In this case, the private key will be included in the site code and anyone can read it.
No, the private key is not in the "site" code, it is not send. It is just used to authenticate the TLS session, by placing a signature that can be verified with the public key in the X.509 certificate. This certificate has been exchanged before in the handshake and it has been verified & validated in the browser. The private key must be kept private, as the name implies.
How can I send a secret message encoded with a key (key1) and only able to be decoded with another secret key (key2), which I only know it, (using ECDSA).
The ECDSA encryption method cannot be used to encrypt messages to keep them confidential. But it can authenticate the handshake. This handshake establishes the session keys, commonly by performing (EC)DH key agreement using two temporary (ephemeral) key pairs generated both by the client and server. These symmetric session keys can then be used to protect the messages.
If you want to perform encryption with Elliptic Curves then you should have a look at the Elliptic Curve Integrated Encryption Scheme or ECIES.
Minimal description of ECIES
For ECIES the sender generates an message specific EC key pair.
The sender then performs key agreement with the generated private key and the (trusted) public key of the receiver. The sender then uses the resulting key material for normal symmetric encryption. The message specific private key of the sender can be discarded after the symmetric key has been derived; it is just needed to calculate the symmetric key once.
The established symmetric key can be used with any block cipher mode of operation - or indeed with a stream cipher to create the ciphertext. It would of course be a good idea to use authenticated encryption to do this. The message specific public key and ciphertext can be combined and send to the receiver.
The receiver then performs his own key agreement with the receivers static private key and the senders message specific public key. This should derive the same symmetric key, which can finally be used to decrypt the ciphertext.