Question is in the context of the recent Google announcement that it will soon add a “not secure” warning to all HTTP websites. My website is HTTP and is not much more than a simple “Hello, World!” website.

It has no forms for user input. It does not get any content from other sources and has no external links. So how can it not be secure?


It is insecure because people using open Wi-Fi networks expose their HTTP GET requests to the general public. Anyone on the same open Wi-Fi network can see what sub-pages of your website people are reading. This may not be information they want to expose to the general public.

In contrast, a HTTPS website only exposes the DNS query for the domain name. People can't see what sub-pages of your website other people are reading.


In addition to the passive attack that lets (bad) people know what your users are reading, HTTP allows active attack where someone intercepts or diverts the traffic and alters it.

For example, assume you have friends who trust your judgement about food, and the proprietor of Joe's Diner sets up a fake server so that when someone requests a page from your site instead of the 'Hello World' you actually wrote they instead see 'Joe's Diner is really great, I've personally checked it out and you should eat there every day!'. In fact Joe is a crook and his food is contaminated, so your friends get sick and die. When their families look at their browser caches and see the advice from your website killed their loved ones they may be peeved at you.

  • That’s exactly the problem. Doesn’t have to be so terrible either, I could just inject a cryptominer in all unencrypted pages. – Daniel B Feb 12 '18 at 8:09
  • More likely a site could be used as a disposable front for a phishing scheme or host viagra/oxycodone ads. – JakeGould Feb 12 '18 at 14:48

It is secure enough for "you". But for someone accessing it, it may not be secure.

This is topical, as a popular service is currently serving images of subscribers using http. As other subscribers "swipe" these images, they expose information about their "preferences" as the images can be seen by anyone sniffing the traffic.

If you are just hosting the weather it may not matter. Anyone typing in credentials should be concerned, and even with https or RDP inside a VPN they are not necessarily secure from sovereign agencies such as the NSA.

Being logged in to a Google account is not going to do them any favours either.

But this label does not mean your site is malicious or a threat, although a suggestible person may lead themselves to believe that is may be.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.