I reckon that static sites that don't require JS can stay just fine using HTTP (provided you turn off JS in the browser, which is the best default you should be

I reckon that static sites that don't require JS can stay just fine using HTTP (provided you turn off JS in the browser, which is the best default you should be having anyway) Please do correct me if I'm wrong, but I think a whole lot of trouble can come if you enable running scripts over unsecured connections. From malicious DOM manipulations to exploiting CPU vulnerabilities. All of this of course if you assume the website you're visiting isn't itself doing malicious things :)