I feel like every time I read a Jeff Atwood article , I have to do fact checking . This one is no exception . The performance penalty of HTTPS is gone , in fact , HTTPS arguably performs better than HTTP on modern devices . Actually , this is false . 1 . HTTPS still has CPU and bandwidth performance penalties . They may not be as noticeable as in the past , but they are still present , particularly as encryption algorithms get more complex there ' s a reason elliptical curve cryptography is recommended for HTTPS now . 2 . HTTP 2 was not finalized at the time the linked benchmark was posted . 3 . . and because of that , this benchmark is out of date . Since it was published , HTTP 2 was revised to allow unencrypted c o n nectionsrequireencryption . Which removes speed as a factor . And with that out of the way , HTTP will outperform HTTPS on the same protocol . Using HTTPS means nobody can tamper with the content in your web browser . Remember what I said before when I mentioned ECC Cryptography ? It ' s not enough for a site to simply use HTTPS , they also have to use an encryption protocol that isn ' t yet broken . For example , all versions of SSL are currently broken . TLS supports some encryption protocols that are broken . Browser manufacturers tend to update their browsers to reject broken protocols , but that doesn ' t help in businesses where they lock browsers at specific versions . See also The IE 6 problem , and its successor the IE 8 problem . The flip side of the coin is application and web servers that stick with older protocols as well I had to research this at my last job to bring out Oracle App Servers protocol list up to date to pass security scans .