Hacked

If you really think you have been hacked.  Start by changing your Apple ID password on another uncompromised device or PC.  Change any and all other passwords you think are compromised as well and make sure none of them are easy to guess.  Then, factory reset your iphone.  

Any web browser is going to give you that not secure error when you type a website into a browser where it doesn't switch the http to https.  Even allowing the browser to "upgrade" the connection to https is misleading because the site still is not using a secure connection unless the weaster or site admin has set it up to only accept https connections.  It's more or less a stupid scare tactic that is meaningless.  Your social media mine and steal more info about you every hour than most websites that are not using https do.  Just because something might not be secure, doesn't mean hackers are waiting to steal all of your info.