HTTPS everywhere
Payment flows must run over HTTPS. Mixed content (HTTP assets on HTTPS pages) can break browsers’ security indicators.
Redirects and HSTS
Enforce HTTPS with 301 redirects. HSTS (with care and testing) can prevent downgrade attacks once you are fully HTTPS.