Exactly. TLS is, as the name implies, at the transport layer (TCP). (TLS is the same thing as SSL, the "S" in HTTPS, unless someone wants to be pedantic.) Every

Exactly. TLS is, as the name implies, at the transport layer (TCP). (TLS is the same thing as SSL, the "S" in HTTPS, unless someone wants to be pedantic.) Everything that is at the HTTP level gets encrypted. The only exception to this is (sometimes) the hostname through a process call SNI (Server Name Indication), which sends the hostname as part of the TLS setup before an encrypted session is setup so that the server knows which website's certificate it should be using. This is the only way that you can host more than one website on a single IP address (unless they all share the same wildcard certificate or a single cert has an alt-name for each).