Will I confuse users by making my whole site HTTPS?

Question

I'd like to make every page on my site load through HTTPS by default (less hassle at my end, personally I prefer HTTPS if given a choice as a user).

However, I'm concerned that seeing the HTTPS icon / green bar in their browser will confuse some users, because they associate it (and have even been told to associate it by many sites) with things like secure logins, online purchases, personal information being sent etc.

My site does have a members area, but also a lot of free content that anyone can access.

Question: is it likely that seeing HTTPS on simple content pages will confuse users, or make them wary that something 'more serious' is going on?

Answer 1

I guess not—many consumer/entertaiment sites are adopting HTTPS. Twitter and Facebook are amongst most popular examples. Also migrating to “HTTPS by default” is a general trend in Web so it’ll soon become a norm instead of exception.

Answer 2

Most people won't even notice unless your certificate requires user interaction to accept it.

We don't know the demographics of your site, but as a general rule you can consider that user will type site.com on the address bar, which will take them to your space on the hosting company and there the answer will take them to the right URL, whatever that is. Other will type the address on their favourite search engine, which will take them directly to the right URL or will show the results with the correct URL and they will click on it.

Just a bunch of them will type the whole address, and those, will notice the redirection from HTTP to HTTPS, so there should be no problem with them.

Conclusion, the only thing you have to do, is to be sure that you site is configured properly, so all the redirections occur seamlessly and that the user is not jumping from HTTP to HTTPS.

Answer 3

Just make sure that your server certificates are always Ok. Don't let them run out, don't redirect to URLs with a different address and use the same server certificate and so on. Because then your users will notice and get some rather frightening notices from their browsers that might cause them to abandon your site.

Answer 4

I see two issues: Server Name Indication and ads.

If you're on a less expensive hosting tier, you share an IP address with several other web sites. With cleartext HTTP, the Host: header distinguishes among web sites on port 443 of a single IP address. But with HTTPS, the server's SSL stack needs to know what the hostname is before it can send the correct certificate. Otherwise, it'll just send the first certificate, which might not match your particular site. But the extension to provide a hostname to the SSL stack, called Server Name Indication (SNI), is fairly recent, and older browsers don't support it. The most important non-SNI browsers are Internet Explorer for Windows XP and Android Browser for Android 2.x. So in order not to confuse users of these older browsers, you'll need to make your site's certificate the first one on that IP address, which means buying a dedicated IPv4 address from your hosting provider.

If your web site uses a third-party advertisement server to fund the publication of "free content that anyone can access", you'll have to either make sure it supports HTTPS, or web browsers will present "mixed active content" warnings that may scare your users. AdSense appears to be the first major ad network to add HTTPS support, and even that didn't happen until September 2013 (less than six months ago as of this writing).

Answer 5

There is nothing wrong with having public content delivered over http + ssl (https). It's the other way around you may fail, as our student web-mail back in 2008 was delivered over http. That is a real security issue.

When it comes to your users, a https indicator is a notion of safe, secure, valid and trustworthy. Your users will feel even more relaxed if they see the https image, even if it makes no difference on a public site.

Answer 6

NO. HTTPS increase confidence of user’s and ensure them about a secure connection. It does not mean that your website has sensitive content. An SSL from trusted CA will provide the highest level of encryption. CA verifies domain ownership and organization detail before issuing the certificate. So, HTTPS connection offers security as well as confidence.

Answer 7

Google and other browser developers are also forcing https. Chrome now won't allow geolocation without it. They are trying to force every website to ssl over the next few years.

We want to start by requiring secure origins for these existing features:

• Device motion / orientation
• EME
• Fullscreen
• Geolocation
• getUserMedia

As with gradually marking HTTP as non-secure (https://www.chromium.org/Home/chromium-security/marking-http-as-non-secure), we expect to gradually migrate these features to secure-only, based on thresholds of usage, starting with lowest usage and moving towards higher. We also expect to gradually indicate in the UX that the features are deprecated for non-secure origins.

The deprecation strategy for each of these features is not decided on and may very well differ from feature to feature. We don’t currently know what the thresholds will be, or how heavily used the features are on what kinds of origins. We are in the process of gathering data, and will report back when we have it. There are no firm plans at all at this time, other than eventual deprecation. We intend for this to stimulate a public discussion of the best way to approach this deprecation. So, to that point, we'd love to hear what the community thinks.

see http://www.brightedge.com/blog/is-https-really-necessary/ and https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/2LXKVWYkOus/gT-ZamfwAKsJ

And now Mozilla is in the game as well…

There’s pretty broad agreement that HTTPS is the way forward for the web. In recent months, there have been statements from IETF, IAB (even the other IAB), W3C, and the US Government calling for universal use of encryption by Internet applications, which in the case of the web means HTTPS.

After a robust discussion on our community mailing list, Mozilla is committing to focus new development efforts on the secure web, and start removing capabilities from the non-secure web. There are two broad elements of this plan:

• Setting a date after which all new features will be available only to secure websites
• Gradually phasing out access to browser features for non-secure websites, especially features that pose risks to users’ security and privacy.

See full entry here https://blog.mozilla.org/security/2015/04/30/deprecating-non-secure-http/

So to answer the OPs question. No you will not confuse users as all site will end up secure on https with ssl.

UPDATE: ios10 beta3 and beta4 now require https for location as well.

Answer 8

Agree with all above. I would suggest a fallback page to explain what it is and why you are doing it if the user rejects the HTTPS request. Not sure how you are signing your certificates, but that page can be used to educate users that reject it that you are simply making everything more secure as a default and for general privacy.

Answer 9

1) What's hassle do you have? We have VIP subscription page with payment form. Taking credit card information requires https of course so we put this page under https protocol. But the rest of the site is under http even in member area.

2) From technical point of view https is a bit slower - adds about 1 sec to page load time. SSL should be installed during the first page request - it takes 4 requests and further it requires less requests because of ssl-cache. But anyway it's a bit slower then http.