SeedProd Plug-in easily bypassed with simple HTTP

When using the SeedProd plugin to set maintenance mode, it works flawlessly when accessed via a HTTPS link. When using a simple HTTP link, the site is fully visible. Is this normal? If not, how to avoid?

• This topic was modified 3 years, 1 month ago by Jan Dembowski. Reason: Moved to Fixing WordPress, this is not an Everything else WordPress topic