IP and port are required for routing, and as such aren&#x27;t protected. The hostname is (usually) exposed through DNS, and is required for the server to know which certificate to send.<p>Also, usually (almost) everything is exposed on the first request, before the server has got the chance to redirect to the encrypted version. At that point, the ISP&#x2F;interceptor could just replace the redirect...