Is my website vulnerable to a man-in-the-middle attack?

@sjr Well, doing that immediately triggered error 521 so I assume that I’ll have to implement TLS on the origin, right?