How secure is the website behind the SSL certificate?
One of the worst assumptions you can make is “the website is protected by SSL, so it must be secure” – WRONG WRONG WRONG. Slapping an SSL certificate around your website does not turn poor website programming into a bulletproof shield against hackers. Almost all incursions into secure data occur due to vulnerabilities in the security of the code that drives a website. SSL protected websites get hacked every day because they are just as vulnerable as non-SSL protected sites to many of the traditional hacks (Cross site scripting, SQL injection, remote code execution etc.). Many websites are now protected by something known as an Application Firewall. I would personally, much rather deal with a well written non-SSL website that has a well maintained Modsec Application Firewall protecting it, than a shoddy website that does have SSL.
