HTTPS should be the only allowed protocol about fish-site HOT 2 CLOSED

Redirecting automatically to HTTPS is pretty easy and mitigates this issue.

Does it? Can't the attacker intercept the redirect?

HSTS is a reasonable thing to implement though (with a slow-growing expiry time).

from fish-site.

Yeah, you are right about that. If someone is typing the URL, they will probably not write https, and I'm fairly sure all browsers just go to the http version by default.

However, and someone will probably have access to analytics to check this, most users don't just directly type the url. Most traffic will come from links pasted on other webs, social media, or other.
Just by enabling the https redirection, most of the traffic will go directly to the https version.

HSTS can be enabled with pretty short expiring dates, so that would work great as well! However, keep in mind that it's just a HTTP header that gets saved. If a user has never opened the website, and they navigate to the http version, it can still be hijacked. The only way to surpass this is preloading the hsts on the browser, which chromes does for decently sized websites that send the header

from fish-site.