactions may have other bad habits. I don't mean to imply that they're dishonest; only that they either do not understand security or do not care about it. I'm not sure which is worse! So there may very well be other problems of which you are not yet aware.

If you must buy something from this site, check whether your credit card company offers one-time-use numbers, or pick up a prepaid card with just enough to complete the transaction. (Note: is it sometimes hard to spend the last few bucks on a prepaid card. Also, it may be harder to dispute a charge on a prepaid card. The one-shot number is the way to go if possible)

  • There is also Another thing to consider: Theres one thing that theres a teoretical risk that there is a sniffer or listerer somewhere, but Another consideration whenever there is a practical risk. Considering that the physical security of core ISP Cables are pretty high with direct alarms and such, and local Exchanges like ADSL lines and fiber lines to apartments are often in secured and alarmed closets, you can still take the risk. The big risk you are taking is that there MIGHT be a sniffer somewhere, that you dont notice, and then 2 years later the card number is misused, leaving you Dec 31, 2014 at 5:27
  • Clueless. The small risk you take is that there is propably not a sniffer in your path. If the data WOULD be sent over a HTTPS Connection but over a form loaded over HTTP, the risk of being subdued would be absolute minimal. In this case theres no HTTPS at all, so the risk is bigger. So what I would say: Its not a big deal if you are only doing a one time purchase. But dont get used of it, you might stumble on a sniffer without knowing. However, doing this on a WIFI Connection or a public space like cyber cafe or whatever, is basically suicide in the security market. If you must buy from this Dec 31, 2014 at 5:29
  • site, ONLY do it from a Connection in your home, that you are fairly Confident its a secure path to your ISP, and no part of path ever should be go over powerline Communication, bluetooth or Wifi Communication (not even a wifi Cable extender). Dec 31, 2014 at 5:34
  • 2
    @sebastiannielsen: I stand by my answer. Under no circumstances should one transmit sensitive information over a connection that's not encrypted. You talk about "theoretical" risks, but every time we turn around we find another "theoretical" risk has been realized. Ans, as I hove already written, the merchant who fails to secure their web transactions may have other bad habits.
    – Bob Brown
    Dec 31, 2014 at 8:40
  • 1
    @sebastiannielsen: Security is about minimizing the number of people whom you must trust. Encryption does that.
    – Bob Brown
    Jan 2, 2015 at 10:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .