Firefox.com is on the HTTP Strict Transport Security preload list, so all connections to this server will use HTTPS; clear HTTP will be upgraded. They also use HTTP Public Key Pinning for extra protection against man-in-the-middle attacks. However, as of January 2018, their Web server supports weak key exchanges (1024-bit DH parameters), making downgrade attacks possible.