I think people forget that any non-HTTPS page can be tampered with in flight. For example, to deliver a form that looks like it uses Stripe but actually goes to

I think people forget that any non-HTTPS page can be tampered with in flight. For example, to deliver a form that looks like it uses Stripe but actually goes to an attacker. HTTPS is a 100% must on all pages for a business.