Install a free SSL certificate in your hosting panel (AutoSSL or Let's Encrypt), open your site with https:// to check the padlock, then switch on Force HTTPS under Settings › Security and access › Hardening in TGGroups 1.2 and set APP_URL in .env to the https address.