It looks to me like you're on the defaults. Can I ask you to navigate to:
https://[yourdomain]/admin/security/config ?
At the top it will say Protocol, and I'm assuming it currently says "http and https" . Ideally that wants to be "HTTPS Only". Be aware that changing that can have wider impacts on your configurations, so you need to be 100% sure that you're not using HTTP anywhere.
Looking at your site, if you ask to view something in the "JavaScript Viewer":
ArcGIS API for Javascript: AirportMapApplication/AirportFacilities (wa.gov)
then that is the 4.x libraries. If you ask for the same in your AGOL viewer, then yes it's v3.x libraries:
https://wsdot.maps.arcgis.com/home/webmap/viewer.html?url=http%3A%2F%2Fdata.wsdot.wa.gov%2Farcgis%2F...
Your rest handlers are configured to the default to send you to the v3 map, you need to change those to point to the 'new' map viewer:
https://wsdot.maps.arcgis.com/apps/mapviewer/index.html?url=http%3A%2F%2Fdata.wsdot.wa.gov%2Farcgis%...
So in this part of the server API:
https://[yourdomain]/hosting/admin/system/handlers/rest/servicesdirectory
change the ArcGIS.com URL: from:
https://wsdot.maps.arcgis.com/home/webmap/viewer.html
to:
https://wsdot.maps.arcgis.com/apps/mapviewer/index.html
By forcing everything to HTTPS and this change you should end up with:
https://wsdot.maps.arcgis.com/apps/mapviewer/index.html?url=https%3A%2F%2Fdata.wsdot.wa.gov%2Farcgis...
Scott Tansley
https://www.linkedin.com/in/scotttansley/