Without TLS, everything sent between a visitor and your app, including passwords, session cookies and personal data, crosses the network as readable text. TLS gives three guarantees: the traffic is encrypted so others cannot read it, it cannot be altered in transit without detection, and the server proves its identity with a certificate.
Hosting platforms turn TLS on for your main domain automatically, which is why the gaps tend to sit at the edges. Typical ones are a custom API subdomain or self-managed server still answering over plain HTTP, a database connection made without TLS, or a server that still accepts old protocol versions. TLS 1.3 is the current version, TLS 1.2 is still widely accepted, and older versions should be switched off.
Serve everything over HTTPS, redirect HTTP to HTTPS, and add an HSTS header so browsers stop trying the insecure version. Require TLS on connections to your database and other backend services too. TLS protects data in transit only. It does nothing for data once it has arrived, so it is no substitute for access control.