Cloudflair https is free, (https://www.cloudflare.com/ssl/) and not such a big of a pain to setup. without https, let's say someone puts a wifi hotspot named JFK_AIRPORT_FREE_WIFI in the airport, and plays with the DNS setting and points to his own version of the internet. https websites are more or less protected from these as the certificates will not be valid. http ones are completely open to manipulation. Do you lock your door at night? even though most likely no one will come in? Do you look who is at the door before opening it? Why is expecting https is a bit too much? Why is security something people see as "we can add it later when needed". It should be part of the checklist before releasing. Most people won't release without documentation, a decent automated build, some unit tests, right? Security should be way up that list as well. Another reason is showing you mind about security. Getting https is just one step, making sure the code is secure is a whole different topic. If you don't care about https, how do I know (without reading the code) that you care about not using DES, that you care about hashing + salting your passwords, that you care about not logging sensitive information, that you don't run as root when not needed, that you take care of my data and not compromise it. It starts with "meh, https is a bit too much" and ends up with Linkedin passwords leaking because they just hashed it. This is not cooking. You can't always add salt later. </rant>