i have been searching around this area about mitm attacks and realize that every single page that doesn't have HSTS preload is vunerable to mitm attacks in first connection to the site. the solution to this, is to add it to the HSTS preload list : https://hstspreload.org/
But for differents reasons some websites can't implement this because as a bug bounty team told me 2 days ago:
"we are limited in some technical example.com subdomains. At foreseeable future, we can't force HTTPS on all subdomains because it breaks dependent infrastructure"
does anybody know another way to protect agaisnt this attack without adding the domains and all subdomains into the HSTS preload list??