The site is manually redirecting you to the HTTPS version of the site, typically using the HTTP 301 redirect status code. This is not as secure as HSTS because it is vulnerable to a MITM attack, but it does cause you to transparently switch to the encrypted version of the site. This behavior must be configured in the server to work. The server can either be made to automatically perform the 301 redirect on all pages, or only for certain pages such as those with password input fields.
The client first sends a request to the non-encrypted version of the site:
GET /index.html HTTP/1.1
The site then responds with a redirect:
HTTP/1.1 301 Moved Permanently
This instructs your browser to send another GET request, this time to port 443 with TLS.
Note that, even when HSTS is used, this is still necessary for the first connection. HSTS headers are only allowed to be set over the HTTPS protocol, so a redirect is usually used to tell the browser to use the encrypted protocol the first time. Only after that will the browser remember that it should rewrite all requests to the encrypted version of the site without being told first.