What is the difference between HTTP and HTTPS? What is encrypted — headers, body, or URL?

HTTP (HyperText Transfer Protocol) is an unencrypted data transfer protocol, whereas HTTPS is HTTP over TLS/SSL, providing a secure encrypted connection.

Main differences:

• Encryption: HTTPS encrypts all traffic between the client and server, including headers, request and response bodies, as well as URL paths and parameters.
• Security: HTTPS protects against eavesdropping, tampering, and "man-in-the-middle" attacks.

What exactly is encrypted:

• HTTP headers: are encrypted, so they cannot be read by intermediaries.
• Request and response bodies: are also encrypted.
• URL: the path and parameters in the URL (e.g., /page?id=123) are encrypted, but the domain name (e.g., example.com) is not encrypted, as it is needed for establishing the connection and routing.

Thus, when using HTTPS, all transmitted information except the domain is protected from interception.