earlier replies
Replying to @pwaring
Leeds do ๐Ÿ˜‰
Without HSTS. Offering both HTTP and HTTPS is pointless
Replying to @pwaring @Tom__Pollard
HSTS tells browsers to ignore the HTTP response other than the redirect-to-HTTPS, and then the HTTPS served HSTS locks the browser in for the period the HSTS header states.

Jul 24, 2018 ยท 9:09 AM UTC

1
Replying to @dsilverstone @pwaring @Tom__Pollard
So yes, unless you're in the preload list, it won't prevent a MITM doing an HTTP-only thing, but the moment *any* resource gets loaded from the HTTPS real site, the browser is "fixed"
1
Then again, getting on the preload list is fairly easy, if slow.