Given the way things are heading on the internet now, and Google making statements about weighing HTTPS sites higher than HTTP in the past couple of months, you might as well make it totally HTTPS.

You don't want to log in on HTTPS then redirect back to HTTP, you'll have issues with people being logged in and out intermittently. People have tried to address this issue over the years, but I don't think it has ever been solved.

I would set HTTPS always on and handle it in .htaccess, redirecting any non HTTPS traffic to HTTP.

Given the way things are heading on the internet now, and Google making statements about weighing HTTPS sites higher than HTTP in the past couple of months, you might as well make it totally HTTPS.

You don't want to log in on HTTPS then redirect back to HTTP, you'll have issues with people being logged in and out intermittently. People have tried to address this issue over the years, but I don't think it has ever been solved.

I would set HTTPS always on and handle it in .htaccess, redirecting any non HTTPS traffic to HTTP. (to clarify, you do not need a module to do any of this - just follow the instructions in .htaccess and work with your hosting provider to provide an SSL cert).