I have a basic question which I did not see previously asked here. I think it belongs here because of the fact that it deals with attempting to secure wordpress.
Which is more secure across requests?
To allow non-ssl secured pages over https or should those requests be forced back to http?
What is the effect or benefit of having a non-ssl page forced over https? Say a homepage where the user is not logged in is making a https request. In this example what is the security gain? Is it better to redirect to the http version of the page instead?
If allowing https is better, are there any (potential) pitfalls in the wordpress core that would cause redirect issues if allowing https for non-ssl pages either directly on the page or via ajax/admin-ajax?