I’m going to change my mind about switching the whole site to HTTPS, after checking things out a lot more today. With embedded content from ads and videos and all of that kind of stuff from external sites, it’s really not feasible to run LGF entirely in HTTPS mode. I can only secure the content I directly control, and stuff like MSNBC videos, for example, will load content from lots of non-secure HTTP connections, and that reassuring padlock icon never shows up. There are some other technical reasons too.

Instead I’m going to stick with the original plan and run only the stuff that handles sensitive data with HTTPS, like the registration, confirmation, account settings and sign-in scripts, and continue following the current best practices for security otherwise.