No, you don't get it: There is no such thing as a "static" web page in the context of a MITM attack. The MITM can change the page to ANYTHING he wants it to b

No, you don't get it: There is no such thing as a "static" web page in the context of a MITM attack. The MITM can change the page to ANYTHING he wants it to be. The HTML you receive can be a completely different page than the one sitting on your server. HTTPS protects you from that. It ensures that the HTML you receive is the same HTML from the server. That's why I sad: The only way unencrypted HTTP is reasonable is when you are fairly sure that there isn't a MITM. Like on your local LAN--anything that goes across the public internet is suspect. > If they can inject malicious content then you should fix the exploits on your platform. This is not reasonable. Literally every browser out there has multiple 0-days show up every year. Chrome, Firefox, Brave, Safari, Edge, you name it.