There are numerous ways these days you can solve this. The first one I would recommend is making sure that you have set Strict-Transport-Security, you can do this in your .htaccess file like this:

Header always set Strict-Transport-Security "max-age=31536000" env=HTTPS

You can also set your Content-Security-Policy, one of the values is for making sure http requests get upgraded to https. There is much more you can do with content security policies, I would recommend reading up on that, but at the very minimum and to help solve your problem you would want to set something like this in your .htaccess file.

Header always set Content-Security-Policy "upgrade-insecure-requests"

For these headers you could also set these in PHP directly (instead of htaccess):

header('Strict-Transport-Security: max-age=31536000');
header('Content-Security-Policy: upgrade-insecure-requests');

Finally another way is to create a RewriteRule in your .htaccess file:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [L,R=301]

You can use one or more of these methods simultaneously. I usually keep the RewriteRule in case older browsers or bots don't understand or support the other directives.

Enable HTTPS-Only Mode in Firefox. This is a security enhancement that forces all connections to websites to use HTTPs while browsing websites with Firefox.

To enable HTTPS-Only mode, in Firefox:

1. Click the menu button and select settings
2. Select Privacy and Security on the left side
3. Scroll down to the very bottom where it says HTTPS-Only Mode
4. Use the radio button to enable or disable HTTPS-Only Mode, or you can set it to only be enabled for private windows.

You can also set exceptions for websites that should not utilize HTTPs-Only mode if you choose to have it enabled.

Here is a screenshot of what the area looks like: