What are the pros and cons of a 100% HTTPS site?

Question

First, let me admit that what I know about HTTPS is pretty rudimentary. I don\'t know much about session security, encryption, or how either of those things is supposed to b

Answer 1

The traditional reason for not having the entire site behind SSL is processing time. It does take more work for both the client and the server to use SSL. However, this overhead is fairly small compared to modern processors.

If you are running a very large site, you may need to scale slightly faster if you are encrypting everything.

You also need to buy a certificate, or use a self signed one which may not be trusted by your users.

You also need a dedicated IP address. If you are on a shared hosting system, you need to have an IP that you can dedicate to only having SSL on your site.

But if you can afford a certificate and private ip and don't mind needed a slightly faster server, using SSL on your entire site is a great idea.

With the number of attacks that SSL mitigates, I would say do it.