> I can tell you for certain that when I was connecting to my own website, there was no attacker trying to "steal my credit card."

Of course, no one can actually be certain of this, because any MITM could have injected anything they wanted into the website, including something asking for your credit card (which they would then steal). Plain http is commonly MITM'd to inject tracking and ads, even on an ISP you pay for with money, and has been for decades at this point.

Just because you own the website does not mean you get to choose the threat model your visitors have to operate under.