It working, but you didn’t force HTTPS, so trying to visit your site over HTTP would also work which is always “unsecure”.
Please read: