Is HTTP encrypted?

• A. Sometimes
• B. No
• C. Yes
• D. Only with TLS

Answer: (B)

HTTP is not encrypted by design. It defines a plain-text request/response format, so without an added security layer, headers and body travel in the clear. Encryption comes from using TLS with the HTTP protocol—i.e., HTTPS (HTTP over TLS). So when you use http:// you’re not encrypted; when you use https://, the connection is encrypted by TLS. The option that implies encryption only with TLS reflects the HTTPS scenario, but the HTTP protocol itself is not encrypted unless you switch to HTTPS.