Web Applications Stack Exchange is a question and answer site for power users of web applications. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In my website, I have a Product Order Form. When a fills the necessary details and clicks Submit, the control is transferred to PayPal for processing transaction. I have a business account.

I want to know whether I need SSL for my Product Purchase Page. I am not asking any details of credit card but simply directing to PayPal site to get it done.

share|improve this question

migrated from superuser.com Dec 23 '10 at 11:25

This question came from our site for computer enthusiasts and power users.

I won't buy from a site that doesn't have SSL on its own site -- login details, anything that gets passed over should not be in cleartext. There will be some customer information being passed, and it provides me (and many others I know of) with peace of mind.

share|improve this answer
True, but to extend on this a bit: assuming the PayPal URLs are all HTTPS, then HTTPS on one's own domain does NOT make the payments any more secure. – Arjan Dec 23 '10 at 11:26
Not more secure on the payment side, no, but potentially more secure in general, as there are likely to be details that would useful to an attacker being transmitted to/from the site. – Matthieu Cartier Dec 23 '10 at 11:33
If the site requires (or even allows) login/registration, yes, SSL should be supported. If there is nothing other than product selection and a handoff to PayPal, it isn't really necessary. The Firesheep release highlighted how trivial it is for to get access to site information and credentials if non-SSL access is allowed for logged-in users. – TomG Dec 23 '10 at 13:43

SSL is used for secure transaction. but in today's date SSL is primarily required for web site. As it will also secure your important data like Payment Form Details and other billing related details.

Personally I feel SSL should be there for more secure business.

share|improve this answer

You will need an SSL for your site. Even if you are not charging Credit Card on your site or using paypal to collect payments.

As you are asking user to put their login details and personal information like address, profile image etc. SSL is strongly recommended in today's trend to protect customer's sensitive information. Even facebook and twitter is also using SSL to protect their user's data. Try to go to change your account data on facebook and you will see https there

You may check which SSL suits your needs by this link http://mycheapssl.com/index.php?route=common/whichSSL

share|improve this answer

I'd say "it depends". If all you have is a simple shopping cart that doesn't store any user information, and you have all the money processed by PayPal where the cards are entered through their interface, I wouldn't bother with the SSL. So someone wants to snoop the products that are getting bought? Not really a big deal.

Checking Amazon, I notice that even they don't start encrypting things until you move into active checkout, or your personal account page.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.