domain - The domain is and *., detectable with rDNS or SNI.

proto - There are only two protocols in common use, HTTP and HTTPS.

Note that, although the Host header is also in the header body and thus encrypted, the host can still be obtained through rDNS lookup on the IP address, or by checking SNI, which transmits the domain in plaintext. This includes the page you are accessing with the GET method. TLS works on a different layer, making all of this encrypted. These are the headers sent directly to the site over TCP. Which would tell the client that the correct location is elsewhere. Thank you Mario, but our princess is in another castle! An example, giving a 301 redirect and some plain text as a response, may be: The server will then respond with an HTTP status code, some headers of its own, and optionally some data (such as HTML). This text, as ASCII, is sent to the server: Take this example, with wget loading the page /some/page.html. In HTTP, the path in the URL is sent along with the header body.

TLS encrypts the entirety of HTTP traffic, including the headers and method. The most common methods are GET, POST, and HEAD, which retrieves a page, transfers data, or requests only response headers, respectively. HTTP works by sending two things to a website: the method, and the headers.

TL DR An attacker cannot see anything past the domain.

Wireshark sniff https