| Keeping it extremely high level: Among other reasons, not encrypting traffic gives an opportunity for bad actors to replace content in transit to your end users when your end users are on compromised connections, such as rogue "free" wifi networks in airports or coffee shops, or even legitimate networks which have in some way been compromised, e.g. the ISPs of the world who decide to inject other content e.g. their own ads into unencrypted traffic. The next question is usually "what could they possibly do, change a few pictures?" They could inject malicious payloads, and for all your users would know, it would appear to them that it came from your site. > I can't use LetsEncrypt with my hosting provider Consider switching. For a static site, consider Gitlab; they do a good job of permitting LetsEncrypt. --- I sincerely appreciate the question, though. I have marketing people ask me this question all the time in private who hesitate to do so in public because quite a few security types berate them for not doing something "obviously" more secure. It's not at all obvious to most of the world's web designers and content creators that a static site should be TLS'd until it's framed (heh) in this manner. The fact that you asked brings about a massive educational moment. Anyway, consider switching hosts. :) |