(I tend to find something HTTP-only about once a day, normally on sites that have been around for over ten years. Normally I’d just shrug if it’s a content site, but this being for making web apps, I figured it was worth commenting on.)
The only thing I can think of is my ISP injecting some HTML at the top of the page. Something that I haven’t seen for years.
Every connection that happens over unsecured HTTP is a connection that can be hijacked by middlemen for nefarious purposes, both for spying and for attacking.
Encrypting as many connections as possible is a form of herd immunity. Encrypting even unimportant "marketing" websites protects everyone on the web by raising the cost of interception and lowering the benefits.
It's also about the entire internet & its users, not just threat models on specific sites.
We can't ask the general public to consider threat models and evaluate what sites should need HTTPS or just HTTP. General, non-technical intuition is basically useless for this eval; it's not a good path.
It's much smarter to just make HTTPS the default, make it easy & free for any site to provide it, and then let browsers show big warnings for any site that's not secured.
(Browsers are moving this way already)
In many countries MITMing your page and replacing its contents, or using it to serve malware to targets is a frequent case.
What is the ISP injecting into page?