Both the blog and the homepage are served over TLS for me. And they’re forcing plaintext to TLS ... so not sure what’s wrong on your end.