Eh, we get pen-testers regularly telling us that we have to turn off HTTP and HTTPS (we had one who helpfully suggested serving the site over a VPN) in order to be secure.

This was on retail eCommerce websites.