Tell me more ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.
up vote 0 down vote favorite

My development team is considering implementing an eCommerce site using end-to-end SSL -- that is, every page on the site is accessed via an https:// URL -- rather than the more traditional "mixed mode" where most pages are accessed via http:// and only "secure" pages such as login and credit card entry are redirected to https://.

Pros of doing such a "pure SSL" approach include avoidance of some session-hijacking attacks such as Firesheep; cons include performance considerations.

My question is: Is anyone aware of a list of eCommerce websites (especially USA-based sites), or even specific websites, that use this end-to-end SSL approach? I'm especially interested in "regular" eCommerce sites rather than banks or other "financial" sites.

share|improve this question
2  
I work at a company that I suppose you'd call a financial site (Braintree) and we serve everything, even our documentation, over SSL. I think the additional cost due to decreased performance is minimal, and it shows people how seriously we take security. I would definitely suggest it -- but I'm the kind of person who uses HTTPS even on sites like Google and Wikipedia, as well as the HTTPS Anywhere extension. – agf Oct 1 '12 at 20:39

closed as not constructive by Su', John Conde♦ Oct 3 '12 at 0:08

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or specific expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, see the FAQ for guidance.

1 Answer

up vote 0 down vote

If you're running a "typical" ecommerce site, I would recommend considering those cons quite seriously. Significantly slower load times, significantly higher server load, and requiring extreme scrutiny to ensure every single resource is loaded over SSL.

Imagine making a blog post and trying to post an external image. Or using social sharing code that pulls from another server. Or any of the dozens of situations your typical website would be using a non-SSL resource that poses virtually no security risk.

Not trying to dissuade you from doing it, but I just don't think there is any good reason for most sites. Unless you are a security related firm or have some reason for specifically putting the extra work into it (like in Jon's case, where his company specializes in payment processing), I seriously doubt your average user is going to be excited about it. In fact, most users will probably be annoyed by the load times.

Take it from the leaders... Amazon doesn't do it. eBay doesn't do it. Overstock.com doesn't do it. HSN doesn't do it. Why should you?

To directly answer your question though, no I'm not aware of any big eCommerce sites that require SSL on every single page.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.