强制整个网站使用 HTTPS 是好做法还是坏做法？
我有一个网站，当所有内容都采用 HTTPS（身份验证、Web 服务等）时，该网站运行良好。 如果我混合 http 和 https，则需要更多编码（跨域问题）。
我似乎没有看到很多完全采用 HTTPS 的网站，所以我想知道这样做是否是一个坏主意？
编辑：站点将托管在 Azure 云上，其中带宽和 CPU 使用率可能是一个问题...
10 年后编辑：现在正确的答案是仅使用 https。
I have a site that works very well when everything is in HTTPS (authentication, web services etc). If I mix http and https it requires more coding (cross domain problems).
I don't seem to see many web sites that are entirely in HTTPS so I was wondering if it was a bad idea to go about it this way?
Edit: Site is to be hosted on Azure cloud where Bandwidth and CPU usage could be an issue...
EDIT 10 years later: The correct answer is now to use https only.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（7）
https 会丢失很多功能（主要与性能相关）
也许这对您来说不是问题，这实际上取决于要求
you lose a lot of features with https (mainly related to performance)
Maybe that's no problem for you though, it really depends on the requirements
HTTPS 会降低服务器吞吐量，因此如果您的硬件无法应对它，这可能不是一个好主意。 您可能会发现这篇文章很有用。 本文（学术）还讨论了HTTPS 的开销。
HTTPS decreases server throughput so may be a bad idea if your hardware can't cope with it. You might find this post useful. This paper (academic) also discusses the overhead of HTTPS.
如果您有来自 HTTPS 页面的 HTTP 请求，您将强制用户确认不安全数据的加载。 在我使用的一些网站上很烦人。
If you have HTTP requests coming from a HTTPS page you'll force the user to confirm the loading of unsecure data. Annoying on some websites I use.
这个问题，尤其是答案已经过时。 此问题应标记为：
，以便它不再出现在搜索结果中。为了使此答案具有相关性：
Google 现在会对未能使用 TLS/https 的网站搜索排名进行惩罚。 您还会因重复内容而受到排名处罚，因此请小心将页面EITHER提供为httpOR https 但绝不能两者兼而有之（或者使用准确的规范标签！）
Google 还积极表明不安全的连接，这会对转化产生负面影响吓跑潜在用户。
这是为了追求仅 TLS 的网络/互联网，这是一件好事。 TLS 不仅仅是保证您的密码安全，而是保证您整个面向世界的环境的安全和真实。
“性能损失”神话实际上只是基于过时的过时技术。 这是一个比较，显示 TLS 比 HTTP 更快（但是应该注意的是，该页面也加密HTTP/2 HTTPS 与纯文本 HTTP/1.1 的比较）。
使用 LetsEncrypt（如果您还没有证书）。
如果您确实有证书，请做好准备并在任何地方使用 HTTPS。
如果
TL;DR，在 2019 年，在站点范围内使用 TLS 是理想的选择，并且建议也使用 HTTP/2。
This question and especially the answers are OBSOLETE. This question should be tagged:
<meta name="robots" content="noindex">so that it no longer appears in search results.To make THIS answer relevant:
Google is now penalizing website search rankings when they fail to use TLS/https. You will ALSO be penalized in rankings for duplicate content, so be careful to serve a page EITHER as http OR https BUT NEVER BOTH (Or use accurate canonical tags!)
Google is also aggressively indicating insecure connections which has a negative impact on conversions by frightening-off would-be users.
This is in pursuit of a TLS-only web/internet, which is a GOOD thing. TLS is not just about keeping your passwords secure — it's about keeping your entire world-facing environment secure and authentic.
The "performance penalty" myth is really just based on antiquated obsolete technology. This is a comparison that shows TLS being faster than HTTP (however it should be noted that page is also a comparison of encrypted HTTP/2 HTTPS vs Plaintext HTTP/1.1).
It is fairly easy and free to implement using LetsEncrypt if you don't already have a certificate in place.
If you DO have a certificate, then batten down the hatches and use HTTPS everywhere.
TL;DR, here in 2019 it is ideal to use TLS site-wide, and advisable to use HTTP/2 as well.
如果您没有副作用，那么您现在可能没问题，并且可能会很高兴不在不需要的地方创建工作。
然而，没有理由对所有流量进行加密。 当然，登录凭据或其他敏感数据也是如此。 您将失去的主要内容之一是下游缓存。 您的服务器、中间 ISP 和用户无法缓存 https。 这可能并不完全相关，因为它表明您只是提供服务。 但是，这完全取决于您的设置以及是否有缓存的机会以及性能是否是一个问题。
If you've no side effects then you are probably okay for now and might be happy not to create work where it is not needed.
However, there is little reason to encrypt all your traffic. Certainly login credentials or other sensitive data do. One the main things you would be losing out on is downstream caching. Your servers, the intermediate ISPs and users cannot cache the https. This may not be completely relevant as it reads that you are only providing services. However, it completely depends on your setup and whether there is opportunity for caching and if performance is an issue at all.
使用全 HTTPS 是一个好主意 - 或者至少为知识渊博的用户提供全 HTTPS 的选项。
如果在某些情况下 HTTPS 完全无用，并且在这些情况下您发现性能下降，那么您才会默认或允许非 HTTPS。
It is a good idea to use all-HTTPS - or at least provide knowledgeable users with the option for all-HTTPS.
If there are certain cases where HTTPS is completely useless and in those cases you find that performance is degraded, only then would you default to or permit non-HTTPS.
我讨厌遇到毫无意义的全 https 网站，这些网站不处理任何真正需要加密的内容。 主要是因为它们似乎都比我访问的其他网站慢 10 倍。 就像developer.mozilla.org 上的大多数文档页面一样，它会无缘无故地强制您使用 https 来查看它，而且加载总是需要很长时间。
I hate running into pointlessly all-https sites that handle nothing that really requires encryption. Mainly because they all seem to be 10x slower than every other site I visit. Like most of the documentation pages on developer.mozilla.org will force you to view it with https, for no reason whatsoever, and it always takes long to load.