The most secure approach is to serve everything over HTTPS <i>AND</i> redirect HTTP to HTTPS <i>WITH</i> &quot;Strict-Transport-Security&quot; header [1]. Even this is not perfect, but it&#x27;s the best approach available AFAIK.<p>1.<a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;HTTP_Strict_Transport_Security" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;HTTP_Strict_Transport_Security</a>