Redirecting to https is still problematic though. Let's say your websites homepage only uses http but the login form is over https. You can MiTM the homepage,

Redirecting to https is still problematic though. Let's say your websites homepage only uses http but the login form is over https. You can MiTM the homepage, and change the login link to haX0r.xyz and then proxy the login.