That&#x27;s one of the reasons why HSTS [1] was invented. Basically your website itself informs the browser to never contact it though http. Then a man-in-the-middle, which can inject whatever in any http pages you visit, simply cannot inject (nor replace) your website ever, because they (supposedly) cannot fake a valid certificate covering your domain.<p>You can even submit your domain [2] so that current browsers automatically apply the https-only preference to your domain, even when it hasn&#x27;t ever been contacted before. Cool, isn&#x27;t it?<p>[1] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;HTTP_Strict_Transport_Security" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;HTTP_Strict_Transport_Security</a>
[2] <a href="https:&#x2F;&#x2F;hstspreload.appspot.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;hstspreload.appspot.com&#x2F;</a>