Besides that, you might want to add a 301 URL redirect to 
  your web server to force people to only use SSL and avoid 
  the fatal mistake of someone forgetting to type http_s

Is there any other way to do this. If a user makes a non SSL request to my server they have potentially already leaked information in that request, especially if it is a post. Cookies etc are all exposed.

Is there a best practice to prevent users making this first incorrect request in the first place?