All of them, but some sites are more vulnerable than others such as financial institutions, big-name brands, and government entities. You must use SSL protection if your website is PCI compliant and accepts payment cards, or does any of the following:
Banking sites asking for financial information.
If your website accepts payment cards (American Express, Diners Club International, MasterCard, Visa. Including credit, debit, prepaid, and gift cards), you have to comply with the credit card associations' rules about data security. The goal being to protect cardholder data. This has been standardised under the Payment Card Industry Data Security Standard (PCI DSS). If you don’t use an SSL certificate on your website, you won’t be complying with the PCI standards.
Your website asks customers to provide personal or sensitive information such as email addresses, social security numbers, medical records, and passport numbers.
You have login forms on your website asking users to enter their username and password.
Your site provides webmail where users can login and read email in a secure environment.
There are subscription pages for newsletters, mailing lists, etc.