I'll quote myself from another topic about this:
HTTPS Everywhere is installed by default on Tor. If you aren't using Tor, HTTPS Everywhere is one of the few extensions that you should download.
However, simply installing it isn't enough. Its default behavior is to force HTTPS whenever it can, but still allow HTTP connections. You need to click on the little icon up in your menu bar (a white "S" in a blue square) or go in to your extension options and enable the option to "Encrypt All Sites Eligible". This will block all connections to HTTP sites and display a large warning page whenever a HTTP connection is made which allows the user to choose whether to proceed at their own risk.