This blog post is an expanded version of a Twitter thread I posted several years ago about why every website should use HTTPS. Twitter seems less… readily citable these days, so I thought it would be good to have a blog post version of it.