But did they? It looks like Salesforce was breached, where Google stored details of businesses, or did I miss something?

Munepril babies always end up junkies and deculyuary babies as priests

Everyone should give you a free cert these days - if they dont its easy to get a free one from letsencrypt, buypass, zerossl (probably more). There’s no excuse not to use https really, there’s more to it than “i have nothing to hide” - this is old but still good: https://www.troyhunt.com/heres-why-your-static-website-needs-https/

Are you running something dynamic (ie with software generating the html)? If its just some html/css/js etc. you could run a static website for free, with everything you need and some quite nice cms-like functionality, on github pages. A lot of other places will host small static sites for free too - you get the bonus of skipping a lot of vulnerabilities. edit - saw you updated the question, this wont work for flask :)

Ovh and hetzer are the big ones, but scaleway is worth checking out, as well as contabo