If your users get to your https login page by following a link from your http front page, I think he can rewrite the link in the front page to be http, and the

If your users get to your https login page by following a link from your http front page, I think he can rewrite the link in the front page to be http, and the attack can still happen. As you say in your other comment, we need more details.