Before the invention of HSTS security policy, if a user didn't specify the protocol in the URL, were all the initial requests sent over HTTP by default for every website?
FIrst request is made over HTTP then the site redirects you to the HTTPS website.
Check out this post
It says it in an example of how sites used to work:
More specifically, these are the steps for logging into the bank’s site:
- You type “www.mybank.com” into the address bar and hit enter.
- The browser assumes “www.mybank.com” should be requested over HTTP by default, so the initial request is unencrypted.
- The server at “http://www.mybank.com” responds with an HTTP redirect to “https://www.mybank.com”
- The secure connection is established, and a login page is served via HTTPS.
- You enter your password and do your banking.