Yes — and this isn't really debatable anymore for a public website. HTTPS protects more than payment forms, and modern browsers treat plain HTTP as the exception that needs justifying, not the reasonable default.
What's at risk even without payments
- Any login form — usernames and passwords sent in plaintext over HTTP can be intercepted on shared networks (public Wi-Fi, compromised routers)
- Contact forms and any personal information a visitor submits
- Content integrity — on plain HTTP, an attacker on the network path can inject ads, malware, or altered content into your pages without your server ever knowing
- Visitor trust — Chrome and other browsers actively label plain HTTP pages "Not Secure" in the address bar
The cost argument no longer applies
The one reason this used to be a real trade-off — cost and setup effort — has effectively disappeared. Free, automated certificates (Let's Encrypt, or built into most hosting) mean there's no longer a meaningful reason for any public site to skip HTTPS.
Why a simple contact form is enough of a reason on its own
Any form submission on a plain HTTP page, even something as simple as a name and email contact form, sends that data in plaintext across the network — trivially interceptable on shared or public networks, regardless of whether payment information is involved at all.
Why browsers now treat plain HTTP as the exception needing justification
The default has fully inverted from a decade ago: modern browsers actively flag plain HTTP pages as Not Secure rather than treating HTTPS as a special, optional upgrade — meaning the burden has shifted to justifying why a site would skip HTTPS, rather than justifying why it should have it.
What an attacker positioned on the network can in practice do without HTTPS
Beyond simply reading submitted form data, an attacker on an unencrypted connection's network path can also inject content into your pages, ads, malware, altered text, without your server ever being aware any tampering occurred, since there's no integrity protection at all on plain HTTP.
What a login form specifically risks even without any payment involved
A login form on plain HTTP transmits usernames and passwords in readable plaintext across the network — credentials are often reused across multiple sites, meaning a single intercepted login on an unrelated, low-stakes site can compromise a visitor's accounts elsewhere entirely, well beyond whatever that specific site itself protects.
Why search engines effectively already answered this question for you
Chrome and other major browsers now flag any plain HTTP page as Not Secure regardless of whether it collects payment information, effectively settling this question at the browser-vendor level rather than leaving it as a judgment call for individual site owners to weigh independently.
The short, current answer for anyone still weighing this
Yes, without meaningful exception for any public-facing site today — the historical trade-off that once made this a genuine judgment call, cost and setup effort, has disappeared with free, automated certificates now the default rather than a special upgrade.
What a realistic cost-benefit comparison looks like for a small, low-traffic site today
Given free, automated certificates cost nothing and require minimal ongoing effort, the realistic cost-benefit comparison for any site today overwhelmingly favors HTTPS regardless of traffic volume or payment handling — there's essentially no scenario where the previous era's cost and complexity trade-offs still substantially apply.
Loading comments…