I am not safety expert, but does not it depend on some settings on your side?
If i enter basicstero, I see a green lock in the firefox address line and it says - secure connection. If you enter it so: https int.basicstero.ws/
You will for sure have it secured. Our site supports https.
For firefox I advice to use the addon HTTPS Everywhere. It will ensure you use only secure version of any site, if it supports it.
But, generally you are right. If https is in some cases not enabled by default, its our fault. I put it into nr. 1 priority tasks list to double check and fix.