Why Static Websites Need HTTPS
When I read things like that, I always think of the paper "The Rational Rejection of Security Advice by Users". [1]<p>Yes, content injection is bad, but the chance of it happening multiplied by the damage it could cause to your users is probably less than the the effort required to shift a static blog site to HTTPS. (Do not underestimate the leap in difficulty from copy-pasting from an Nginx tutorial to understanding how Let's Encrypt works).<p>[1] <a href="https://www.nspw.org/2009/proceedings/2009/nspw2009-herley.pdf" rel="nofollow">https://www.nspw.org/2009/proceedings/2009/nspw2009-herley.p...</a>