Can I put an order form designed for offline usage to print over non SSL?
You might think putting a simple order form without a submit but designed to print and post over non-SSL could be secure, but guess what it’s not secure at all! An attacker can inject a piece of JavaScript to this request, can log every single keystroke and send them to attacker’s website automatically. Thus you shouldn’t put an order form or any similar form which requires private information such Credit Card details, address, phone numbers etc. In a similar way putting an offline order form such as PDF file to over non-SSL URL is another bad practice since attack can send this PDF file on the fly and modify post address or similar information to get benefit out of it. This is common problem with banking websites where they provide these kind of forms over non-SSL connections.
