Benefit of using CI - an honest question

In my opinion, the amount of security you need is a function of both the probability of attack and the stakes involved. Do you need SSL? Well, what are the chances that someone might intercept a login attempt? Sites like Amazon or Wells Fargo are attractive, but is yours? And what are the consequences of someone unauthorized hacking into one of your users account?

As for encrypting passwords, sure. It's easy to do and doesn't cost anything. But in my experience of running small websites, the main benefit is that you don't know your users' passwords.

While this seems logical, it is a very dangerous thing to say, especially when giving advice - it's discouraging people to think about security. Especially your second paragraph, it sounds like you're suggesting that storing passwords in plain-text is OK - it is not, period.

It doesn't matter if you're building a teapot or banking software - security is a requirement, not something that you decide to have or not.