Serve the site over HTTPS

Problem

The site is crawled over plain HTTP — either HTTPS is not offered or HTTP does not redirect to it.

Why it matters

• Anyone on the network path can read and modify the traffic.
• Browsers mark HTTP pages "Not secure"; HTTPS is a ranking signal.
• Modern features (HTTP/2, HTTP/3, service workers, geolocation) require HTTPS.

How to fix

1. Obtain a certificate (Let's Encrypt is free and automatable).
2. Redirect all HTTP traffic: return 301 https://$host$request_uri; (nginx).
3. Point rel=canonical and internal links at the https:// origin.
4. Add HSTS once everything works: Strict-Transport-Security: max-age=31536000.