Allow non-SSL pages to use https or Force non-SSL pages to http?

Question

I have a basic question which I did not see previously asked here. I think it belongs here because of the fact that it deals with attempting to secure wordpress.

Which is more secure across requests?

To allow non-ssl secured pages over https or should those requests be forced back to http?

What is the effect or benefit of having a non-ssl page forced over https? Say a homepage where the user is not logged in is making a https request. In this example what is the security gain? Is it better to redirect to the http version of the page instead?

If allowing https is better, are there any (potential) pitfalls in the wordpress core that would cause redirect issues if allowing https for non-ssl pages either directly on the page or via ajax/admin-ajax?

Answer 1

The short answer is that you should always use https whenever possible even on the most basic websites regardless of whether you use wordpress. Here are some of the reasons with a short explanation.

1. Security - Even on pages that don't necessarily need to be secure it is useful to use https because you want cover as many situations as possible. Consider, you may have a contact form on your site where you collect users' personal (if not necessarily secret) data. If that form is filled out without https in a coffee shop, now anyone in that coffee shop who was looking has that user's information. This is a simple example but you can see that the possibilities here are many and varied (think about cookies et. al.).
2. Spoofing - This could easily be a sub-category of security. When you use https, you make it much more difficult for your site to be spoofed via man in the middle.
3. Referrer Data - When you go from an https page to an http page all referrer data is lost. This may or may not be an issue for you but it is still something to consider. When you are jumping between http and https within a site you have to consider that you will be losing any referrer data (which can be bad for seo and especially bad if your site has advertising).
4. SEO - Google and other search engines give sites that are https enabled a higher ranking. There are various arguments to be made on whether or not this is a good policy but it is a policy regardless.
5. Why Not? - If you are hosting a site and you have an ssl certificate why not use it on all the pages. There isn't a real downside and personally, I've found that it is much easier to just turn it on for an entire site using the apache (or IIS) configuration and forget about it rather than trying to constantly manage which pages are and are not secure.

These are just a few of the big reasons, there are others that are just as valid.