I've used the code below to force pages that need to use SSL to use https. However once going to a secure page all other pages on the site / menu use https. How can I force all pages to use http and only the ones required to use https?

if(Director::isLive()) {
Director::forceSSL(array('/^members/','/^admin/', '/^Security/'));
}

I'm not sure how forceSSL works, but have you tried

Director::setBaseURL('http://www.mysite.com');

PS - I started out using SS 2.4 so tend to do stuff in _config.php that can probably be done in yml...

Thanks for that but I'm afraid it didn't work.
It forced the base tag but, which is fine in http: but it broke https pages. Also it made the canonical link double up as below.
<link href="http://www.mysite.com/http://www.mysite.com/home/" rel="canonical">

If I removed <% base_tag %> from the page template then the menu disappeared on secure pages.

Really we need a forceSSL :false type statement to make all other urls not use it.