Where it stops being optional.
PAYMENT PROCESSING
Every reputable payment gateway requires https on any page involved in a transaction. Most require it site-wide.
A shop without https will be refused by gateways, and browsers block form submission on insecure pages.
WHAT IS NOT ACCEPTABLE
Securing only the checkout page. Browsers flag any page with a form field, and session handling breaks between secure and insecure pages.
CARD DATA
Never accept or store card details on your own server. Use a hosted gateway where details are entered on the provider's infrastructure. HTTPS is necessary but does not by itself make you suitable to handle card data.
DATA PROTECTION
Collecting personal data over an unencrypted connection is difficult to defend under the NDPR or any comparable framework. Encryption in transit is a baseline expectation.
LOGIN PAGES
Any page accepting a password must be secure. An insecure admin login sends the password in plain text.
THE PRACTICAL POSITION
Secure the entire site. Partial HTTPS creates more problems than it solves and saves nothing.
