I guess it's because those sites have content that are largely public anyway. That is, you don't have to login to consume their content. They still would redirect to https when you do sensitive things like logging in or changing your profile. Content driven sites don't need to face any problems with SSL. Even major CDNs have https URLs nowadays. I don't see any reason at all not to use SSL for a web application today. It's just that a lot of sites started before SSL became commonplace and they haven't moved to encrypt the whole site yet. I believe Jeff Atwood (stackoverflow.com's founder) would have made stackoverflow.com https by default if he started it today. You can read his thoughts on this matter here - http://blog.codinghorror.com/should-all-web-traffic-be-encrypted/ Just checked .. Quora does redirect to https by default.