[aj3]

Without encryption active attacker could redirect users to different website, which would collect more data than your website does normally. They could also inject ads and javascript into users' sessions through your website.

[Const-me]

If an active attacker has sufficient motivation, hacking user's computer is way more profitable than messing with their home router in the middle.

[rdedev]

Redirecting an unencrypted webpage could be the first step a hacker uses to take over a user's computer. It's best to minimize attack vectors as much as possible