From the source
Replit announced that all HTTP server repls on its platform are now HTTPS-first by default.
The proxy redirects HTTP requests to HTTPS before they reach the app, and serves HTTP Strict Transport Security headers.
Replit manages around half a million HTTPS certificates using ACME with Let's Encrypt, using HTTP-01 validation for custom domains and DNS-01 validation for wildcard certificates on the repl.co domain.
