Wp-login.php directs to https

That https prefix indicates that the login is over a secure connection, which isn’t a bad idea. To the best of my knowledge WordPress doesn’t force, and has never forced, https (ssl) logins by default, but you can configure it to do so. I suspect that a developer or a plugin altered the settings. You will need to figure out which.