No HTTPS
Effort to fix: Moderate (a few hours)
Why it matters
Without HTTPS, anyone on the network path can read or modify what visitors see and submit. Browsers label the site 'Not secure' and search engines rank it lower.
How to fix it
Install a TLS certificate (free from Let's Encrypt or your host/CDN), serve the site over https://, and redirect all http:// requests to it with a 301.
On WordPress
After the certificate is installed, update Settings > General so both URLs use https://, then run a search-replace on the database for old http:// links.