[toong]

For this to work properly, it requires https only, to prevent downgrade attacks (you stated that).

Google analytics is also served both over http & https ? Can anyone shine a light on that ?

[pingooo]

From https://developers.google.com/analytics/devguides/collection...

ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';