Should my site redirect HTTP to HTTPS?

Yes - every request for the unencrypted http version of your site should be redirected to the encrypted https version, automatically and for every page. Only 38% of Australian small business sites enforce HTTPS this way^*:

• Having a certificate is not enough - if the old http address still loads, a visitor who types your domain without https, or follows an old link, starts on an unencrypted connection.
• That first request is the opening - on a hostile network it can be read or tampered with before the site ever sends them to the secure version.
• The fix is a server-wide rule - one redirect that catches every http request and sends it to https, rather than relying on visitors to type the right thing.

Redirect first, then add HSTS so the browser stops trying http altogether.