[geofft]

HSTS also protects external URLs; an old link to http://news.ycombinator.com gets internally rewritten to https://news.ycombinator.com without making the cleartext request. So HSTS is a more general solution.

Probably there will come a time when attempting HTTPS first instead of HTTP for manually-typed URLs without a protocol is the right default, but that's just a subset of the problem.

[Buge]

Couldn't dmm's proposal be used for links as well?