Limesurvey prior to 3.17.14 does not enforce SSL/TLS usage in the default configuration.
limesurvey limesurvey