Comment by Too

Enabling HTTPS only should stop this right?

Or are they able to inject it even then since they are the hosting provider?