Why Static Websites Need HTTPS
When I read things like that, I always think of the paper "The Rational Rejection of Security Advice by Users". [1]Yes, content injection is bad, but the chance of it happening multiplied by the damage it could cause to your users is probably less than the the effort required to shift a static blog site to HTTPS. (Do not underestimate the leap in difficulty from copy-pasting from an Nginx tutorial to understanding how Let's Encrypt works).[1] https://www.nspw.org/2009/proceedings/2009/nspw2009-herley.p...