Ideally, you should be using SSL any time you ask for information you don't want others to ever be able to see. Think about it this way: You log on to your sit

Ideally, you should be using SSL any time you ask for information you don't want others to ever be able to see. Think about it this way: You log on to your site via an open wireless network at your local coffee shop. Anything that you aren't SSL encrypting is being sniffed and read by the shady looking dude with the laptop and latte over in the corner. What don't you want him to see? SSL encrypt that. For my sites, this generally means any page where a password is entered. You might want to take it a step further and protect private profile pages or anything like that, but at a minimum, authentication should be encrypted over the wire. You might say "Well yeah, but I run a site where people post pictures of their morning poo, who cares if they get hacked?" - that's fine, but people have a horrible tendancy to use the same email and password all over the place. When Joe logs in to PostMyPoo with joe@gmail.com/hunter2, chances are Shady Latte Guy is going to pop over to gmail, punch in those credentials, and the vast majority of the time, he's in to Joe's account. He can now go through Joe's email to see what else Joe is signed up for, try his existing credentials, or issue password reset requests to get into anything else he wants. Suddenly, Joe has a data/identity security nightmare on his hands, and you bear some measure of responsibility for that.