> If a user goes to http://site.com http://site.com, even if you have a redirector to the https://site.com https://site.com version, the https version can be MI

> If a user goes to http://site.com http://site.com, even if you have a redirector to the https://site.com https://site.com version, the https version can be MITM'd with a self-signed certificate. At which point their browser will give them a big scary security warning.