HTTP does not redirect to HTTPS
Effort to fix: Quick win (under an hour)
Why it matters
Visitors who type your domain or follow old links land on the insecure version, which can be intercepted before they ever reach HTTPS.
How to fix it
Add a permanent (301/308) redirect from every http:// URL to the same https:// URL at the server or CDN level.
On WordPress
Most hosts have a 'Force HTTPS' toggle. Otherwise add the redirect in .htaccess (Apache) or the server block (Nginx) rather than in a plugin, so it happens before WordPress loads.