> The overall connection will drop to "mixed status", but the inner frame will still be HTTPS. That is not possible. You would get a cert mismatch error. Cons

> The overall connection will drop to "mixed status", but the inner frame will still be HTTPS. That is not possible. You would get a cert mismatch error. Consider what your browser does when you navigate to the page: it directly opens a TLS connection to port 443. There's nothing your ISP can do to force the browser to request the page using a non-TLS connection. What might have happened, is that you might have carelessly typed the address in your URL bar without the "https:// https://" prefix, as in "www.example.com"; for legacy historical reasons, most browsers (except IIRC some very old browsers from the dialup era, which always required an explicit URL scheme) treated that as if you had prefixed it with http:// http:// (so it actually was the non-HTTPS "http://www.example.com http://www.example.com" that you were using). Many sites would then redirect you to the HTTPS site, but your ISP could hijack the page before that redirect (since the redirect was not protected by HTTPS). Had you been careful to always prefix any address you type with "https:// https://", there would be no initial non-HTTPS connection to hijack.