In reply to J-F Arseneault.

Correct, the protocol won’t be changed in the database, but on the fly. The dynamic replacement is very simple, I would be surprised if it had a noticeable difference in performance.

And yes, Site Health will consider the site “secure” as long as it is served over HTTPS. It doesn’t check the contents of the database.