Question: can https headers be sniffed?
Answer: 5 Answers. The entire HTTP request (and response) is encrypted, including the URL. ... which is not over HTTPS, the full URL could be sniffed in the Referer header. Same if the user click on a link in the page that leads to an HTTP (no SSL) page.