HN Hall of Fame Weekly email

Why Static Websites Need HTTPS

www.troyhunt.com Essays & writing Essays & articles Security & privacy Candidate
Screenshot of www.troyhunt.com captured 2026-07-20
Page preview · captured 2026-07-20

Resurfaced independently across 3 calendar years, with breakout response in 2 of them.

submissions
6
submitters
6
observed span
2018–2021
peak thread · 253 comments
328 pts
latest 20+ return · 2020-01-25
153 pts

Submission timeline

2007–2026

One slot for every year since HN launched. Height is that year's peak points; orange marks a 100+ point or 50+ comment breakout. Select a bar to open its strongest thread.

First comments on top threads

HN comment order

Let's Encrypt is one of the best things that happened to the web recently. I wish we had more choices though. Relying so much on a single party is unnerving.

The recommendation of Cloudflare here seems poor. Using CF to make an HTTP only site support HTTPS will only prevent MITM between CF and the end user. MITM between my server and CF is not improved as it's still HTTP. Yes, you can add a self signed cert and tell CF not to check the cert validity, but that doesn't prevent MITM. Worse, Cloudflare can inject JavaScript into your site. The default settings will show Captchas to users if CF…

Why? Because you want somebody to be able to censor out your whole website without notifying you and without giving you any meaningful way to protest (CA revoking your certificate and giving you as much support as Google gives to its non-paying users or PayPal to the sellers). Now we have the same situation with DNS, but let's add more choking points, it surely is a good idea.

dozzie·3-point thread·

The first top-level comment from each of the four biggest threads, in HN’s own order. Excerpts are shortened; open a comment for full context.

Breakout years
2

100+ points or 50+ comments

Total points
497

reference only — not used in Hall rules or ranking

Total comments
391

reference only — not used in Hall rules or ranking

Every submission

DateTitle as submittedByPointsComments
2018-07-12Why Your Static Website Needs HTTPSel_duderino50
2018-07-13Here’s why your static website needs HTTPSMandieD60
2018-07-29Why Your Static Website Needs HTTPSvmarsy31
2018-08-28Why Static Websites Need HTTPSFirst breakout · Best threadedward328253
2020-01-25Why Your Static Website Needs HTTPS (2018)Latest 20+ point returncodesections153137
2021-10-06Why Your Static Website Needs HTTPS (2018)kaeruct20