System -> Admin Security -> Security offers three choices in firmware 6.3.3 on a Surf SOHO. The names of these options could be clearer.
HTTPS should be “HTTPS only”
HTTP should be “HTTP only”
HTTP/HTTPS should be “Either HTTP or HTTPS”
and since HTTP has no security, the field should be called “access protocol” rather than “security”.