I have a website residing on a domain with a valid SSL certificate that is fully using HTTPS. If I take form data from this site that is secured with an SSL and send it to a non-secure HTTP endpoint using a cURL POST is the transmission fully encrypted considering it's going from an HTTPS site to an HTTP endpoint?

  • 1
    Definitely not. Cloudflare is the easiest way to get the other site SSL-encrypted.
    – The Onin
    May 29, 2018 at 14:35

1 Answer 1


Short answer: no, it is not encrypted.

The only thing that matters is the URL you are using to send content, what happened before is irrelevant.

If you are sending your content to an HTTP URL then it is not encrypted, end of story (except some rare corner cases that you should not rely on, like HSTS preloading where a browser would automatically do an HTTPS request instead).

  • Thanks. I suspected this was the case, but wanted to make sure before I did it!
    – AndyWarren
    May 29, 2018 at 18:00
  • 1
    @AndyWarren If you want to be sure (in general), launch a network scanner such as Wireshark on your computer to see what goes out, and click Send to see what is posted on the wires. May 29, 2018 at 18:02
  • "like HSTS preloading" - although the OP is using a cURL server to server request, so any "HSTS preloading" in the browser would not apply here anyway.
    – MrWhite
    May 31, 2018 at 19:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.