There's this common misconception that sans user input a site is fine without https. Unfortunately this is not the case. Site security serves not only the purp

There's this common misconception that sans user input a site is fine without https. Unfortunately this is not the case. Site security serves not only the purpose of protecting user input, but also ensuring that the data you are receiving has not been altered, ammended or replaced. At the low level it stops an ISP injecting their own ads or tracking, at the high level it prevents the injection of malicious code downstream from the site itself. Things like link-replacement, javascript injection, altered text, and so on make even read-only style sites untrustworthy over plain http.