does HTTP pose any threat to the website itself?

[JoneLoveIT]

We usually think of HTTP is unsafe to users who browse the website, but does it pose any threat to the website itself? is HTTP more vulnerable compared to HTTPS?

[Nayr438]

Unless your dealing with sensitive data, not really. You should checkout this page on HTTPS however, https://www.cloudflare.com/learning/ssl/why-is-http-not-secure/

By not having a certificate however your users may get hit with a unsecure warning which may deter users from your site.

 

There is little reason not to have a Certifcate anymore to handle HTTPS requests, you can obtain a free certificate from LetsEncrypt. I would imagine most website hosting providers offer a option to generate one, for self hosters there is Certbot to help automate the process as well.

[Master Disaster]

1 hour ago, Nayr438 said:

Unless your dealing with sensitive data, not really. You should checkout this page on HTTPS however, https://www.cloudflare.com/learning/ssl/why-is-http-not-secure/

By not having a certificate however your users may get hit with a unsecure warning which may deter users from your site.

 

There is little reason not to have a Certifcate anymore to handle HTTPS requests, you can obtain a free certificate from LetsEncrypt. I would imagine most website hosting providers offer a option to generate one, for self hosters there is Certbot to help automate the process as well.

^This

 

My webserver has 5 subdomains and they all have an autorenewing LE certificate, it takes literal seconds, heck certbot even automagically copies your HTTP config, changes it to port to 443, adds the SSL information, adds a redirect to the HTTPS site from the old HTTP one, saves the configs, enables the HTTPS site and reloads Apache/NGINX for you.

 

Even on hosting services you can still use certbot, as long as you have root SSH to the terminal certbot uses file based verification to determine the domain ownership (it basically adds a challenge file to the root of the website then looks online to check it can find the file on the domain you specified).