I want to enable HTTPS for my website on pages where data is sent by the user (forms, comments etc).

Does it make sense to enable it only when a page uses forms or is it easier to enable globally?

If not globally, do I also need it on search?


You should enable it globally, otherwise you'll be vulnerable to the situation where an attacker modifies the unencrypted form to send all the user data to evilserver.com rather than to the one you want (or, since the attacker is actively listening, modify the form action to use HTTP instead of HTTPS).

You may also get into a configuration headache encrypting only on selective paths. It's usually easier just to encrypt everything, and it will prevent the aforementioned attack.

  • Thanks, I just thought it would help the performance not to use https when it's not needed. But you're probably right; it might create unwanted problems and unseen cases might not be covered. – Martin Aug 2 '13 at 13:11
  • SSL isn't the performance hit that it once was. CPUs are faster, more core-capable and there's optimisation mechanisms for SSL if you're really heavy traffic (offload cards, etc). – Tom O'Connor Aug 2 '13 at 13:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.