I would like to commend myself on accomplishing a very trivial task – set up a blog. Ordinarily I would have tried every esoteric trick possible before trying something obvious.
I enabled HTTPS for my site. But the unencrypted style (HTTP) was still working. Okay, I am not running anything commercial. But I wanted to see how hard it would be. Without any control over the running web server (I use a cheap hosting service). Answer? Just installed a plugin WordPress Force HTTPS. And voila, I now have forced HTTPS, even if someone were to try plain HTTP!
$ wget http://nbhat.in/ --2017-01-10 17:07:02-- http://nbhat.in/ Resolving nbhat.in (nbhat.in)... 18.104.22.168 Connecting to nbhat.in (nbhat.in)|22.214.171.124|:80... connected. HTTP request sent, awaiting response... 301 Moved Permanently Location: https://nbhat.in/ [following] --2017-01-10 17:07:03-- https://nbhat.in/ Connecting to nbhat.in (nbhat.in)|126.96.36.199|:443... connected. HTTP request sent, awaiting response... 200 OK Length: unspecified [text/html] Saving to: ‘index.html’ index.html [ <=> ] 17.50K --.-KB/s in 0.05s 2017-01-10 17:07:03 (332 KB/s) - ‘index.html’ saved 
YAY! On to the next challenge!