Skip to content

insecure.club

A directory of websites that support HTTP sans S.


Why does this exist?

  1. To make it easier to find cool sites that can be viewed in old browsers.
  2. To raise awareness of the value of HTTP and encourage webmasters to disable automatic HTTPS redirects.

What sites are eligible?

See the rules section of the submit page. The TL;DR is it needs to be a real website accessible over HTTP.

Why should websites support insecure HTTP?

HTTPS is a massive barrier between old browsers and the web --- particularly the small and independent web, which is not so gung-ho about JavaScript. Many websites have solid HTML and would work just fine in truly ancient browsers, but the HTTPS requirement immediately cuts them off.

Mandatory HTTPS is a form of forced obsolescence. Devices that are still perfectly functional are made artificially incompatible with the web, thus adding to ever-growing mountains of e-waste and discriminating against people who can't afford the latest computer/fondleslab.

Plus, using old computers is fun.

What about privacy?

Which is worse: the risk of being spied on when you visit a website, or not being able to visit it at all?

Users should be allowed to decide for themselves if they accept that risk --- particularly since browsers make it very difficult to access insecure websites. Anyone who uses HTTP has probably either jumped through several hoops to voluntarily circumvent their browser safeguards or is entirely unable to use HTTPS.

Sites often support broken HTTPS cipher suites for compatibility. Instead, they should drop the old ciphers and add HTTP --- that way compatibility is maximized and users are informed when their connection isn't truly secure.

I want to renounce industry best practices, but I don't want to self-host, and also I'm a cheapskate. What do?

I've started a list of free webhosts that support HTTP.

Got any other hot tips for serving HTTP?

For maximum insecurity, you should steer clear of top-level domains on the HSTS preload list. These are hardcoded in browsers to only support HTTPS. You might think that's fine because browsers old enough to need HTTP won't have the preload list, but that's not entirely true.

Browsers with the preload list can still be incompatible due to outdated cipher suites. Many browsers support HTTPS but not modern HTTPS --- an ever-moving target. Plus, it's more difficult to tell during development if insecure HTTP is working (if you mostly use a modern browser, which you probably should).

TLDs to avoid

Note that some of these may be reserved for evil corporations or otherwise unavailable for registration. The preload list is controlled by Google and changes over time.

You're using the word "insecure" wrong.

You are encouraged to submit websites that lack self-confidence (and also support HTTP).