It should also be mentioned that they certainly aren't actively pushing people to the secure site. You would only get it if you manually typed it in, or are using HTTPS Everywhere.

And the forums, the only place you would actually log in, don't even have a secure version: https://forums.xkcd.com/