Why no padlock says all good, but no padlock

Both HTTP and HTTPS versions of a site can exist simultaneously. By default when you type the name of a website in by itself, the browser will assume you want the (insecure) HTTP site.

Things you can do about this:

You can set your site to redirect visitors who arrive at the HTTP site to the HTTPS site. The method to do this will depend on your web server software etc.

Once people visit the HTTPS site you can set the HSTS header (Google that) to tell their web browser to visit only the HTTPS site after that, and never the insecure one.