Leeds do 😉

Without HSTS. Offering both HTTP and HTTPS is pointless

HSTS tells browsers to ignore the HTTP response other than the redirect-to-HTTPS, and then the HTTPS served HSTS locks the browser in for the period the HSTS header states.

So yes, unless you're in the preload list, it won't prevent a MITM doing an HTTP-only thing, but the moment *any* resource gets loaded from the HTTPS real site, the browser is "fixed"