The biggest barrier to HTTPS is the fact that it's a royal pain in the ass for someone who's not an OPs guy to set up. Unless you're on a shared host or some sort of PaaS that sets your certificates up for you, it's basically a big "go fuck yourself" to get everything installed and configured properly.
Even the Mozilla article linked in the top comment asks you to choose a ciphersuite. Who the heck has time to know and understand what to use, and then figure out how to make it work on their own server?
Oh, the version of Apache you're running combined with the version of OpenSSL that comes pre-installed on your Linux distro causes "Re-negotiate handshake failed" errors? Good luck finding the answer to that on StackExchange.
For most folks that are just trying to ship something, unless security is a huge issue HTTPS doesn't come first because it's simply too much work. And if HTTP works out of the box, there's little incentive to turn on HTTPS.
Even the Mozilla article linked in the top comment asks you to choose a ciphersuite. Who the heck has time to know and understand what to use, and then figure out how to make it work on their own server?
Oh, the version of Apache you're running combined with the version of OpenSSL that comes pre-installed on your Linux distro causes "Re-negotiate handshake failed" errors? Good luck finding the answer to that on StackExchange.
For most folks that are just trying to ship something, unless security is a huge issue HTTPS doesn't come first because it's simply too much work. And if HTTP works out of the box, there's little incentive to turn on HTTPS.