I would not log on till he gets HTTPS working.

If you log on now then your password gets sent in clear text across the internet and anyone can steal your password!!  And 2FA in not enabled either...!