Facebook had this problem for <i>years</i>, even after they started hiring industry veterans who would know better (<a href="https:&#x2F;&#x2F;www.sslshopper.com&#x2F;article-how-to-make-a-secure-login-form-with-ssl.html" rel="nofollow">https:&#x2F;&#x2F;www.sslshopper.com&#x2F;article-how-to-make-a-secure-logi...</a>). Amateur hour lasted for so long that just thinking of their codebase makes me ill.