Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

I'd like to make every page on my site load through HTTPS by default (less hassle at my end, personally I prefer HTTPS if given a choice as a user).

However, I'm concerned that seeing the HTTPS icon / green bar in their browser will confuse some users, because they associate it (and have even been told to associate it by many sites) with things like secure logins, online purchases, personal information being sent etc.

My site does have a members area, but also a lot of free content that anyone can access.

Question: is it likely that seeing HTTPS on simple content pages will confuse users, or make them wary that something 'more serious' is going on?

share|improve this question
1  
In my experience it is the opposite. You don't notice the https icon unless you have to input sensitive information. –  avi Feb 19 at 7:51
1  
Don't know about confusion. But you might loose many users because some firewalls/internet proxy don't let SSL/port 443 to pass through. Fascist firewalls. –  Bleeding Fingers Feb 19 at 14:22
2  
Note that many of us are running the "https; everywhere" browser plug-in, which always tries the HTTPS protocol first even when the URI said http:. And a fair number of websites do immediately redirect users who come in via HTTP to their HTTPS side. I really don't think anyone is going to object if a site is more secure than it needs to be... and the folks who might be confused will probably never even notice. –  keshlam Feb 21 at 0:26
1  
Just make sure that ALL of your assets (images etc) are served over HTTPS, otherwise users will get mixed-content warnings. –  Nicolas Raoul Feb 21 at 8:49
1  
If you are selling a web service, you shall do everything with HTTPS, no excuses! –  Abektes Feb 24 at 13:15

7 Answers 7

up vote 42 down vote accepted

I guess not—many consumer/entertaiment sites are adopting HTTPS. Twitter and Facebook are amongst most popular examples. Also migrating to “HTTPS by default” is a general trend in Web so it’ll soon become a norm instead of exception.

share|improve this answer
1  
That's also my view on this. However, Facebook and Twitter are membership sites, which leads me to this concern. –  Hugh Feb 19 at 5:50
3  
Add google to twitter and facebook. These days it seems impossible to use anything by google through http. –  SAM Feb 19 at 17:12

Most people won't even notice unless your certificate requires user interaction to accept it.

We don't know the demographics of your site, but as a general rule you can consider that user will type site.com on the address bar, which will take them to your space on the hosting company and there the answer will take them to the right URL, whatever that is. Other will type the address on their favourite search engine, which will take them directly to the right URL or will show the results with the correct URL and they will click on it.

Just a bunch of them will type the whole address, and those, will notice the redirection from HTTP to HTTPS, so there should be no problem with them.

Conclusion, the only thing you have to do, is to be sure that you site is configured properly, so all the redirections occur seamlessly and that the user is not jumping from HTTP to HTTPS.

share|improve this answer

Just make sure that your server certificates are always Ok. Don't let them run out, don't redirect to URLs with a different address and use the same server certificate and so on. Because then your users will notice and get some rather frightening notices from their browsers that might cause them to abandon your site.

share|improve this answer

I see two issues: Server Name Indication and ads.

If you're on a less expensive hosting tier, you share an IP address with several other web sites. With cleartext HTTP, the Host: header distinguishes among web sites on port 443 of a single IP address. But with HTTPS, the server's SSL stack needs to know what the hostname is before it can send the correct certificate. Otherwise, it'll just send the first certificate, which might not match your particular site. But the extension to provide a hostname to the SSL stack, called Server Name Indication (SNI), is fairly recent, and older browsers don't support it. The most important non-SNI browsers are Internet Explorer for Windows XP and Android Browser for Android 2.x. So in order not to confuse users of these older browsers, you'll need to make your site's certificate the first one on that IP address, which means buying a dedicated IPv4 address from your hosting provider.

If your web site uses a third-party advertisement server to fund the publication of "free content that anyone can access", you'll have to either make sure it supports HTTPS, or web browsers will present "mixed active content" warnings that may scare your users. AdSense appears to be the first major ad network to add HTTPS support, and even that didn't happen until September 2013 (less than six months ago as of this writing).

share|improve this answer
    
That's a very good point that it may complicate integrations with other services. –  Hugh Feb 21 at 4:25

There is nothing wrong with having public content delivered over http + ssl (https). It's the other way around you may fail, as our student web-mail back in 2008 was delivered over http. That is a real security issue.

When it comes to your users, a https indicator is a notion of safe, secure, valid and trustworthy. Your users will feel even more relaxed if they see the https image, even if it makes no difference on a public site.

share|improve this answer

Agree with all above. I would suggest a fallback page to explain what it is and why you are doing it if the user rejects the HTTPS request. Not sure how you are signing your certificates, but that page can be used to educate users that reject it that you are simply making everything more secure as a default and for general privacy.

share|improve this answer

1) What's hassle do you have? We have VIP subscription page with payment form. Taking credit card information requires https of course so we put this page under https protocol. But the rest of the site is under http even in member area.

2) From technical point of view https is a bit slower - adds about 1 sec to page load time. SSL should be installed during the first page request - it takes 4 requests and further it requires less requests because of ssl-cache. But anyway it's a bit slower then http.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.