: Using HTTP (insecure) ad providers on HTTPS (secure) site As more and more browsers adopt stringent checks around preventing insecure content served up on secure sites, there is impact on the

@Lee4591628

You could do what Slashdot used to do:


Require HTTPS for pages directly related to user authentication, such as sign-up, login, password change, OpenID management, and subscription payment. Offer HTTP for all other pages.
Offer HTTPS to subscribers who have paid for ad-free access.
Redirect non-authentication, non-subscriber HTTPS page views back to HTTP so that ads can be displayed. This may hurt your SEO now that Google is ranking HTTPS sites slightly higher. It is also vulnerable to cookie copying attacks such as Firesheep, so be sure to warn users of this when they log in.

Vote Up Vote Down

@Murray432

I would think that using information served over HTTP on a HTTPS page would defeat some of the purpose of using HTTPS in the first place. HTTPS is meant to be more secure than HTTP, but once you start using HTTP on an HTTPS page you are only as secure as your weakest link, HTTP.

You said you were aware of HTTPS advertising networks, that is probably your safest bet.

If you do try a proxy solution you should make sure you read the Terms of Service, some advertising networks are strict about how you use their code/service.

Vote Up Vote Down