Good practice or bad practice to force entire site to HTTPS?

Question

I have a site that works very well when everything is in HTTPS (authentication, web services etc). If I mix http and https it requires more coding (cross domain problems).

I don't seem to see many web sites that are entirely in HTTPS so I was wondering if it was a bad idea to go about it this way?

Edit: Site is to be hosted on Azure cloud where Bandwidth and CPU usage could be an issue...

Answer 1

HTTPS decreases server throughput so may be a bad idea if your hardware can't cope with it. You might find this post useful. This paper (academic) also discusses the overhead of HTTPS.

Answer 2

you lose a lot of features with https (mainly related to performance)

• Proxies cannot cache pages
• You cannot use a reverse proxy for performance improvement
• You cannot host multiple domains on the same IP address
• Obviously, the encryption consumes CPU

Maybe that's no problem for you though, it really depends on the requirements

Answer 3

If you have HTTP requests coming from a HTTPS page you'll force the user to confirm the loading of unsecure data. Annoying on some websites I use.

Answer 4

If you've no side effects then you are probably okay for now and might be happy not to create work where it is not needed.

However, there is little reason to encrypt all your traffic. Certainly login credentials or other sensitive data do. One the main things you would be losing out on is downstream caching. Your servers, the intermediate ISPs and users cannot cache the https. This may not be completely relevant as it reads that you are only providing services. However, it completely depends on your setup and whether there is opportunity for caching and if performance is an issue at all.

Answer 5

I hate running into pointlessly all-https sites that handle nothing that really requires encryption. Mainly because they all seem to be 10x slower than every other site I visit. Like most of the documentation pages on developer.mozilla.org will force you to view it with https, for no reason whatsoever, and it always takes long to load.

Answer 6

It is a good idea to use all-HTTPS - or at least provide knowledgeable users with the option for all-HTTPS.

If there are certain cases where HTTPS is completely useless and in those cases you find that performance is degraded, only then would you default to or permit non-HTTPS.