As your site can be consulted in http mode, I assume that it contains no highly sensitive content. The choice HTTP vs. HTTPS is a matter of exchanging security for performance:
- all what can be done in HTTP can be done in HTTPS and you get a higher security
- HTTPS is more resource consuming
As a rule of thumb, use HTTPS if you can offer enough resources and HTTP if the value of the data is low.
It can be admissible to mix HTTP for normal pages and HTTPS for sensitive pages like credential exchange provided:
- the server will reject any HTTP request to a secure page => if a page containing HTTPS links is rewritten with HTTP links you will get a redirect to the HTTPS page or an error
- the overall security of the site is at HTTP level
- you are confident in your users to control that sensitive pages come from your site
What you must be aware is that as soon as the session uses an insecure cookie (HTTP mode) you should not be confident in that session to access sensitive information.
So this is correct: HTTP consultation => link to HTTPS for login => new session after login => HTTP consultation - the overall security is low-medium because the session cookie is insecure and you only protect credentials
But this is bad: HTTPS login => HTTP consultation of non sensitive pages => HTTPS consultation/modification of sensitive data
because here the security level of the session has dropped to HTTP and it is still used for sensitive operations.
The minimal should be:
... => HTTP operations => HTTPS control of credential or of a secure cookie => new session => HTTPS operations ...
The greatest risk here is that you should instruct your users that the login page is special and that they should control that the little padlock is present and the url is in correct domain. The risk is here:
- an attacker managed to get a copy of your login page
- it manage to send one of your users to a page he controls
- the user writes his credentials
=> the attacker has gained all accesses allowed to the user
TL/DR: having only a part of the site (including login page) in HTTPS is acceptable only if:
- the login page is only accessible in HTTPS and creates a new session
- any transition from HTTP to HTTPS requires a control of credentials (or of a special secure cookie)
- all your users control that the URL of the login page is correct before entering their credentials