This note preserves the original context of the Facebook post. Some tools, interfaces, and external links may have changed.
Websites don’t only require HTTPS when they require users to enter a password or checkout.
HTTPS mainly protects Internet users from three parts.
- Encryption: Prevent the data being transmitted from being read by others.
- Data Integrity: Allow the recipient to detect whether the data has been tampered with during transmission.
- Verification: Let the user know that they are connecting to the intended website server and not the person being impersonated.
If you only use HTTPS for login or transaction pages, other HTTP pages may still become entry points for attacks.
The attacker doesn’t necessarily have to directly steal the account and password, but may also modify images, JavaScript, or page content, or make the user believe they are browsing the correct website.
This post was published in 2018 and also mentioned that Chrome would soon mark HTTP websites as unsafe.
I reserve it here as a historical note on website security concepts, rather than a how-to guide for today’s browser interfaces.
Related reading
How Search Engines Work: Crawling
Crawling is the first step in search. A crawler starts with a URL, visits it, discovers more URLs, and repeats the cycle. The concept sounds simple, but it contains many important SEO details.
What happens after entering the URL: from Request to Status Code
Use a simplified web page request process to understand how Request Headers, Response Headers and 2XX, 3XX, 4XX, and 5XX status codes describe the results of resources.
Trailing slashes and duplicate content: What really needs to be unified is the entire URL signal
Organizes the differences between URL trailing slashes, HTTP/HTTPS, www and non-www versions, and explains that canonical, redirects, internal links, and sitemaps should all point to the same version.