It's 2019 and I still see websites not utilizing HTTPS on their websites.
I see websites with the option for HTTPS, but they don't force HTTPS.
Look, I get it. SSL certificates used to be a bit more out of reach for the common web developer.
It's easier now. You can get a Let's Encrypt certificate pretty much anywhere, any time. You can easily pop a few lines of code and force HTTPS. Hell, most web hosts can do this for you.
Get a certificate and get your site secure.
You don't want to be the person who regrets not doing it sooner.