It's not safe to do only logins over HTTPS because if the initial site is served over HTTP, an attacker could rewrite the URL or inject JavaScript to leak your

It's not safe to do only logins over HTTPS because if the initial site is served over HTTP, an attacker could rewrite the URL or inject JavaScript to leak your password. Also, once you're signed in, every request sends a cookie which is also valuable to steal as it's an active session. Every request needs to be encrypted. We haven't made TLS worse by deploying it everywhere.