There are multiple reasons. Some low-traffic sites might not find it worthwhile to invest in an HTTPS certificate. Some website owners might consider they don’t collect enough user data to warrant the need for encryption. Some website owners still use outdated hosting services, and don’t know they’re missing out on a secure connection.  Virtual hosts can host multiple websites from the same server, which makes them a very cost-efficient option, but almost all virtual hosts don’t support HTTPS. And lastly, HTTPS makes it more difficult to cache data across sessions, so data miners might choose not to implement it.