Is HTTPS Always needed any more?

[ltcomdata]

Hello:

If I understand correctly, enabling the HSTS protocol in the Security options makes Pale Moon use HTTPS.
So, is HTTPS Always needed any more with this option checked?

But enabling HSTS might come with some privacy concerns according to an old post (viewtopic.php?t=9999#p68698).
With this in mind, is there any advantage to disabling the HSTS protocol while at the same time using HTTPS Always?

Or is this issue moot altogether given that the majority of mainstream websites use https by default?

[Moonchild]

A lot has changed in the past 10 years.
HSTS is pretty much standard. you can still disable it if you want for the privacy reasons indicated.
HTTPS everywhere/HTTPS always doesn't have much use any more. The extension was primarily to deal with the transition period on the web, and if a site currently uses http and not https, it is usually for a reason.
Note that the extension and HSTS perform 2 slightly different functions.

[RealityRipple]

The "Enable Upgrade Insecure Requests" checkbox is probably the saner option than the extension: it lets the site you're visiting know you want to be redirected to its secure version.

[frostknight]

The "Enable Upgrade Insecure Requests" checkbox is probably the saner option than the extension: it lets the site you're visiting know you want to be redirected to its secure version.

Some sites for me such as archive.org, don't automatically go to https. This being said, I use https always for those specific sites.