Comment by amiga-workbench

Regarding https, one thing I like to do on my personal websites is listen if the client actually wants to upgrade protocols instead of forcing https on everyone.

  set $need_http_upgrade "$https$http_upgrade_insecure_requests";

  location / {
    if ($need_http_upgrade = "1") {
      add_header Vary Upgrade-Insecure-Requests;
      return 301 https://$host$request_uri;
    }

    index index.php index.html;
    try_files $uri $uri/ /index.php?$query_string;
  }

Its pretty straightforward to do in nginx, and my websites remain usable in IE5, Contiki, various feature phones.