For most startups, the performance hit is not a big deal. If your a serious startup, you need your own IP, so this shouldn't be a roadblock. Setup is not hard

For most startups, the performance hit is not a big deal. If your a serious startup, you need your own IP, so this shouldn't be a roadblock. Setup is not hard. If you can't setup an SSL cert, how are you going to manage the rest of your server concerns? Cost of the cert? This is a drop in the bucket compared to the rest of your startup. For most, the big problem is the all or nothing decision. Most end users don't like the browser asking about switching protocols, for example, for the login or credit card process. So the easy choice is to use https for everything. But that's a waste, most of your requests don't need it. But there is lots of waste that buys you value: ruby, multi-layered frameworks and libs, etc.