User Experience Stack Exchange is a question and answer site for user experience researchers and experts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to make every page on my site load through HTTPS by default (less hassle at my end, personally I prefer HTTPS if given a choice as a user).

However, I'm concerned that seeing the HTTPS icon / green bar in their browser will confuse some users, because they associate it (and have even been told to associate it by many sites) with things like secure logins, online purchases, personal information being sent etc.

My site does have a members area, but also a lot of free content that anyone can access.

Question: is it likely that seeing HTTPS on simple content pages will confuse users, or make them wary that something 'more serious' is going on?

share|improve this question
1  
In my experience it is the opposite. You don't notice the https icon unless you have to input sensitive information. – avi Feb 19 '14 at 7:51
1  
Don't know about confusion. But you might loose many users because some firewalls/internet proxy don't let SSL/port 443 to pass through. Fascist firewalls. – Bleeding Fingers Feb 19 '14 at 14:22
3  
Note that many of us are running the "https; everywhere" browser plug-in, which always tries the HTTPS protocol first even when the URI said http:. And a fair number of websites do immediately redirect users who come in via HTTP to their HTTPS side. I really don't think anyone is going to object if a site is more secure than it needs to be... and the folks who might be confused will probably never even notice. – keshlam Feb 21 '14 at 0:26
2  
Just make sure that ALL of your assets (images etc) are served over HTTPS, otherwise users will get mixed-content warnings. – Nicolas Raoul Feb 21 '14 at 8:49
1  
If you are selling a web service, you shall do everything with HTTPS, no excuses! – Abektes Feb 24 '14 at 13:15
up vote 44 down vote accepted

I guess not—many consumer/entertaiment sites are adopting HTTPS. Twitter and Facebook are amongst most popular examples. Also migrating to “HTTPS by default” is a general trend in Web so it’ll soon become a norm instead of exception.

share|improve this answer
1  
That's also my view on this. However, Facebook and Twitter are membership sites, which leads me to this concern. – Xiu Feb 19 '14 at 5:50
3  
Add google to twitter and facebook. These days it seems impossible to use anything by google through http. – SAM Feb 19 '14 at 17:12

Most people won't even notice unless your certificate requires user interaction to accept it.

We don't know the demographics of your site, but as a general rule you can consider that user will type site.com on the address bar, which will take them to your space on the hosting company and there the answer will take them to the right URL, whatever that is. Other will type the address on their favourite search engine, which will take them directly to the right URL or will show the results with the correct URL and they will click on it.

Just a bunch of them will type the whole address, and those, will notice the redirection from HTTP to HTTPS, so there should be no problem with them.

Conclusion, the only thing you have to do, is to be sure that you site is configured properly, so all the redirections occur seamlessly and that the user is not jumping from HTTP to HTTPS.

share|improve this answer

Just make sure that your server certificates are always Ok. Don't let them run out, don't redirect to URLs with a different address and use the same server certificate and so on. Because then your users will notice and get some rather frightening notices from their browsers that might cause them to abandon your site.

share|improve this answer

I see two issues: Server Name Indication and ads.

If you're on a less expensive hosting tier, you share an IP address with several other web sites. With cleartext HTTP, the Host: header distinguishes among web sites on port 443 of a single IP address. But with HTTPS, the server's SSL stack needs to know what the hostname is before it can send the correct certificate. Otherwise, it'll just send the first certificate, which might not match your particular site. But the extension to provide a hostname to the SSL stack, called Server Name Indication (SNI), is fairly recent, and older browsers don't support it. The most important non-SNI browsers are Internet Explorer for Windows XP and Android Browser for Android 2.x. So in order not to confuse users of these older browsers, you'll need to make your site's certificate the first one on that IP address, which means buying a dedicated IPv4 address from your hosting provider.

If your web site uses a third-party advertisement server to fund the publication of "free content that anyone can access", you'll have to either make sure it supports HTTPS, or web browsers will present "mixed active content" warnings that may scare your users. AdSense appears to be the first major ad network to add HTTPS support, and even that didn't happen until September 2013 (less than six months ago as of this writing).

share|improve this answer
    
That's a very good point that it may complicate integrations with other services. – Xiu Feb 21 '14 at 4:25

There is nothing wrong with having public content delivered over http + ssl (https). It's the other way around you may fail, as our student web-mail back in 2008 was delivered over http. That is a real security issue.

When it comes to your users, a https indicator is a notion of safe, secure, valid and trustworthy. Your users will feel even more relaxed if they see the https image, even if it makes no difference on a public site.

share|improve this answer

NO. HTTPS increase confidence of user’s and ensure them about a secure connection. It does not mean that your website has sensitive content. An SSL from trusted CA will provide the highest level of encryption. CA verifies domain ownership and organization detail before issuing the certificate. So, HTTPS connection offers security as well as confidence.

share|improve this answer

Google and other browser developers are also forcing https. Chrome now won't allow geolocation without it. They are trying to force every website to ssl over the next few years.

We want to start by requiring secure origins for these existing features:

  • Device motion / orientation
  • EME
  • Fullscreen
  • Geolocation
  • getUserMedia

As with gradually marking HTTP as non-secure (https://www.chromium.org/Home/chromium-security/marking-http-as-non-secure), we expect to gradually migrate these features to secure-only, based on thresholds of usage, starting with lowest usage and moving towards higher. We also expect to gradually indicate in the UX that the features are deprecated for non-secure origins.

The deprecation strategy for each of these features is not decided on and may very well differ from feature to feature. We don’t currently know what the thresholds will be, or how heavily used the features are on what kinds of origins. We are in the process of gathering data, and will report back when we have it. There are no firm plans at all at this time, other than eventual deprecation. We intend for this to stimulate a public discussion of the best way to approach this deprecation. So, to that point, we'd love to hear what the community thinks.

see http://www.brightedge.com/blog/is-https-really-necessary/ and https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/2LXKVWYkOus/gT-ZamfwAKsJ

And now Mozilla is in the game as well…

There’s pretty broad agreement that HTTPS is the way forward for the web. In recent months, there have been statements from IETF, IAB (even the other IAB), W3C, and the US Government calling for universal use of encryption by Internet applications, which in the case of the web means HTTPS.

After a robust discussion on our community mailing list, Mozilla is committing to focus new development efforts on the secure web, and start removing capabilities from the non-secure web. There are two broad elements of this plan:

  • Setting a date after which all new features will be available only to secure websites
  • Gradually phasing out access to browser features for non-secure websites, especially features that pose risks to users’ security and privacy.

See full entry here https://blog.mozilla.org/security/2015/04/30/deprecating-non-secure-http/

So to answer the OPs question. No you will not confuse users as all site will end up secure on https with ssl.

share|improve this answer
    
please include teh relevant part of the link in your answer so if it's deleted, the answer remains – Devin May 10 at 19:27
    
Agreed with Devin, this is now (could be) the most relevant answer since Google is essentially forcing https, but right now it is just lacking relevant details. – DasBeasto May 10 at 19:47

Agree with all above. I would suggest a fallback page to explain what it is and why you are doing it if the user rejects the HTTPS request. Not sure how you are signing your certificates, but that page can be used to educate users that reject it that you are simply making everything more secure as a default and for general privacy.

share|improve this answer

1) What's hassle do you have? We have VIP subscription page with payment form. Taking credit card information requires https of course so we put this page under https protocol. But the rest of the site is under http even in member area.

2) From technical point of view https is a bit slower - adds about 1 sec to page load time. SSL should be installed during the first page request - it takes 4 requests and further it requires less requests because of ssl-cache. But anyway it's a bit slower then http.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.