The only solution is to always go for the HTTPS resource disregarding any suggestion. On browsers a strict configuration of Smart HTTPS [0] covers that, for everything else I think the best solution would be to intercept all HTTP traffic, request the HTTPS counterpart (and decide if falling back on failure is acceptable instead of just dropping the connection), then serving locally the decrypted response. Worse than properly requesting the right one from the start but harder enough to exploit.
> Are there any other "non-usual" recommendations for writing code?
Pretty unusual, but after years I finally managed to find an alternative to Consolas I liked enough in Oxygen Mono—albeit I turned down a lot of really good fonts just because they had too much interline spacing and I couldn't tweak in Sublime.
Pretty much no Unicode support outside of common accents (good for every European language at least) and common programming symbols, though. Still I edited in em and en dashes and never found it lacking since.
[0] https://mybrowseraddon.com/smart-https.html