You could just as easily register a separate domain and use HTTPS on that if your goal is to inject scripts in the background. The &quot;problem&quot; being reported here is that the user may think the site is not going to send them malware because it has a green padlock in the address bar